PHP在入口处判断请求来源

仅本站访问或者没有跳转的可以访问：

if (isset($_SERVER["HTTP_REFERER"])) {
    $referer = $_SERVER["HTTP_REFERER"];
    if (strpos($referer, 'http://***.***.com.cn') !== 0) {
        header('HTTP/1.1 404 Not Found');
        header("status: 404 Not Found");
        echo 'ERROR 404';
        exit();
    }
}

 禁止?/和/?的访问形式：

$url = $_SERVER['REQUEST_URI'];
$regex1 = '/.*\?\/.*/';
$regex2 = '/.*\/\?.*/';
if (preg_match($regex1, $url) || preg_match($regex2, $url)) {
    header('HTTP/1.1 404 Not Found');
    header("status: 404 Not Found");
    echo 'ERROR 404';
    exit;
}