Answers.Body: <p>You could probably do it at the webserver level, e.g. in apache using <code>&lt;LocationMatch&gt;</code> and then <code>&lt;Limit&gt;</code>. Untested, and you might have to fiddle or put it in the right place for clean/non-clean urls, or for specific gid params:</p>
  <pre><code>&lt;LocationMatch &quot;^/civicrm/profile/create&quot;&gt;
    &lt;Limit GET&gt;
      # allow just my own IP
      Require ip my.own.ip.address
    &lt;/Limit&gt;
  &lt;/LocationMatch&gt;
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-10-22T15:28:21.540Z
Answers.Text: It's a shared server, so I can't do this directly, but I will see if I can get it implemented, thanks!
Answers.UserDisplayName: Lars SG
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-11-16T21:16:02.217Z
Answers.Text: If you're trying to limit what gets POSTed to the profile form, then I don't see that snippet as being useful. The only information available once it gets to the civicrm site is going to be the ip of the agent doing the posting and the referrer url which is spoofable anyway. Using the html snippet on a remote site is generally not advised and should be abandoned to use more sophisticated integrations.
Answers.UserDisplayName: Alan Dixon
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-10-22T01:29:25.227Z
Answers.LastActivityDate: 2020-10-22T01:29:25.227Z
Answers.UserDisplayName: Demerit
Body: <p>I would like to disable access to specific profiles via their public URL, while still allowing HTML snippet access, i.e. I'd like to allow POST only. Is this possible?</p>
  <p>We have fake spam contacts entering our database from <a href="https://secure.wildsight.ca/civicrm/profile/create?gid=56&amp;reset=1" rel="nofollow noreferrer">https://secure.wildsight.ca/civicrm/profile/create?gid=56&amp;reset=1</a>. This profile is only used via HTML snippet on our other website and there is no need for it be available at this URL.</p>
  <p>Disabling use of the profile for Standalone Form or Directory prevents any submissions from the snippet. ReCaptcha doesn't seem to be preventing these submissions.</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-10-22T02:22:10.573Z
Comments.Text: If you can't sort out a redirect perhaps you could try https://civicrm.org/extensions/civihoneypot perhaps? and/or fail2ban. some good answers at https://civicrm.stackexchange.com/questions/2345/how-to-prevent-fraud-attempts-on-contribution-pages
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-10-22T15:25:38.550Z
Comments.Text: CiviHoneyPot doesn't do profiles, unfortunately, just contribution and event pages. And I don't think fail2ban would do anything as it is just a few per day and generally spaced out. I'll see if I can make some of the suggestions in that question work.
Comments.UserDisplayName: Lars SG
Tags: <profile>
Title: How to prevent public use of profile, while still allowing use via HTML snippet
ThreadText: # How to prevent public use of profile, while still allowing use via HTML snippet
  
  (Asked by: username_0 on 2020-10-21)
  
  I would like to disable access to specific profiles via their public URL, while still allowing HTML snippet access, i.e. I'd like to allow POST only. Is this possible?
  
  We have fake spam contacts entering our database from <https://secure.wildsight.ca/civicrm/profile/create?gid=56&reset=1>. This profile is only used via HTML snippet on our other website and there is no need for it be available at this URL.
  
  Disabling use of the profile for Standalone Form or Directory prevents any submissions from the snippet. ReCaptcha doesn't seem to be preventing these submissions.
  
  **Tags:** profile
  
  > **Comments:**
  > **username_1**: If you can't sort out a redirect perhaps you could try https://civicrm.org/extensions/civihoneypot perhaps? and/or fail2ban. some good answers at https://civicrm.stackexchange.com/questions/2345/how-to-prevent-fraud-attempts-on-contribution-pages  
  > **username_0**: CiviHoneyPot doesn't do profiles, unfortunately, just contribution and event pages. And I don't think fail2ban would do anything as it is just a few per day and generally spaced out. I'll see if I can make some of the suggestions in that question work.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2020-10-22. Score: 1
  
  You could probably do it at the webserver level, e.g. in apache using `<LocationMatch>` and then `<Limit>`. Untested, and you might have to fiddle or put it in the right place for clean/non-clean urls, or for specific gid params:
  
  ```
  <LocationMatch "^/civicrm/profile/create">
    <Limit GET>
      # allow just my own IP
      Require ip my.own.ip.address
    </Limit>
  </LocationMatch>
  
  ```
  
  > **Comments:**
  > **username_0**: It's a shared server, so I can't do this directly, but I will see if I can get it implemented, thanks!  
  > **username_3**: If you're trying to limit what gets POSTed to the profile form, then I don't see that snippet as being useful. The only information available once it gets to the civicrm site is going to be the ip of the agent doing the posting and the referrer url which is spoofable anyway. Using the html snippet on a remote site is generally not advised and should be abandoned to use more sophisticated integrations.  
  
  ---
  
  