Protect a landing page

Landing protection lets visitors open your landing through a campaign link while preventing access through the page’s plain URL. Use it for a Redirect campaign when you control the landing’s hosting. For Hosted landings, turn on Landing protection before publishing and skip the PHP setup below. See Host your landing pages. For a landing on your own hosting, use the PHP setup below. Leave protection off for the first page of Direct script.

1. Prepare the PHP file

Create metricanic-guard.php beside your landing’s index.php. Copy the code below into it. Open Profile → Security → LP protection key, click Copy, and replace PASTE_YOUR_LP_PROTECTION_KEY in that PHP file with the copied secret. Keep the secret in PHP on your server. The public landing URL gets a generated key, never the secret from your profile.

Copy the PHP protection file

<?php
$secret = 'PASTE_YOUR_LP_PROTECTION_KEY';
$key = $_GET['lp_key'] ?? '';
$ttl = 600;
header('Cache-Control: private, no-store');
header('Referrer-Policy: no-referrer');

if ($secret === '' || $secret === 'PASTE_YOUR_LP_PROTECTION_KEY') {
    http_response_code(500);
    exit;
}
if (!is_string($key) || !preg_match('/\A[0-9a-f]{5}([0-9]{5})[0-9a-f]{5}([0-9]{5})[0-9a-f]{54}\z/', $key, $parts)) {
    http_response_code(404);
    exit;
}
$timestamp = $parts[1] . $parts[2];
$age = time() - (int) $timestamp;
$hash = hash('sha256', $secret . $timestamp . ($_SERVER['HTTP_USER_AGENT'] ?? ''));
$expected = substr($hash, 0, 5) . substr($timestamp, 0, 5)
    . substr($hash, 5, 5) . substr($timestamp, 5, 5) . substr($hash, 10);

if ($age < -30 || $age > $ttl || !hash_equals($expected, $key)) {
    http_response_code(404);
    exit;
}

This example lets visitors open a protected link for 10 minutes.

2. Add one line before the page HTML

Put this at the very beginning of index.php, before any HTML, spaces, or other output:

<?php require __DIR__ . '/metricanic-guard.php'; ?>

If the landing is currently index.html, serve it as index.php on PHP hosting and update the landing URL if necessary. Remove the old public HTML copy after verifying the PHP page, otherwise it remains an unprotected way to open the same content. For a CMS or page builder, add the PHP file to its server-side page template.

3. Add the key to the landing URL

Edit the landing in Metricanic and set its URL to:

https://landing.example.com/index.php?lp_key={lp_key}

Use &lp_key={lp_key} if the URL already has a query string. Select the landing in your campaign’s rotator, save, and enter through Tracking link. Disable shared HTML caching for this page and clear existing cached copies. If your hosting uses a proxy, preserve the visitor’s User-Agent header.

Check that it works

Test	Expected result
Open the landing URL without `lp_key`	`404`.
Open the campaign Tracking link in a browser	The landing opens.
Change a character in the generated key	`404`.
Reopen the URL after more than 10 minutes	`404` with this example’s lifetime.

If every request fails, check the copied secret, PHP execution, server time, and User-Agent forwarding. If the bare page still opens, check for an old HTML copy or a cached response.

Start here

Campaigns and tracking

Landing pages and scripts

Conversions

Reports and optimization

Integrations

Account

Troubleshooting

Protect a landing page

1. Prepare the PHP file

2. Add one line before the page HTML

3. Add the key to the landing URL

Check that it works

​1. Prepare the PHP file

​2. Add one line before the page HTML

​3. Add the key to the landing URL

​Check that it works

1. Prepare the PHP file

2. Add one line before the page HTML

3. Add the key to the landing URL

Check that it works