tiles.overturemaps.org returns CloudFront 403 for requests with my Referer

[Thibault Durand (tdurand)]

Hello 👋

I run https://maps3d.io , where I render 3D models from overture data. I am facing the following issue since 2026-08-03:

CloudFront returns 403 / Request blocked. for any request to tiles.overturemaps.org carrying a Referer from our domain, maps3d.io. The same request with no Referer, or with any other site's Referer, returns 206.

Reproduction

URL=https://tiles.overturemaps.org/2026-08-19.0/buildings.pmtiles

curl -s -o /dev/null -w 'no Referer          -> %{http_code}\n' -r 0-0 "$URL"
curl -s -o /dev/null -w 'Referer example.com -> %{http_code}\n' -r 0-0 -H 'Referer: https://example.com/' "$URL"
curl -s -o /dev/null -w 'Referer maps3d.io   -> %{http_code}\n' -r 0-0 -H 'Referer: https://maps3d.io/' "$URL"

Referer	Status
(none)	206
https://example.com/	206
https://maps3d.io/	403

How do we use this ?

We read the base, buildings and transportation PMTiles from the browser with the pmtiles library: range requests for the header, the directory, then the tiles covering one user-selected bounding box, capped per area. Nothing crawled or mirrored in bulk. URLs resolved through stac.overturemaps.org.

Workaround

We now read from overturemaps-extras-us-west-2.s3.us-west-2.amazonaws.com/tiles/{release}/{theme}.pmtiles, which is not blocked , but would like a better workaround

Question

I would like to know if this is an intentional block on our domain, and if so what triggered it? Happy to change our usage if something about it tripped the rule.

Have a great day

Thibault