Marketing Cloud Cloud Pages only accessible through email links

Question

Is there a way in marketing cloud to restrict access to cloud pages if they're not being accessed from email links generated from marketing cloud.

So basically what I need is, An email is sent from marketing cloud to a customer, when the customer opened the email and clicked the link, the customer can access this cloud page. Now if not from clicked link, the customer cannot access the cloud page

I plan on using a javascript syntax called document.referer but upon reading it is not reliable.

Is there an existing functionality for this restriction to cloud pages using ssjs, gtl or ampscript?

Any tips or suggestion will do.

Answer 1

This is really kinda a bonkers way to do it, but may fit your solution.

Keep in mind this requires 2 Cloudpages and a data extension.

First, you will want to build out a data extension with a 1 hour (or your preferred setting) individual row data retention policy. Inside this DE, you will want to have the following fields:

SubscriberKey  |  JobID  |  CreatedDate  |  GUID

I would then set SubscriberKey, JobID and CreatedDate as the PrimaryKeys

From there you would build the first CloudPage.

This cloudpage will be all AMPscript and essentially it will create a GUID and then do an upsert to the DE we created above attaching the GUID to the Subscriber.

Something like:

%%[
set @GUID = GUID()
set @SubscriberKey = AttributeValue("_SubscriberKey")
set @JobID = AttributeValue("jobid")
set @CreatedDate = Now()

UpsertData('guidDE',3,'SubscriberKey',@SubscriberKey,"JobID",@JobID,"CreatedDate",@CreatedDate,"GUID",@GUID)

Redirect(CloudpagesURL(1234,"GUID",@GUID,"CreatedDate",@CreatedDate))
]%%

You would then want to wrap your second cloud page (intended target page) inside of a conditional to determine if the GUID passed in the url exists in the DE or not.

Something like:

%%[
  SET @GUIDRows = LOOKUPROWS("guidDE,"SubscriberKey",@SubscriberKey,"JobID",@JobID,"CreatedDate",@CreatedDate,"GUID",@GUID)
  IF ROWCOUNT(@GUIDRows) > 0 THEN
    <<YOUR PAGE CONTENT>>
  ELSE
    <<EXPIRED CONTENT>>
  ENDIF
]%%

Essentially this will make it so that CloudPage 1 is only called when the link is clicked in the email, which will set the GUID for the page with a 1 hr lifespan. It will then redirect you to CloudPage 2 (your intended target page) which will then do a lookuprows to the GUID DE to check if the GUID as well as the relevant subscriber/job data is valid (extra validation in case the impossible happens and you get a duplicate GUID). If it is, then it will display the expected page. If it is not (e.g. been over an hour long) then it will display error content stating to go back to the email and click the link again.

Please do note that with 2 cloudpages you could be looking at paying 2 super messages per click due to the 2 required viewings to get to your target page (not sure if you can have the first CP be a code repository or not - if so that may save you some money). This also is not foolproof and depending on the page and your customers it may provide a bad user experience.

Answer 2

I'd recommend checking out the HTTPRequestHeader() AMPscript function.

Using that along with a CloudpagesURL() function in your email footers will allow you to only render the page for people coming from the SFMC redirected url.

In the email footer:

<a alias="page" href='%%=redirectto(CloudPagesURL(##yourPageID##))=%%'>Page</a> 

On the Cloudpage:

%%[
set @Referer = HTTPRequestHeader('Referer')
if indexOf(@Referer,"marketingcloudapps.com") > 0 then
  set @showContent = true
else
  set @showContent = false
endif
]%%

In my test, the full request header value was "https://email-app.s7.marketingcloudapps.com/", but that would vary depending on your stack and how you are testing the page (so that's why I used an IndexOf() instead of looking for an exact match of that url).

Note that this would not prevent users who clicked through from a url that was shared via a forum or something like that.