Hotlink could be bypassed with curl, when you set up the referer to the same website the apache will still parse it.