Japh

Hi Craig, Hmm... try echoing $_SERVER['HTTP_REFERER'] instead of the code snippet I provided earlier to see what values it has in different circumstances. Hard to know without seeing exactly what you're doing now

Hi Craig, Ah ok, the problem is that you need to make sure the code snippet I pasted above is the absolute first thing in your fail.php file. That error is basically telling you "Sorry! I've already sent stuff to the browser, so I can't change the headers now!"

Hi Craig, Could you paste the errors here? Then I can help you debug them

Hi Craig, You could do something like this in the top of your fail.php file: <?php if (empty($_SERVER['HTTP_REFERER'])) { header("HTTP/1.0 403 Forbidden"); exit; } ?> However, that will only check to make sure the user hasn't come directly to the script. If they link to it from elsewhere they can still access it, which you could get around by adding a strpos or something to the if() above. Hope that helps