Hiding a landing page
Keeping a landing page from being seen by people it is not for — two forms of the snippet, and the one instruction that decides whether it works.
A landing page is public, which means it is visible to a competitor copying your funnel, to a scraper building a database of offers, and to whoever reviews ads at the platform you buy from.
The protection snippet asks UTMCAP about the visitor before the page is shown.
#It is not the tracking tag
Nothing is shared between them. The tag is a separate script
at /t.js doing a different job — opening a click and rewriting the button.
This one carries its own per-page token rather than the account key the tag
uses. They have no file, no endpoint and no credential in common.
A page can carry both. Most pages behind paid traffic should.
#Two forms, and one is stronger
PHP — use it where the page runs on PHP. It decides before any HTML is sent, so a blocked visitor never receives the page at all. There is nothing in the response to read, no markup in view-source, nothing cached by an intermediary.
JavaScript — for pages that are plain HTML, or built by something that cannot run code on the server. It works, and it is weaker by construction: the page has already been delivered to the browser before the script can act on it.
Take whichever applies from the landing page's screen in UTMCAP; both come with the token already in them.
#The one instruction that matters
In the <head>, and without async or defer.
It has to run before the browser paints anything. With async or defer, or
placed at the end of <body>, the page it is meant to hide has already been
seen by the time it runs — and the failure is invisible to you, because you
already know what the page says.
If you take one thing from this page, take that.
#What it can decide on
The same signals as bot detection: network origin, a claimed identity that does not verify, a malformed request, flooding. A verified crawler and a spoofed one are treated differently, which is what lets you stay indexed while keeping a scraper out.
#Two things worth thinking about first
Your own review traffic. The platform reviewing your ad is often indistinguishable from a probe, and a rejected ad is more expensive than a copied funnel. Consider an allow list entry before you need one.
Search. If the page is meant to rank, blocking crawlers will deindex it. Verified crawlers are identifiable precisely so this choice is available rather than accidental — but it is a choice, and it is worth making deliberately rather than discovering in a month.
#Checking it works
Not from your own browser, which will look like an ordinary visitor and see the page. The honest check is the clicks log: filter to that landing page and read Bot reason and Score on the rows that arrived.
If nothing is being caught at all, the snippet is almost always in the wrong
place. Look at the page source and confirm it is in the <head> with no
async and no defer.