How do I only allow visitors from specific domains?

Question

Hello,

I have a PHP based website that uses coupon codes. I can restrict search engines from finding the landing page of a coupon code (like if it was an ad on another page).

But I also want to restrict the coupon code so that it only works if they came from the site serving the coupon code. That way, if someone find the code, they can't just post it on a blog. Granted, it's good business to have a Coupon code go viral, but we need it to be restricted for marketing analysis.

So if I put an ad on www.examplead.com, and someone comes to our website from clicking the ad, I want to allow the coupon code to work. If they come from www.exampleblog.com, or any other site other than www.examplead.com, I don't want to allow the coupon code to work.

I don't need help with writing code that will disable/enable coupon codes, but I need help with filtering where someone is coming from, and then executing a function based on that.

If someone else has a better method for keeping track of coupon codes, please let me know.

Answer 1

The simplest way is to check the value of $_SERVER['HTTP_REFERER']. It can be forged, but it doesn't require the other side to do anything.

Answer 2

I would also try validating against $_SERVER['HTTP_REFERER']. If you need something more robust than that, I would maybe set up an affiliate system, where a key gets passed via the URL that corresponds to a specific affiliate account in your system, so you can know which affiliates are redeeming which codes. (and logging the referrer domain name, so you can detect forgeries or if affiliates are abusing their code).

One thing you might want to be careful about is punishing users who might start but not complete a transaction using a coupon code, and come back later (but not through the referrer). You might just want to flag their account as being available to use that code any time after they visit once through the referrer.

Answer 3

You could create a dynamic hash that changes daily and append that to the link to that page. If that hash is missing or incorrect you could choose to not show the coupon code. The hash could be a generated using a unique identifier for the linking website (salt) plus a dynamic identifier like the date (although if the server times are off by any amount of time this could be problematic so I recommend an alternative value). By having this value change daily you prevent anyone from sharing the link. At worst it is "in the wild" for 24 hours before it becomes invalid.

You could use $_SERVER['HTTP_REFERER'] to augment this system but, since it is unreliable for the reasons mentioned above, you wouldn't be dependent on it.