Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an HTML page (on a server running Apache) that basically contains a bunch of links (link menu) to other HTML/PHP pages in VirtualDirectories on the same server. Is there a way to only allow access to the URLs specified in links on the "main page" by clicking on those links and not by book marking or issuing the URLs directly from the browser by using some Apache directives and/or PHP? Would I have to pass some sort of token via a POST from the "menu page" and check to see if that token has a valid value from the linked "applications"?

Hopefully the question makes sense.

share|improve this question
up vote 1 down vote accepted

Use PHP's server variable $_SERVER['HTTP_REFERER'] to see which page they came from. If it isn't the page you have the links on, deny them access.

Keep in mind that this is the most simple of solutions, and should not be implemented if you are heavily concerned about security. The referrer can easily be spoofed.

share|improve this answer

You can do the same with a mod_rewrite in apache itself.

share|improve this answer
A little more detail wouldn't go amiss. Do the same as what? Just how is the desired result achieved using mod_rewrite? – John Gardeniers Sep 30 '10 at 0:43

Oops on the double post.

Lots of people use mod_rewrite to stop people from hot linking images. The above shows one example. I bet the above example can be tweaked to do what you are looking for.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.