Creating gateway pages with Deleach:

Gateway pages are special pages which you want your visitors to pass through as they use your website. Just like putting up a notice in a shop, you want your visitors to be aware of them before they use your website or buy from you.

Why do you need gateway pages?

There are many occasions where you want to provide notices to visitors to your site. Examples would be:

If you're supplying content supplied by third-parties, you may want to disclaim responsibility for that content.
If you're offering adult-oriented material, you may want to warn your visitors that some of the content may be offensive.
If you're selling art, you may want to inform your visitors that the copyright belongs to individual artists.
If you're selling products which may be dangerous if mis-handled, you may want to note that the products are supplied own-risk.
If you're selling pharmaceuticals, you may want to advise the customer to consult a doctor before ordering.

I've seen pages like that. What's the problem?

Traditionally, these notifications are placed in a number of locations. But each solution has its own problems:

But: if somebody follows a deep-link, right into your site's content (either through a serch-engine link, a bookmark, or a person-to-person referral), then they'll bypass your splash page altogether.Many sites use "Splash" screens - special welcome pages which inform visitors of the content to follow.
But: On-page warnings take up valuable screen real-estate. They are necessarily designed to be unobtrusive.Some sites put warning notices at the bottom of their catalogue's product pages,
But: Off-page links interrupt the customer's flow. When a visitor is trying to do something on your site, he's not going to pause to read your warnings!Some sites place - at the bottom of sensitive pages - links to more general T&Cs pages containing the warning notices.

So: you can see that you can't guarantee that visitors will ever see your notices! In fact, frequently they won't even know they're there!

How can DeLeach help?

Using DeLeach, you can protect any or all of your webpages, such that no visitor will ever see the protected pages unless they have already passed through a gateway page.

Gateway picture Let's take a typical example. You have a home page (or landing page), which links to some further pages. One of those is a gateway page which contains:

your notice, and,
links to your sensitive pages.

So long as visitors only reach your sensitive pages through your gateway page, they'll see the notice, as you intend. But if visitors deep-link to your protected pages, they've bypassed your gateway page and they won't see your notice.

DeLeach allows you to create a "protected zone" - a group of pages on your website which are accessible only through your gateway pages. If a visitor tries to enter through a deep-link, the pages in the protected zone won't show up.

As an alternative, you can provide a second, deep-link-only gateway page - a "back-door" gateway. When a visitor deep-links to a page in the protected zone, the back-door gateway will be served automatically. The visitor will have to explicitly click a link to access the page he wants.

What you need to do:

You proceed in two steps:

Step 1: Create a "protected zone" which will protect your sensitive files from deep-linking:

In this step you'll make sure that your sensitive pages can only be seen when they're used from inside your website.

In your website, create a directory called _self.
Is your sensitive content served from script pages, such as ASP or php? If you have both sensitive and public content served from the same script, DeLeach won't be able to tell which is which. You'll need two different script files to serve the two kinds of content.Select which pages (.html, .php, .asp, etc) you want to protect, and move them into _self.
If your sensitive pages contain assets (pictures, sounds, etc) which are also sensitive, you should move these to the _self directory as well.
Ensure that, inside your website, the only links to your sensitive pages are either from your gateway pages or from other pages in the protected zone.

And that's it! From now on, the pages and other files that you've moved into _self will only be accessible through your gateway page. Users who deep-link to those pages will see a 404 error.

Step 2: Provide a back-door gateway page:

When DeLeach blocks access to a file because a visitor is deep-linking to it, it can also serve up a replacement file. In this case, we're going to use that facility to create a back-door gateway page.

The page will be different depending on whether the files you're protecting are simple .html files, or are scripts. Two examples are presented here - more detailed discussions are presented at the end of the article.

Example1: All the protected pages are called something.htm

In this situation, you have a selection of sensitive pages, all recorded in different .htm files.

First, prepare the .htm back-door gateway page:
```
<HTML>
   <HEAD>Whatever you want in here</HEAD>
   <BODY>
      Put your notice in here.
      To continue, click <A href=''>here</A>
   </BODY>
</HTML>
```
Normally, IIS is set up to deliver server-side includes (SSI) only on pages called something.stm, .shtm, .shtml, or similar. But you can set up server-side includes on any type of page including .htm and .html. Look under Configuration .. mappings
In your website, create a directory called _def.
Copy the prepared page to _def\#.htm,
Ensure you have server-side includes enabled for .htm files.

And that's it! Now, every time a visitor asks for one of your protected pages, the back door gateway page will be shown instead.

Example 2: There's one protected page, called protected.asp

In this situation, all your sensitive pages are represented by a single script which delivers content from a database. This is how you'd implement a catalogue.

Prepare the .asp back-door gateway page:

<HTML>
   <HEAD>Whatever you want in here</HEAD>
   <BODY>
      Put your notice in here.
      To continue, click <A href='<%=request.servervariables("URL")%>'>here</A>
   </BODY>
</HTML>

In your website, create a directory called _def.
Copy the prepared page to _def\protected.asp.

And that's it! Now, every time a visitor asks for a page from the protected.asp script, the back door gateway page will be shown instead.

Back-door pages in more detail:

The purpose of a back-door gateway page is to:

Display the notice that you want your visitors to see, then
Allow them to continue to the page they asked for.

It is not enough to refresh or reload the page: doing so will still keep the third-party referer which caused DeLeach to hide the content in the first place. It must be a genuine link from this page (in your website) to itself.Since the back-door page already has the url of the page they asked for, the page needs to provide a link to itself. The most reliable way to do that is with a small amount of scripting.

Using SSI or .htm:

We've already seen an example of an SSI back-door page. Note that this approach will catch all .htm files which don't appear in the main part of the website - whether or not there's a corresponding protected page in the _self directory. A visitor might arrive here, click the link, and then receive a 404 error. Generally speaking, it would be better to place all the protected files (and the back-door gateway) into a special directory, thus:

//you.com/
   files...
   protected/
      asset files...
      _self/
         files.htm
      _def/
         #.htm

Of course, you can probably find a more descriptive name for the directory than protected/!

Using ASP:

Though you can provide a _def\#.asp file to intercept all the scripts you want to protect (just as in the example above), you can also provide a seperate gateway page for each individual script. In fact, you can mix and match: you can provide specific gateway pages for the scripts you want to provide specific notices for, and then protect all the rest using the more general _def\#.asp. All you have to do is place all the gateway pages in the _def directory.

Using php:

The scripts you'll use when you're using php are almost identical to the scripts you use when you're using other scripting languages:

<HTML>
   <HEAD>Whatever you want in here</HEAD>
   <BODY>
      Put your notice in here.
      To continue, click 
<?php echo "<A href='" . $_SERVER['REQUEST_URI'] . "'>here</A>" ?>
   </BODY>
</HTML>

What you need:

Works on all versions of DeLeach

You'll need some scripting on your server, such as php or ASP. Even SSI will do!