Protect a landing page

Landing protection helps prevent someone from opening your landing with just its plain URL. Metricanic adds a generated lp_key to the visitor’s URL, and your landing checks that key before showing the page. Use it for a 302 Redirect Mode campaign when you control the landing’s hosting. You need a server that runs PHP. A JavaScript check in the browser cannot protect HTML that has already been sent to the visitor.

How it works

The visitor opens your campaign Tracking link.
Metricanic replaces {lp_key} in the landing URL with a generated key.
Your PHP page validates the key. A valid request opens the landing. A missing, changed, or expired key returns 404.

This is an access check for the page, not bot detection or a login system. A valid URL can be reused in the same allowed period with the same User-Agent.

1. Prepare the PHP file

Create metricanic-guard.php beside your landing’s index.php. Copy the code below into it. Open Profile → Security → LP protection key, click Copy, and replace PASTE_YOUR_LP_PROTECTION_KEY in that PHP file with the copied secret. Keep the secret in PHP on your server. The public landing URL gets a generated key, never the secret from your profile.

Copy the PHP protection file

<?php
$secret = 'PASTE_YOUR_LP_PROTECTION_KEY';
$key = $_GET['lp_key'] ?? '';
$ttl = 600;
header('Cache-Control: private, no-store');
header('Referrer-Policy: no-referrer');

if ($secret === '' || $secret === 'PASTE_YOUR_LP_PROTECTION_KEY') {
    http_response_code(500);
    exit;
}
if (!is_string($key) || !preg_match('/\A[0-9a-f]{5}([0-9]{5})[0-9a-f]{5}([0-9]{5})[0-9a-f]{54}\z/', $key, $parts)) {
    http_response_code(404);
    exit;
}
$timestamp = $parts[1] . $parts[2];
$age = time() - (int) $timestamp;
$hash = hash('sha256', $secret . $timestamp . ($_SERVER['HTTP_USER_AGENT'] ?? ''));
$expected = substr($hash, 0, 5) . substr($timestamp, 0, 5)
    . substr($hash, 5, 5) . substr($timestamp, 5, 5) . substr($hash, 10);

if ($age < -30 || $age > $ttl || !hash_equals($expected, $key)) {
    http_response_code(404);
    exit;
}

The file checks the tracker signature and allows keys up to 10 minutes old, with 30 seconds of future clock tolerance. These are settings of this example. Metricanic does not enforce that lifetime for your landing.

2. Add one line before the page HTML

Put this at the very beginning of index.php, before any HTML, spaces, or other output:

<?php require __DIR__ . '/metricanic-guard.php'; ?>

If the landing is currently index.html, serve it as index.php on PHP hosting and update the landing URL if necessary. Remove the old public HTML copy after verifying the PHP page, otherwise it remains an unprotected way to open the same content. If you use a CMS or page builder, its server must run this check before rendering the protected page. Pasting PHP into a browser-side HTML widget is not enough.

3. Add the key to the landing URL

Edit the landing in Metricanic and set its URL to:

https://landing.example.com/index.php?lp_key={lp_key}

Use &lp_key={lp_key} if the URL already has a query string. Select the landing in your campaign’s rotator, save, and enter through Tracking link. Disable shared HTML caching for this protected page and clear existing cached copies. Every request must reach the PHP check, including requests rejected earlier. Keep the original visitor User-Agent when a proxy forwards the request.

Check that it works

Test	Expected result
Open the landing URL without `lp_key`	`404`.
Open the campaign Tracking link in a browser	The landing opens.
Change a character in the generated key	`404`.
Reopen the URL after more than 10 minutes	`404` with this example’s lifetime.

If every request fails, check the copied secret, PHP execution, server time, and User-Agent forwarding. If the bare page still opens, check for an old HTML copy or a cached response. Do not enable this gate on the first page of Direct Script Mode. That page must open before its tracking script can register the visit. The account’s protection secret is shared by its campaigns, so this check also does not restrict access to one particular campaign.

Start here

Campaign setup

Conversions

Reports

Integrations

Automation

Account

Troubleshooting

Protect a landing page

How it works

1. Prepare the PHP file

2. Add one line before the page HTML

3. Add the key to the landing URL

Check that it works

​How it works

​1. Prepare the PHP file

​2. Add one line before the page HTML

​3. Add the key to the landing URL

​Check that it works

How it works

1. Prepare the PHP file

2. Add one line before the page HTML

3. Add the key to the landing URL

Check that it works