Someone Is Using Your Website Images? What to Do About Image Theft

In this guide, we at Talha Aslan and team focus on one situation only: photos you took or commissioned showing up on someone else's site. Copied text is a separate problem, and we cover it in our guide on what to do when a scraper site outranks you and how to file a DMCA removal request. Here, we walk through finding copies, collecting proof, blocking hotlinks and getting images removed.

Note: This article is general information, not legal advice. For cease and desist letters, lawsuits or damages, talk to a licensed attorney.

How do you find out someone is using your images?

In practice, most people find out by accident. For example, a customer mentions seeing your product on another store, or you spot your own photo under a different domain in Google Images. Still, a regular check works better than waiting for luck.

Common warning signs include:

• Image requests in your server logs coming from sites you do not recognize.
• A sudden, unexplained jump in bandwidth on your hosting plan.
• Reverse image search results showing your product photo on other pages.
• Marketplace or social media listings with your exact angle, background and lighting.

Also, each sign points to a different kind of misuse. A bandwidth spike usually means hotlinking. A copy in search results, on the other hand, means someone downloaded the file and uploaded it to their own server. That difference decides your next steps.

There is also a mixed case. Sometimes a site copies your photo and also lifts your product name, description or pricing copy. In that situation, keep separate records for the image and for the text. Then handle the text side with the DMCA guide linked above and the image side with the steps below.

How do you use reverse image search to find copies?

Reverse image search means you give the search engine a picture instead of words. Google's official help page on how to search with an image on Google explains the desktop options. You can upload a file, drag it into the search box or paste the image link. In Chrome, you can also right-click an image and choose to search it with Google Lens.

For an efficient sweep, we suggest this order:

1. Pick the 10 to 20 product or project photos you invested the most in.
2. Search each one in its original, uncropped form, because full files tend to return more matches.
3. Check the exact match and similar image sections of the results.
4. Log every page URL you find in a spreadsheet.
5. Repeat the sweep every few months.

Also keep in mind that cropped or mirrored copies do not always show up. So it helps to search a distinct section of the photo as well. A close crop of a unique detail, like a logo on packaging or a distinctive texture, often surfaces copies that the full image misses.

What is hotlinking and why does it hurt your site?

Hotlinking means another site displays your image by calling your file URL directly instead of uploading a copy to its own server. A visitor opens their page, but the image loads from your server. As a result, you pay for the traffic while they get the benefit.

In practice, hotlinking can cause these problems:

• It eats into the bandwidth and resource limits on your hosting plan.
• Your own pages may slow down during busy periods.
• The other site presents your product as if it were theirs.

That said, hotlinking has one upside for you. The file still lives on your server, so you stay in control. If you rename the file or serve a different image to outside requests, the picture on their site changes right away. With a copied and re-uploaded image, you have no such lever.

Is it hotlinking or a copied file?

To tell the two apart, right-click the image on their page and open the image address. If the URL starts with your domain, you are dealing with hotlinking. If it starts with their domain, someone copied the file. The table below compares both cases.

In short, you fix hotlinking with a technical setting and you fix copying with a notice process. Some sites do both at once.

One caveat when you check the address: some sites route images through a CDN under their own domain. In that case, the URL may show their name even though the file still comes from your server. When in doubt, look at your server logs, because requests for your file will show up there and settle the question.

How do you turn on hotlink protection?

Hotlink protection means your server checks which site an image request comes from and only serves the file to domains you allow. Browsers usually send referrer information with each request, and the server decides based on that. It is not airtight. Still, it cuts the load significantly.

We usually see three ways to set it up:

1. If your hosting control panel has a hotlink protection section, add your own domain and subdomains to the allowed list.
2. If you use a content delivery network (CDN), turn on the matching protection in its dashboard.
3. If neither option exists, ask your hosting provider's support team to configure it on the server.

Be careful with one thing, though. Do not block the access that Google, other search engines and social media link previews need. A wrong setting can hurt your visibility in Google Images and break your share previews. So after you turn it on, test your own pages and a social share preview right away.

Also decide the scope early. Protecting JPG, PNG, WebP and GIF files is usually enough. However, if other sites also pull your PDF catalogs or videos, consider adding those file types too.

Does renaming the file stop hotlinking?

In the short term, yes. Their page keeps calling the old address, so the image simply disappears. This works well if your control panel has no hotlink protection or you need a quick fix. However, you also have to update every link on your own site, or you will end up with broken images on your pages.

When you rename a file, follow this order:

1. Choose a clear, descriptive new file name.
2. Move every use on your own pages to the new URL.
3. Clear your site cache and, if you have one, the CDN cache.
4. Instead of deleting the old URL, you can place a plain notice image there.

On the other hand, the other site may notice the new address and link to it again. So treat renaming as a temporary measure and hotlink protection as the lasting fix. Also note that renaming an image that ranks well in Google Images can affect its visibility for a while. Weigh that before you decide.

What can your server logs tell you?

The access logs in your hosting panel can show which sites are pulling your image files. Each request usually lists the referring address. So if one image file gets lots of requests from a domain you do not know, that site is most likely hotlinking it.

Still, read these logs with a few things in mind. Search engines and social platforms also fetch your images through preview bots, and that is not misuse. In addition, some browsers and privacy extensions do not send referrer data, so logs never give you the full picture.

Here is an example scenario. A small furniture workshop notices its bandwidth climbing quickly. In the logs, the most requested file turns out to be a sofa photo, and most requests come from a classifieds site the owner has never heard of. Now the owner knows the source from records instead of guesswork and can aim the hotlink protection at the right target.

How do you collect evidence before you send a notice?

Above all, every notice rests on the same question: is this image really yours? So build your evidence file before you contact anyone. Even if they remove the image, this file will help later.

• The exact URL of the page with the copy, not just the homepage.
• A full-page screenshot that shows the date and time.
• Your original file, ideally the raw or highest-resolution version from the camera.
• The page on your site where the image first appeared and its publish date.
• If a photographer shot it, the contract or emails that show your usage rights.

For instance, if you have several frames from the same shoot, those are strong proof, because the copier usually has only the frame you published. Keep all evidence in one folder, sorted by date. That way, you reuse the same package for every notice.

Add a short summary file to the package too. In a few sentences, write when, where and by whom the photo was taken, and which product or project page uses it. Notice forms often limit the description field. A ready summary keeps your story consistent and lowers the risk of a factual mistake.

Do you actually own the rights to the image?

Before you claim image theft, make sure the rights are yours. If you took the photo yourself, the answer is simple. If a photographer or agency shot it, however, the rights stay wherever the contract put them. We cover this in detail in our guide on who owns website source code and copyright.

Stock photos are a different story. A licensed stock image appearing on another site is often not infringement, because other businesses may hold the same license. That gap is also why the choice between professional photography and stock photos matters: custom shots are the only images you can clearly prove you own.

Likewise, product photos you received from a manufacturer usually belong to the manufacturer. In that case, the rights holder files the notice or authorizes you to do it on their behalf. Ask for that authorization in writing before you act.

Can a watermark really prevent image theft?

A watermark is a logo or text you place on top of an image. It does not stop copying completely, but it makes copying harder and makes the source visible. Someone can crop or edit it out. Even so, that extra effort discourages a large share of casual copying.

Keep this balance in mind when you add one:

• A small logo in the corner is easy to crop, so a faint mark that overlaps part of the product works better.
• A heavy watermark can reduce the sales impact of a product photo.
• Use a light mark on main product images and a more visible one on gallery and detail shots.

Also remember that a watermark alone gives you no legal protection. Protection comes from owning the work. The watermark only makes ownership visible and strengthens your evidence. In the U.S., removing copyright management information can itself be an issue under the DMCA, which is one more reason to keep that information on your files.

Why does IPTC copyright metadata help?

IPTC metadata is information stored inside the image file, such as the creator, copyright notice and credit line. According to Google Search Central's documentation on image license metadata, Google can read the Creator, Copyright Notice, Credit Line, Web Statement of Rights and Licensor URL fields. The same page notes that Google uses structured data when it conflicts with IPTC data.

This helps you in two ways. First, if someone downloads the file and does not strip the metadata, your ownership details travel with it. Second, creator and license details can appear in Google Images. We explain the setup step by step in our guide to IPTC image metadata for Google Images.

One warning, though. Many compression tools and content management systems strip metadata when they shrink files. So check that the information survives after you optimize your images.

What should your message to the site owner say?

In practice, the first step often works fastest. Many site owners think they got the image from a supplier, a template or a search result, and they remove it once they hear from you. So keep your first message calm, clear and backed by evidence.

Your message should include:

1. Who you are and that you own the image.
2. The exact URL of the page where the image appears.
3. The URL of the original on your site and its first publish date.
4. Your clear request: removal or a licensing conversation.
5. A reasonable deadline for a reply.

You can usually find contact details on the contact page, about page or legal notice. Avoid threats. Then again, you can mention that you may pursue other options later if the image stays up.

How does a DMCA takedown notice work?

The Digital Millennium Copyright Act is the U.S. law behind most online takedown requests. According to the U.S. Copyright Office's DMCA page, Section 512 sets up a notice and takedown system that lets copyright owners get infringing material removed without filing a lawsuit. In return, service providers that meet certain conditions get safe harbor protection.

To qualify, providers must act promptly once notified. They also need to designate an agent to receive notices, publish that agent's contact details and register the agent with the Copyright Office. In practice, this means you can often find where to send your notice.

• Look for a DMCA or copyright page on the host's or platform's website.
• Check the Copyright Office's designated agent directory.
• Include your evidence package and the exact URLs.

Above all, be accurate in every notice. A takedown notice includes a statement that the information is correct, so only file for images you clearly own or are authorized to enforce.

How do you notify the hosting provider?

If the site owner does not reply, the next contact is the company hosting the site. You can usually identify it through domain lookup data and the server's IP address. Most hosts have an abuse email or a copyright form, often labeled as a DMCA contact.

In your notice, repeat what you sent the site owner and include the date of your first message. That shows the host you tried the owner first. Then the host may warn the customer, ask them to remove the image or, in some cases, restrict access to the page.

However, speed and outcomes vary from host to host, so do not expect a fixed timeline or result. If you hear nothing back, send the notice once more and reference your first message. If the site sits behind a CDN, the CDN provider usually forwards the complaint to the actual host.

How do you use Google's copyright removal form?

Google can only restrict access within its own products. In other words, even if the copy stays on the site, you can ask Google to remove it from search results and Google Images. Google's page on reporting copyright infringement explains that Google responds to notices under the DMCA and accepts them through a web form.

The official tips, in brief:

• Choose the Google product where the content appears and your reason for reporting it.
• Enter the exact URL of each page, not the homepage.
• Explain specifically what infringes and why.
• Send a separate notice for each Google product involved.
• Save the confirmation email and reference number, because Google may follow up.

The same page also recommends contacting the site owner to get the content removed at the source. So the Google form sits next to your notices to the owner and host. It does not replace them.

In what order should you handle image theft notices?

The most common mistake we see is taking steps in the wrong order. Writing to Google before the site owner, or filing with the host before you collect proof, drags the process out. The sequence below is fast and leaves a clear paper trail.

1. Build your evidence package.
2. For hotlinking, turn on hotlink protection or rename the file.
3. For a copied file, send the site owner a written message.
4. When there is no reply, send a notice to the host.
5. If the copy shows up in Google, file the copyright removal request.
6. If the business harm is serious or the use continues, talk to an attorney.

At each step, log the date, recipient and response in one spreadsheet. If you later consider legal action, you will have an organized record. And when you find several copies, the same sheet shows which site is at which stage.

What about copies on social media and marketplaces?

If your image shows up in a social media account or a marketplace listing instead of a website, you deal with a different party. Most of these platforms offer their own intellectual property report forms. So instead of the host, you use the copyright section in the platform's help center.

The basics stay the same: exact URL, screenshot, original file and proof of ownership. Each platform asks for different fields, though, so read its current help page before you fill out the form. Menu names change over time. Instead of relying on exact button labels, search the help center for "copyright" or "intellectual property."

Also, a seller using your photo on a marketplace might be a real reseller who bought from you. Check the business relationship before you report. If needed, tell your resellers in writing which images they may use and on what terms. That makes it clear later which uses you allowed.

Which mistakes should you avoid when responding to image theft?

Image theft is frustrating and can push you toward a rushed reaction. Yet some reactions can put you in a tough spot even when you are right.

• Sending harsh or threatening messages.
• Calling out the site by name on social media, which can give them grounds for a claim against you.
• Swapping a hotlinked image for something offensive.
• Reporting licensed stock images as infringement.
• Filing a notice in your own name when you are not the rights holder.

Take the last point seriously. Many processes, including Google's form and DMCA notices, ask you to confirm that your information is accurate. So for any image whose ownership is unclear, sort that out first. As a safer hotlink response, a plain image reading "this image is used without permission" works far better than anything offensive.

Do right-click blocking and similar tricks work?

Right-click blocking only slows down beginners. Screenshots, browser developer tools and page source still give access to the image. On top of that, such blocks can hurt accessibility and user experience, since some people right-click to open links in a new tab.

Likewise, covering an image with a transparent layer or loading it as a background is not a real fix. These tricks can make it harder for search engines to understand the image, which risks your visibility in Google Images.

Our advice is to rely on protection that is visible and leaves a record: watermarks, IPTC data, regular reverse searches and hotlink protection. In short, choose measures that make life harder for copiers and give you evidence, instead of blocks that punish every visitor.

How do you build a website that resists image theft from day one?

You cannot bring copying down to zero, because anything on screen can be saved one way or another. Still, a few decisions during the build make copying harder and evidence easier to gather. The practical need here is a well-planned image workflow from the start. If that feels like too much to handle alone, our custom website design work plans image sizing, metadata, hotlink protection and CDN settings together.

Specifically, cover these points:

• Publish images only at the size the page needs, and keep the full-resolution master in your archive.
• Confirm that IPTC data survives resizing.
• Add a consistent, light watermark to product images.
• Turn on hotlink protection and test search engine access.
• Organize your image archive by shoot date and project.

For example, publishing at screen size means a copier never gets a file good enough for print or large banners. You can use our image resizer for that step.

Can other technical issues get in the way?

Yes, indirectly. When you turn on hotlink protection or change CDN settings, other technical problems can surface. For example, if the security check on your contact form depends on domain settings, a domain or subdomain change can break the form. Our guide to the reCAPTCHA invalid domain for site key error covers that fix.

Similarly, reprocessing image files can change color profiles and transparency. Visitors using dark mode on their phones may see odd results on logos or watermarks with transparent backgrounds. We explain why in our article on how phone dark mode breaks website colors.

So once your protection settings are live, review your site on desktop and mobile, in light and dark mode. That way you do not fix one problem by creating another. If a wrong thumbnail starts showing in search, see our guide on a wrong image thumbnail in Google search results.

When should you get expert help with image theft?

For instance, one image on one site is usually something you can handle yourself. In some cases, though, outside help saves real time. For example, if hundreds of product photos appear on several sites, if hotlink traffic strains your server or if your images sit in a messy archive with no metadata, one-off fixes will not be enough.

Two kinds of expertise come in at that point. On the legal side, an attorney can assess demand letters and damages. On the technical side, the image setup of your site needs a rebuild. If you are redesigning a business site, our professional web design projects set up the image archive, watermark style, IPTC data and hotlink protection from day one. Then, if image theft happens, you already have proof and control in place.

Finally, keep this in mind: no technical measure stops copying completely, but the right setup shortens every step of the process.