A website with two HTML pages, A and B.

Both can be accessed by typing the URL, of course.

However, can I disallow any access to page B, and only allow it if the user is coming from page A? As in, a link in page A that redirects to page B.

Is it possible with .htaccess, or are there other alternatives?


Yes. In the example below, people reaching page B from a page other than A will receive a forbidden error. To do it, you need something like this:

RewriteCond %{HTTP_REFERER} !^http://www.yoursite.com/A.html$
RewriteRule B.html - [F,NC]

Substitute yoursite and the html extension as appropriate for your case.

Note that this is not a secure way of doing this as people can spoof the referrer. If you want a secure way of doing this, you will need a login over SSL instead of using the referrer.

As one commenter noted, sometimes legitimate users do not show a referrer field or an incorrect one. Sometimes privacy software do this but it breaks a things (like hotlink protection) on many sites, so it is not that common anymore.

  • Using SSL won't stop people spoofing the referer.
    – Quentin
    Apr 15 '13 at 7:46
  • 2
    It should be noted that there are quiet a lot of circumstances where the referer information may be missing (such as when the user has decided to block it for privacy, or when they are coming from an HTTPS site, or using a proxy).
    – Quentin
    Apr 15 '13 at 7:47
  • 1
    @Quentin: I agree, the answer is a little misleading in this respect, however, I would assume that the "login over SSL" would be used to allow access to the page. At which point, the referer would not be used.
    – MrWhite
    Apr 15 '13 at 8:10
  • @w3d - Good point. I'll clarify.
    – Itai
    Apr 15 '13 at 13:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.