I have a private (= I'm the only user) site at
example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at
example.com, especially not my private site.
Now let's say Alice "guesses" the URL and visits
example.com/private/. Of course I have protected the site by requiring a login, but still, I don't want Alice to know that there is such a site at all, and I don't want her to try out the login etc.
I wonder if the following method could help me here:
I set the Referer to (e.g.)
9b2389Bqa0-ub712/bauUU-UZsi12jkna10712 for any request to
Now I check with
don't know how it is possible exactly, but I heard it should be see the question on Code Review SE) for the visitor's Referer:
- if it is
9b2389Bqa0-ub712/bauUU-UZsi12jkna10712, do nothing special (= access to the site is possible)
- if it is something else, send HTTP error 404
I guess instead of 404 a fake site could be shown, but for my case I want no one to see a difference between
/private (which exists) and
/foobar (which doesn't exist → 404).
Would this work? Is it possible with
.htaccess? Has this method any flaws? Anything I should change? Any similar methods?
Updates & clarifications
- The whole host uses HTTPS.
- I don't need to hide the fact that there is a server, I just want to hide that there is content served.
Thanks @Adnan for bringing the term "plausible deniability" into play → I want this (client-side)!
Some proposed using a hard to guess URL (e.g. the secret string appended to the URL): While this might certainly work, I think using the Referer method has the advantage that you can't accidentally reveal the secret (easily). URLs are more visible than HTTP headers: someone looking at your screen, published bookmark list by accident (not remembering that the secret URL is included), browser history, screenshotting your desktop with browser address bar in background, …. And so you have the initial problem again: how to hide that there is a site when Alice "guesses" (or whatever) the URL.
Some proposed using an external (even better, local) login page. I like that idea. In comparison to the Referer method (if it can be implemented by
.htaccess, which I assume is possible) it has the disadvantage that you'd maybe need to adapt the site's code/CMS.
For discussion about the
.htaccess, see the question on Code Review SE
As @НЛО points out, a custom header would be better. Yes, I think so, too. But I didn’t find a Firefox add-on for that yet (see question on Super User).