Hide a URL in the database, or with php or javascript

shifubill · Dec 27, 2018

I am working on a prelander page to direct visitors from Instagram and FB to money sites or offers. My goal is to hide links as much as possible. I've designed the page so that visitor is directed to the money site after clicking a form submit button that appears to be an image like a fake captcha.

The problem I'm having is that I have to use some type of form redirect, and this makes it obvious to a crawler what the money site is. I've used javascript to listen for the form submit and set the location as the money site. The javascript with the URL is clearly at the bottom of the page source.

I've figured out how to use the same method but put the set the link as a var in a separate .js file, but since this is still pulled on the page, it can be found. I've also thought of using javascript to scramble the URL.
From what I understand, IG and FB bots are able to parse javascript and using any type of javascript method isn't effective.

The method I'd like to use would write the money site URLs to the database where they aren't called until the form submit button is clicked.
I used to use a plugin to make Amazon affiliate stores. It would place the amazon link in the postmeta in the database. Here's an example of a page using this plugin:

http://megafishingstore.com/product/berkley-ugly-stik-jr-spincast-rod-reel-combo/
When I look at the source code, the link behind the button is this:
http://megafishingstore.com?product=4000

I looked at the php code of the plugin, but I can't find a simple way to recreate the necessary function. If I could create a link like that, I can use it in the javascript to redirect after form submit. I've tried doing this using custom fields, and I've tried using the Advanced Custom Fields plugin for WordPress, but I just can't figure it out.

Any tips, suggestions, or code snippets would be much appreciated.

Extruser · Dec 27, 2018

Well then, use a link with a variable (example.com/go.php?product=4000) and let it redirect to your money page.
You could even check that variable before doing anything and send crawlers one way and visitors another.

Gogol · Dec 27, 2018

As @Extruser mentioned, you can have another page setup (and make that your form action)called e.g. out.php?id=somelinkid
Then, in the out.php you can have:

Code:

<?php
if($_REQUEST['id'] == somelinkid){
  header('Location:http://thesecreturl.com');
}

It's still not foolproof because the bots can follow redirect locations too, but it will be a bit more harder.

whiteaxe · Dec 27, 2018

Meh, what i should do is create an ajax connection then this one return the final URL

shifubill · Dec 27, 2018

Gogol said:
It's still not foolproof because the bots can follow redirect locations too, but it will be a bit more harder.

Yes, but I'm planning to make it look like a normal redirect to a thank you page. Nothing is perfect, but I just want to make it less obvious. Is there a way to do this using custom fields so that the URL can be entered easily? I'm trying to make this more user friendly. It will be complicated for another user if they have to edit a php file every time they want to change the URL.

Extruser said:
You could even check that variable before doing anything and send crawlers one way and visitors another.

There's a theory that it's unwise to show a crawler and a human user different things because Instagram can track the users experience through the browser, but I can't say for sure. I know a lot of people use cloakers that do this very thing, but I've decided to avoid it and focus on making the prelander appear as a legitimate site with normal functions.

whiteaxe said:
Meh, what i should do is create an ajax connection then this one return the final URL

No idea what that means or how to do it. I've had to teach myself javascript and php in bits and pieces. I vaguely understand the concept you're talking about, but I'm not sure it will work in this case without looking too suspicious.

Gogol · Dec 27, 2018

shifubill said:
Yes, but I'm planning to make it look like a normal redirect to a thank you page. Nothing is perfect, but I just want to make it less obvious. Is there a way to do this using custom fields so that the URL can be entered easily? I'm trying to make this more user friendly. It will be complicated for another user if they have to edit a php file every time they want to change the URL.

Yeah why not? You could do it several ways. I guess you already know the custom fields part. As for the redirect php page, you could easily do it with a template page.

e.g.

Code:

https://stackoverflow.com/a/2810723/1437261

Then make a custom page from wp admin as set the template as this template that you made. You could have the secret url in the custom field. In the custom template page, get that field and redirect..

When your client needs to change the url, he simply goes to wp-admin, edit that page and changes the URL.

shifubill · Dec 27, 2018

Gogol said:
I guess you already know the custom fields part.

Sorry if I wasn't clear, but this is actually one thing that I'm getting hung up on. I don't know how to use custom fields. I researched it and tried some tests, but was unable to come up with a solution.

Gogol · Dec 27, 2018

shifubill said:
Sorry if I wasn't clear, but this is actually one thing that I'm getting hung up on. I don't know how to use custom fields. I researched it and tried some tests, but was unable to come up with a solution.

E.g. follow this tutorial

Code:

https://generatewp.com/the-meta-box-generator/

If it is too much, you could use a meta box plugin or something. Not sure if anything is available on that though. Haven't touched WP for a while

shifubill · Dec 27, 2018

Gogol said:
E.g. follow this tutorial

Thanks, that's a bit beyond my ken but I'll see if I can figure it out. Nothing is making sense this late at night, so I'll go over it soon.

Gogol · Dec 27, 2018

shifubill said:
Thanks, that's a bit beyond my ken but I'll see if I can figure it out. Nothing is making sense this late at night, so I'll go over it soon.

Nevermind, I was feeling good today, so I decided to do it for you

In your functions.php, paste the codes below:

Code:

<?php
/**
 * Register meta boxes.
 */
function gogol_register_meta_boxes() {
    add_meta_box( 'secret-url', __( 'Landing Page URL', 'gogol' ), 'gogol_display_callback', 'page' );
}
add_action( 'add_meta_boxes', 'gogol_register_meta_boxes' );

/**
 * Meta box display callback.
 *
 * @param WP_Post $post Current post object.
 */
function gogol_display_callback( $post ) {
    ?>
    <div class="postbox ">
    <input id="secret_page_url" type="text" name="secret_page_url" style="width: 310px;height: 30px;padding: 3px 10px;" value="<?php echo esc_attr( get_post_meta( get_the_ID(), 'secret_page_url', true ) ); ?>">
    </div>
    <?php
}

function gogol_save_meta_box( $post_id ) {
    if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) return;
    if ( $parent_id = wp_is_post_revision( $post_id ) ) {
        $post_id = $parent_id;
    }
    $fields = [
        'secret_page_url',
    ];
    foreach ( $fields as $field ) {
        if ( array_key_exists( $field, $_POST ) ) {
            update_post_meta( $post_id, $field, sanitize_text_field( $_POST[$field] ) );
        }
     }
}
add_action( 'save_post_page', 'gogol_save_meta_box' );

Obviously, remove the <?php from line 1 if you already have other stuffs in your functions.php

Once you do that, you will magically see a field called Landing Page URL whenever you edit/add a page.

In your frontend template, you call:

Code:

<?php echo esc_attr( get_post_meta( get_the_ID(), 'secret_page_url', true ) ); ?>

where you want to see the url..

Hope that helps

shifubill · Dec 28, 2018

Gogol said:

Nevermind, I was feeling good today, so I decided to do it for you

In your functions.php, paste the codes below:

Code:

<?php
/**
 * Register meta boxes.
 */
function gogol_register_meta_boxes() {
    add_meta_box( 'secret-url', __( 'Landing Page URL', 'gogol' ), 'gogol_display_callback', 'page' );
}
add_action( 'add_meta_boxes', 'gogol_register_meta_boxes' );

/**
 * Meta box display callback.
 *
 * @param WP_Post $post Current post object.
 */
function gogol_display_callback( $post ) {
    ?>
    <div class="postbox ">
    <input id="secret_page_url" type="text" name="secret_page_url" style="width: 310px;height: 30px;padding: 3px 10px;" value="<?php echo esc_attr( get_post_meta( get_the_ID(), 'secret_page_url', true ) ); ?>">
    </div>
    <?php
}

function gogol_save_meta_box( $post_id ) {
    if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) return;
    if ( $parent_id = wp_is_post_revision( $post_id ) ) {
        $post_id = $parent_id;
    }
    $fields = [
        'secret_page_url',
    ];
    foreach ( $fields as $field ) {
        if ( array_key_exists( $field, $_POST ) ) {
            update_post_meta( $post_id, $field, sanitize_text_field( $_POST[$field] ) );
        }
     }
}
add_action( 'save_post_page', 'gogol_save_meta_box' );

Obviously, remove the <?php from line 1 if you already have other stuffs in your functions.php

Once you do that, you will magically see a field called Landing Page URL whenever you edit/add a page.

In your frontend template, you call:

Code:

<?php echo esc_attr( get_post_meta( get_the_ID(), 'secret_page_url', true ) ); ?>

where you want to see the url..

Hope that helps

That's amazing, thank you so much. The trouble is when I use a php call in javascript, it shows up as blank. I've read up on how to use php in javascript and it looked like I did it the right way. I'll see if there's another way I can use that call to redirect. Thanks again!

Gogol · Dec 28, 2018

shifubill said:
That's amazing, thank you so much. The trouble is when I use a php call in javascript, it shows up as blank. I've read up on how to use php in javascript and it looked like I did it the right way. I'll see if there's another way I can use that call to redirect. Thanks again!

K bro, learn some programming then. This is pretty basic. If you don't know how to render php vars to js vars.. or how to use em.. seriously.. u shudnt be taking clients.. lol

shifubill · Dec 29, 2018

Ow, you were being so nice. I'm always learning on the go, and I am learning a few new things on this one. I just need something out of the ordinary for this project.

This was what I originally had

Code:

add_action( 'wp_footer', 'mycustom_wp_footer' );

function mycustom_wp_footer() {
?>
<script>
document.addEventListener( 'wpcf7mailsent', function( event ) {
    location = '<?php echo $websiteredirect ?>';
}, false );
</script>
<?php
}

I think I had made a mistake in the way I wrote the php to set the redirect url. But then I realized this wasn't the solution I wanted because the url would be still be in the source code, so I abandoned it. I had another solution, but it would work for me but was less user friendly. I have to put this aside for a while, but you've got me pointed in the right direction and I'm sure I can figure it out from here. Thanks so much. I didn't expect as much help as you gave. And I have a 4 day weekend. It's a Christmas miracle.

maidanez · Dec 29, 2018

random out of the box thinking, is it worth setting a cookie on something only a human would do from js, like your form submit/click handler. Then only redirecting if the cookie is set? How advanced are the FB/IG bots?

yakuzaemme · Dec 29, 2018

It's pretty simple, do it with ajax.

First of all, load jQuery if you haven't already.

Code:

<script src="https://code.jquery.com/jquery-3.3.1.min.js"></script>

Always use self-hosted, but for simplicity load it directly from jquery.com

Then create your .php file.

Code:

<?php
echo "https://my-money-site.com";
?>

Obviously, you can throw in some checks here, but without knowing exactly how everything should work I decided to keep it simple.

And then in your JavaScript:

Code:

function formSubmitted() {
       $.ajax({
            type: "POST",
            url: "/your-php-file.php",
            dataType: "html",
            success: function(result) {
                window.location.href = result;
            }
        });
}

And for your listener:

Code:

document.addEventListener( 'wpcf7mailsent', function( event ) {
   event.preventDefault();
   formSubmitted();
}, false );

Edit:
And if you really want to hide it from lazy competitors, you could add in a few checks in the PHP to check referer, you could set cookies at form submission and compare timestamps - etc etc.

For something simple though, you can just obfuscate the JavaScript making it unreadable to the naked eye.

The formSubmitted-function, but obfuscated:

Code:

var _0x562c=['href','POST','/your-php-file.php','html','location'];(function(_0x15d4c7,_0x1813df){var _0x4673a6=function(_0x5ed9ee){while(--_0x5ed9ee){_0x15d4c7['push'](_0x15d4c7['shift']());}};_0x4673a6(++_0x1813df);}(_0x562c,0xbf));var _0x1221=function(_0x38351b,_0x5f2465){_0x38351b=_0x38351b-0x0;var _0x3a4064=_0x562c[_0x38351b];return _0x3a4064;};function formSubmitted(){$['ajax']({'type':_0x1221('0x0'),'url':_0x1221('0x1'),'dataType':_0x1221('0x2'),'success':function(_0x492afa){window[_0x1221('0x3')][_0x1221('0x4')]=_0x492afa;}});}

shifubill · Dec 29, 2018

maidanez said:
random out of the box thinking, is it worth setting a cookie on something only a human would do from js, like your form submit/click handler. Then only redirecting if the cookie is set? How advanced are the FB/IG bots?

Rumors suggest the bots work in a way that allows cookies to be set, so advanced enough that that wouldn't work.
Rumors also suggest that Instagram follows the experience of users through the browser and can compare it to what the crawlers see to know if there are differences.
Rumors also say they only see the prelander and don't go further.
When I say rumors, I mean things I've read from people who work in this field enough that I write down what they say. Some information is old, some may be guesses. It's hard to say. No one knows but Instagram, so it's all rumor.

supereek · Jan 10, 2019

Create your own WEB API in Node.js
In your javascript you fetch the moneysite url through an API call which returns an object (JSON). Its async so a crawler can never read it as it is not there. Make sure to execute the form submit with a delay to allow the promise to be resolved otherwise you end up with an empty url. Hopefully you get an idea of what I mean.

IKXS Acquiring · Feb 3, 2019

If our trying to hide data in data, the secret is classic stenography..

Basically, use an interpreted scripting lanaguage with an eval() feature.

Write a block of code containing your super secret infos, put it into a seperate file.

Scramble that block of code with a basic key and cypher.

Embed the scrambled block into your page.

On runtime, descrable the block, then feed it into eval(), such like

x = eval(descrabmbled_code_block)

Now, X is scoped with all of your secret infos

x.redirect_url_to
x.top_secret_url
x.gon_give_it_to_ya

maidanez · Feb 3, 2019

IKXS Acquiring said:
Embed the scrambled block into your page.

Is this still accurate considering there are multiple implementations of javascript engines that would process this perfectly? Especially if there were no delays or event handlers to trigger the decryption process.

bartosimpsonio · Feb 3, 2019

shifubill said:
I know a lot of people use cloakers that do this very thing, but I've decided to avoid it and focus on making the prelander appear as a legitimate site with normal functions.

Only way to hide the link is to cloak it out. Obscuring the javascript won't cut it.

Hide a URL in the database, or with php or javascript

Regular Member

Regular Member

Administrator

Newbie

Regular Member

Administrator

Regular Member

Administrator

Regular Member

Administrator

Regular Member

Administrator

Regular Member

Registered Member

Senior Member

Regular Member

Power Member

BANNED

Registered Member

Elite Member

Main Menu

Marketplace

Making Money

BlackHat World