# Secure media access

## Use signed URLs, on-demand watermarks and basic firewall policies to keep your files from being shared or embedded without permission.

## Signed URLs with configurable expiry

Hand out links that expire when you say so and, if you like, stamp a watermark on every download. Unsigned URLs can be disabled at the account level, so public endpoints never expose originals.

Need finer-grained control? Mark files as _private_ and apply restrictions only to that content instead of enforcing the rule across the whole account.

[Docs – Restrict unsigned URLs](/content/docs/media-delivery-basic-security#restrict-unsigned-urls/index.html)

## Restrict which edits are allowed

Serve images and video only through **named transformations**. By whitelisting specific presets, say, `thumb_320`, you block every unapproved crop, resize or filter a third party might try to apply.

[Docs – Restrict unnamed transformations](/content/docs/media-delivery-basic-security#restrict-unnamed-transformations/index.html)

## Prevent hot-linking and unwanted traffic

A built-in Web Application Firewall (WAF) lets you drop requests at the edge. Block by HTTP referrer to stop hot-linking, by IP or CIDR to shut out abuse, by User-Agent to curb scrapers, or by geo-location to comply with regional rules.

All rules are evaluated at the edge, so genuine users stay fast while freeloaders see an instant denial.

[Docs – Advanced WAF](/content/docs/media-delivery-advanced-waf/index.html)