Tests of the predictions of quantum mechanics for entangled systems have provided increasing evidence against local realistic theories. However, there remains the crucial challenge of simultaneously closing all major loopholes—the locality, freedom-of-choice and detection loopholes—in a single experiment. An important sub-class of local realistic theories can be tested with the concept of 'steering'. The term 'steering' was introduced by Schrödinger in 1935 for the fact that entanglement would seem to allow an experimenter to remotely steer the state of a distant system as in the Einstein–Podolsky–Rosen (EPR) argument. Einstein called this 'spooky action at a distance'. EPR-steering has recently been rigorously formulated as a quantum information task opening it up to new experimental tests. Here, we present the first loophole-free demonstration of EPR-steering by violating three-setting quadratic steering inequality, tested with polarization-entangled photons shared between two distant laboratories. Our experiment demonstrates this effect while simultaneously closing all loopholes: both the locality loophole and a specific form of the freedom-of-choice loophole are closed by having a large separation of the parties and using fast quantum random number generators, and the fair-sampling loophole is closed by having high overall detection efficiency. Thereby, we exclude—for the first time loophole-free—an important class of local realistic theories considered by EPR. Besides its foundational importance, loophole-free steering also allows the distribution of quantum entanglement secure event in the presence of an untrusted party.