Not really. Hotlink protections at present check the Referer header to see if the request was initiated by another site. Not only can this be bypassed on a brow

Not really. Hotlink protections at present check the Referer header to see if the request was initiated by another site. Not only can this be bypassed on a browser level, HTML5 allows <a> tags to have the rel="noreferrer" attribute, which prevents the referrer from being set. This proposal allows sites to set a cookie (essentially, an authorization token), that must be actively sent for data to be available, and which can only be sent when the site being browsed matches the domain on the cookie.