Is there a way in marketing cloud to restrict access to cloud pages if they're not being accessed from email links generated from marketing cloud.

So basically what I need is, An email is sent from marketing cloud to a customer, when the customer opened the email and clicked the link, the customer can access this cloud page. Now if not from clicked link, the customer cannot access the cloud page

I plan on using a javascript syntax called document.referer but upon reading it is not reliable.

Is there an existing functionality for this restriction to cloud pages using ssjs, gtl or ampscript?

Any tips or suggestion will do.

  • What if i just share the link of the email to my colleges or forward the mail? Will they be allowed to see it? You can just do it with the CloudPagesURL function and on the cloudpage you only load the content when a valid subscriber context is given. Commented Feb 5, 2020 at 9:09
  • 1
    @JohannesSchapdick I was just writing an answer with CloudPagesUrl based solution - but I will not submit it :-) Don't want to be accused of stealing other people's ideas Commented Feb 5, 2020 at 9:12
  • That's what I'm doing right now, But the thing is, If I give the full link to someone, that person can access the cloud page. What I want to is like if they like give the full link to someone they just can't access it in the browser. Something like that
    – imajmdf
    Commented Feb 5, 2020 at 10:02
  • but if they forward the email, I guess there's already consent regarding that one. You guys have any idea what "Do not allow search engines to view this page." and "Do not allow search engines to follow links on this page" means in the Advanced Setting SEO of Cloud Pages? @JohannesSchapdick
    – imajmdf
    Commented Feb 5, 2020 at 10:12
  • and @LukasLunow
    – imajmdf
    Commented Feb 5, 2020 at 10:12

2 Answers 2


This is really kinda a bonkers way to do it, but may fit your solution.

Keep in mind this requires 2 Cloudpages and a data extension.

First, you will want to build out a data extension with a 1 hour (or your preferred setting) individual row data retention policy. Inside this DE, you will want to have the following fields:

SubscriberKey  |  JobID  |  CreatedDate  |  GUID

I would then set SubscriberKey, JobID and CreatedDate as the PrimaryKeys

From there you would build the first CloudPage.

This cloudpage will be all AMPscript and essentially it will create a GUID and then do an upsert to the DE we created above attaching the GUID to the Subscriber.

Something like:

set @GUID = GUID()
set @SubscriberKey = AttributeValue("_SubscriberKey")
set @JobID = AttributeValue("jobid")
set @CreatedDate = Now()



You would then want to wrap your second cloud page (intended target page) inside of a conditional to determine if the GUID passed in the url exists in the DE or not.

Something like:

  SET @GUIDRows = LOOKUPROWS("guidDE,"SubscriberKey",@SubscriberKey,"JobID",@JobID,"CreatedDate",@CreatedDate,"GUID",@GUID)

Essentially this will make it so that CloudPage 1 is only called when the link is clicked in the email, which will set the GUID for the page with a 1 hr lifespan. It will then redirect you to CloudPage 2 (your intended target page) which will then do a lookuprows to the GUID DE to check if the GUID as well as the relevant subscriber/job data is valid (extra validation in case the impossible happens and you get a duplicate GUID). If it is, then it will display the expected page. If it is not (e.g. been over an hour long) then it will display error content stating to go back to the email and click the link again.

Please do note that with 2 cloudpages you could be looking at paying 2 super messages per click due to the 2 required viewings to get to your target page (not sure if you can have the first CP be a code repository or not - if so that may save you some money). This also is not foolproof and depending on the page and your customers it may provide a bad user experience.


I'd recommend checking out the HTTPRequestHeader() AMPscript function.

Using that along with a CloudpagesURL() function in your email footers will allow you to only render the page for people coming from the SFMC redirected url.

In the email footer:

<a alias="page" href='%%=redirectto(CloudPagesURL(##yourPageID##))=%%'>Page</a> 

On the Cloudpage:

set @Referer = HTTPRequestHeader('Referer')
if indexOf(@Referer,"marketingcloudapps.com") > 0 then
  set @showContent = true
  set @showContent = false

In my test, the full request header value was "https://email-app.s7.marketingcloudapps.com/", but that would vary depending on your stack and how you are testing the page (so that's why I used an IndexOf() instead of looking for an exact match of that url).

Note that this would not prevent users who clicked through from a url that was shared via a forum or something like that.

  • I cannot get this to work. It only returns an empty string for me each time on the referrer value. This is when using a collection from both AMPscript and the SSJS versions. I also tried using a Classic Microsite/Landing Page versus a Cloudpage and had the same results. Commented Feb 5, 2020 at 22:14
  • 1
    Tried HTTPRequestHeader('Referer'), It works same as document.referer. It will only be populated if the page came from another page not from email. Or I'm missing something.
    – imajmdf
    Commented Feb 6, 2020 at 8:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .