You can use a regular expression to validate the Referer header. preg_match( '/^(http|https|ftp):\/\/(([A-Z0-9][A-Z0-9_-]*)(\.[A-Z0-9][A-Z0-9_-]*)+)(:(\d+))?\//i', $_SERVER['HTTP_REFERER'], $captures ); if (count($captures[0]) == 0) { exit('Sorry, you cannot access this page.'); } PHP: Note that you may also be blocking legitimate visitors, as user agents are not required to send the referrer header. - P