Protection and Throttling
The Protection and Throttling tabs gate access the moment a viewer clicks Download. Rate-limit settings here can be overridden per category.
Protection tab
| Setting | Default | What it does |
|---|---|---|
| Hotlink protection | Off | When on, downloads cannot be initiated from links on other sites. Requests with no referer header are still allowed, so privacy-conscious browsers and direct links continue to work. |
| Allowed referer hosts | empty | Comma-separated or one-per-line list of additional hostnames allowed to link to downloads. Your board's domain is always allowed. |
| Member download rate limit | 0 | Default downloads-per-hour cap for a logged-in member. After the burst is exhausted, the next download is allowed every (3600 / value) seconds. Use 0 to disable. |
| Member burst allowance | 20 | Default burst allowance for a single member. The bucket refills toward this cap at the per-hour rate. |
| Guest download rate limit | 0 | Default downloads-per-hour cap for an unauthenticated visitor. Use 0 to disable. |
| Guest burst allowance | 5 | Default burst allowance for a guest. |
| CAPTCHA challenge for guests | Disabled | When the CAPTCHA fires for guests. Options: Disabled, Always, On rate limit. Members are never challenged. |
| CAPTCHA pass duration | 30 min | How long a successfully solved CAPTCHA stays valid for the same guest session. Use 0 to challenge every download. |
| Password window | 60 min | Once a viewer enters the correct password, they are not prompted again on the same download for this many minutes. Use 0 to prompt on every attempt. |
CAPTCHA modes
| Mode | When the CAPTCHA fires |
|---|---|
| Disabled | Never. |
| Always | Every guest download attempt. |
| On rate limit | Only when the guest is approaching their rate limit bucket. |
The CAPTCHA uses whichever provider is configured under AdminCP > Setup > Options > User registration > CAPTCHA.
Throttling tab
| Setting | Default | What it does |
|---|---|---|
| Default bandwidth cap | 0 KB/s | Maximum download speed for users whose group does not set its own cap. Use 0 to disable throttling. The per-group Bandwidth cap (KB/s) permission takes precedence. |
To set per-group bandwidth caps, navigate to AdminCP > Groups & permissions > Permissions, edit a user group, and set Bandwidth cap (KB/s) under Downloads user permissions.
Where each setting is enforced
| Setting | Gate |
|---|---|
| Hotlink protection, Allowed referer hosts | Hotlink gate |
| All four rate limit settings | Rate limit gate |
| Both CAPTCHA settings | CAPTCHA gate |
| Password window | Password gate |
| Default bandwidth cap | Bandwidth gate |
The order in which gates run, and how one gate can short-circuit the rest, is documented under access gates overview.
Per-category rate-limit overrides
Each category carries its own copy of the four rate-limit settings. To set them per category, navigate to AdminCP > [MC] Downloads Manager > Categories, edit a category, and open the Throttling section.
A blank per-category value falls back to the global default.
Hotlink allow-list format
Either format works:
example.com
mirror.example.com
example.org, example.net
Spaces, blank lines, and commas are all accepted. Hostnames are matched case-insensitively. Subdomains do not match implicitly: list them explicitly.