Required URL parameters

With Required URL parameters (“Link only”) a site opens only for visitors who arrive with your link, for example from an Instagram ad: https://example.com/?ref=metaads. Everyone else, including people who type the address, competitors, review bots and crawlers, gets a block page (404 by default) or a redirect.

Use it for a landing page or a private promotion that only the audience of one campaign, or a closed group, should see.

Turn it on in the site’s settings: Advanced tab, Required URL parameters. When it is on, the site shows a Link only badge in the sites list, and the section shows an example link that opens the site, with a button to copy it.

Parameters

Add up to 20 parameters. Each one has a name and a check:

• Values are separated by commas, up to 50 per parameter, each up to 200 characters.
• To compare a parameter’s values ignoring case, tick any case on that parameter. Without the tick, MetaAds does not equal metaads.
• The parameter name is always compared exactly: ref and REF are different parameters. Names cannot contain spaces, &, =, # or ?.
• If a parameter appears several times in the address, any of its values may match.

Then choose how they combine:

• With Any (the default), one matching parameter is enough. This suits several campaigns that each have their own link.
• With All, every parameter must match, for example ref=metaads and campaign present.

Remembering the visitor

Only the first page is opened with your link. The styles, images and scripts it loads, and the next pages the visitor clicks, do not carry the parameter, so a visitor who came with the link gets a pass.

Remember the visitor, hours (default 24, from 0 to 8760, one year) sets how long the pass lasts.

• The pass is a cookie named wp_entry. It is HttpOnly, SameSite=Lax, valid for the whole site (Path=/), and Secure on HTTPS.
• It cannot be forged or extended: it carries its expiry time and is signed with HMAC-SHA256 using a secret that belongs to the site. The secret is never shown in the panel and never included in the settings export.
• Lowering the time shortens the passes already given, right away: a pass longer than the current setting allows is treated as given today.
• End all passes given so far (applied when you save) creates a new secret: every pass becomes invalid, and everybody needs the link again.
• A value of 0 means no passes at all: every request must carry the parameter, so in practice only the link’s own page opens (together with the files let through below).

Passes given by Small Web Panel 1.x (cookie swp_entry) stay valid and are re-issued under the new name.

Also remembering the IP address

Also remember the visitor’s IP address (on by default) remembers the visitor’s address for the same time as the pass; for IPv6, its whole /64.

• Another browser or app on the same address gets in without the link and immediately gets a pass of its own, which ends when the address’s pass ends. This helps when an ad opens in Instagram’s built-in browser and the visitor then switches to Safari or Chrome.
• A visitor with a valid pass who comes from a new address (a phone moving from Wi-Fi to mobile data) gets that address remembered as well.
• A mobile operator or an office often puts many people behind one address, and all of them get in.

Remembered addresses survive a panel restart. They are saved once a minute to /var/lib/wardpane/entry-ips.json. Each address is stored as an HMAC with the site’s secret, so the file alone cannot be turned back into a list of your visitors. End all passes clears them too. At most 100 000 addresses are kept; the oldest go first.

A Cloudflare address is never remembered. If a site is proxied by Cloudflare but “Behind Cloudflare” is off, everybody arrives from Cloudflare’s addresses: remembering one would open the site to everyone using the same Cloudflare server. In that case the IP binding does not work; turn on Behind Cloudflare.

Styles, scripts, images and media

With Let styles, scripts, images, fonts and media through on (the default), requests for these files get in without the link: css, js, mjs, map, png, jpg, jpeg, gif, webp, avif, svg, ico, bmp, woff, woff2, ttf, otf, eot, mp4, webm, mp3, wav, ogg, m4a. Pages then look right in browsers that refuse cookies, and with remembering set to 0.

Only files that really exist pass, so a request for a made-up /x.css does not reach a single-page app, a PHP front controller or a rewritten route. Data and documents (json, xml, pdf and the rest) stay behind the filter. These files can be opened by direct address without the link; turn the option off if that matters.

Paths that are always open

List the paths in Always open these paths, one per line, up to 100. The defaults are /.well-known/, /robots.txt and /favicon.ico.

Add every address that other services call by themselves. Their requests never carry your link and would get the 404:

• payment callbacks and webhooks (Stripe, PayPal, YooKassa and so on),
• uptime monitors,
• cron URLs,
• pages you must keep public, such as a privacy policy or terms linked from the ad platform.

Removing the parameters from the address bar

With Remove the parameters from the address bar after entry on (it is off by default), a visitor who came with the link is sent to the same address without your parameters (a 302 redirect). The address bar then shows a clean address, which is less likely to be shared with the parameter. Other parameters, such as fbclid and utm_source, are kept.

• It works only on the site’s main domain and only for GET requests.
• Analytics on the page will not see your parameters.
• A browser that refuses cookies cannot open the page at all: it loses the parameter and has no pass.

What visitors without the link get

Choose what they get:

• Show a page: the plain 404 (the default), or your own file with status 404, 403 or 200. See Block pages.
• Redirect them to another address (http:// or https://), for example your Instagram profile. The address must not lead back into the filter: a redirect to the site itself would loop forever, so the panel refuses it unless the target path is in the always-open list.

Caching

The same address answers differently with and without a pass, so every response that depends on the pass carries Vary: Cookie and Cache-Control: private (a public or s-maxage value set by the site is replaced), and the redirects carry Cache-Control: no-store. With these headers, Cloudflare or another cache will not hand the page that a visitor with the link received to a visitor without it.

Domains

A pass is given for the domain the visitor came to. www.example.com and example.com are different domains with different passes: if your site redirects one to the other, make your link point to the final one.

Where it sits in the order of checks

The filter runs after all other filters (blocklist, rate limit, Bot Fight Mode, Geo-blocking, devices, hotlink protection) and before the site’s password. A visitor with the link is still subject to all the protection. Refusals are counted in the site’s statistics.

What it does not protect

Whoever has the link can share it, and a pass can be copied together with the browser. Required URL parameters keep a page out of sight of the general public. For anything secret, use Password protection.

Older panel versions do not know this setting: after a rollback to such a version, the site opens to everyone.

An Instagram ad landing page

You run an ad in Instagram and want the landing page https://example.com/ to open only for people who tap the ad. Everyone else should land on your Instagram profile.

1. In the ad, set the website link to https://example.com/?ref=metaads. Meta adds its own fbclid parameter; that does not matter.
2. In the site’s Required URL parameters: turn it on, choose Any, add the parameter ref, check equals one of, value metaads.
3. Keep Remember the visitor, hours at 24 and Also remember the visitor’s IP address on: people often open the ad in Instagram’s built-in browser and continue in Safari or Chrome later.
4. Keep Let styles, scripts, images, fonts and media through on.
5. In Always open these paths, keep the defaults and add the privacy policy page that the ad platform links to, and the webhook of your payment provider if the page takes payments, for example /privacy and /api/payment-callback.
6. Choose Redirect and enter https://www.instagram.com/yourpage.
7. Optionally tick Remove the parameters from the address bar after entry, so that a visitor who copies the address does not share the working link.

Save, then open the example link shown in the section to check that the page opens, and the bare address to check that you are redirected.