Yeh hes right. People can just visit say paymentfinished.php and even if it denies them, they type in the link to your site and it counts as they have:p
Printable View
use htaccess?
Also i used it for a counter strike server the sv_downloadurl to only allow users on my server to connect to my web server to download files, so it may not work, you'll have to see.Code:SetEnvIfNoCase Referer http://example\.com allow_download
Order Deny,Allow
Allow from env=allow_download
Deny from all
Imo, if you know how to, PHP is good for it.
I have never used .htaccess for it :P
To tell you the truth this might be handy in the future days for others, therefore I would say keep it open anyway.