Disable Direct Access to a WordPress Page

Sometimes a WordPress page should only be reached from one specific page, such as a thank-you page after a form or a download page after a sign-up. This snippet checks where the visitor came from and redirects them if they opened the page directly or from anywhere else. Add it to your child theme’s functions.php or a custom plugin.

<?php
add_action('template_redirect', function () {
    //Page you want to redirect
    if (!is_page(ADD_YOUR_PAGE_ID)) {
        return;
    }
    if (wp_get_referer() == 'ENTER_THE_URL_FROM_WHERE_IT_SHOULD_BE_ACCESSIBLE') {
        return;
    }
    //Where You Want To Redirect
    wp_redirect(get_permalink(ADD_YOUR_PAGE_ID));
    exit;
});
?>

How it works

• template_redirect runs just before WordPress loads the page template, which is early enough to redirect.
• is_page( ADD_YOUR_PAGE_ID ) makes the function return early on every other page. Replace the placeholder with the ID of the page you want to protect.
• wp_get_referer() returns the URL the visitor came from. If it matches the URL you enter exactly, the page loads normally, so include the full address with https:// and the trailing slash.
• Otherwise wp_redirect() sends the visitor to the permalink of the page ID in the last lines, and exit stops WordPress from loading anything else.

Before you use it

• The redirect target needs a different page ID than the protected page. If you use the same ID in both places, the page redirects to itself in an endless loop.
• wp_get_referer() only returns URLs from your own site. A referrer from another domain comes back as false, so the allowed page has to be on the same site.
• The referrer is sent by the browser. It can be missing or faked, so treat this as a convenience, not as real access control for private content.
• If your functions.php already starts with <?php, leave out the opening and closing PHP tags when you paste the code.

Related articles

• redirecting to the homepage when a form value is missing: a JavaScript way to keep visitors off a page
• the same template_redirect hook in a WooCommerce logout fix: another early redirect before the template loads