Blocking referrers

lordatlas

Hi.

I'm an absolute newbie, so forgive me.

What I want to do is prevent casual linking of a certain page on my site from any other site.

Here's the pseudo-code:

a) Check referer
b) If it's not blank, redirect them to an "oops" error page
c) If it's blank, do nothing.

What would be the PHP code for this?

(Yes, I know referer blocking is not 100% reliable. I don't need this to be bullet-proof; only to block "bloggers" from linking to that particular section of my site")

AndrewWest

I haven't tested this, but maybe try something like.

<?php

$referrer = $_SERVER['HTTP_REFERRER'];

if (!$referrer) {
header("Location: oops.php");
}

Be aware that if this code is not at the beginning of your code (very top of the source) then it will not work, becuase when you send headers you can not have whitespace before the header.

rachel2004

Try using SESSIONS to authenticate visitors to your site. So, even if some site links to you, a user could click that link on that other site, but if they do no authenticate to your Blog pages, they don't get in.

tommynanda

I would strongly recommend Rachel's way of doing that, because 'HTTP_REFERER' doesnt work always... but since you're a newB.. it takes some time to get into SESSIONS... so lets consider your option

<?php
$ref = $_SERVER['HTTP_REFERER'];
$domain = "something.com"; // Your domain name

if(!strpos($ref,$domain))
{
  header("Location: oops.html");
}
?>

But like I said 'HTTP_REFERER' doesnt work always... when you get some handle over PHP... try Rachels suggestion...

Happy Coding!
TommYNandA

lordatlas

Hi Tommy.

Your code checks to see if the referer includes my domain. Er, that won't do the trick because I will never link to this page from anywhere else on my site. The referer has to be BLANK so I can be sure that my close friends typed the URL in.

I tried the code from the first reply but it didn't work.

I am not new to programming; only to PHP. I've been an ASP dude for a while. 🙂

dnast

Andrew's should've been $SERVER['HTTP_REFERER']; instead of $SERVER['HTTP_REFERRER']; (notice the extra "R").

tommynanda

Oh.. okay.. now I see wat you talking abt... so u want to make a URL private just for ur friends? are they going to include that URL in their website or just type it in browser?

rachel2004

Both way, but in a nutshell:

<?php
session_start();
if (!isset($_SESSION['name_of_friend']))
{
  // redirect user to a login page
}
?>

Or less reliable way since web servers do not need to reveal REFERER:

<?php
$friendlies = array('domain1.com',
                    'domain2.com',
                    'domain3.com');
$count = count($friendlies);
$bad_guys = 0;
for ($i=0; $i<$count; $i++)
{
    if (!$_SERVER['HTTP_REFERER'] == $friendlies[$i])
    {
        $bad_guys++;
    }
}

if ($bad_guys > 0)
{
    /* redirect visitor away from the page 
       useing header() function or cancel parsing
       the page and give message with die():
       die('warning message'); */
}
?>

planetsim

To be perfectly honest your close friends still arent going to be the ones getting to the page. A quick copy paste from a link to your site from a search engine or anything and the user will be in. Also HTTP Referrer can be blank.

So why dont you use HTTP Authentication. using .htaccess

dnast

If you don't care too much about blocking every possible outsider, which it seems you don't, then I say use Andrew's simple code.

If there are no links to said page, then you won't have to worry about a search engine finding it. And to be honest, unless it's a common filename or folder, I doubt anyone would find it regardless.

It would probably be more fun with .htaccess with its usernames and passwords and make it feel more "underground", though. (not to mention more secure) 🆒