How to hide destination URLs from bots

Most short links are optimized for convenience. They redirect quickly, preview nicely, and expose enough information for browsers and link scanners to understand where the visitor is going.

That is the wrong default when the destination should not be followed by bots.

If a crawler, preview bot, security scanner, or automated client can see the destination in HTML, JavaScript, headers, or public metadata, the destination is not really protected. It may be fetched before the intended user arrives.

RequestGuard Go is built for the opposite behavior: keep the destination server-side until verification succeeds.

The simple protected-link model

A protected redirect should separate the public link from the private destination.

The public link can be shared:

https://go.requestguard.com/a1c2d3rs/

The destination stays on the server. The visitor sees a verification page first. Only after the RequestGuard CAPTCHA succeeds does the service resolve the destination.

Create one at go.requestguard.com.

Why hiding the URL matters

There are legitimate cases where an early automated visit creates real problems:

• One-time download links can be consumed early.
• Campaign links can be crawled before launch.
• Partner resources can be indexed or previewed in the wrong context.
• Private handoff URLs can leak through logs, bots, or unfurled previews.

CAPTCHA does not make a secret URL permanently secret. It does add an intentional human step before the destination is revealed, which is often exactly the control a shared redirect needs.

Add password protection only when it helps

Passwords are useful when the recipient already has a trusted channel for the secret. They are not useful when everyone receives the same public link and the password beside it.

RequestGuard Go lets you keep the default flow simple:

• No password by default.
• Never expire by default.
• Add a password when the audience can receive it safely.
• Add expiry when the link has a real access window.

That avoids security theater while still covering high-risk links.

Link protection for product teams

Legacy link protectors can be useful, but product teams usually need a cleaner pattern. They need a link that looks professional, explains why verification is required, and can be created by support tools or backend services.

That is why RequestGuard Go includes a REST API as well as the web creation page. You can create protected links from internal tools, dashboards, order flows, or support workflows.

Next steps

Use RequestGuard Go when a destination should not be followed by bots before a human has passed verification. For competitor-specific pages, see the Filecrypt.cc alternative, Linkcrypt.ws alternative, and Cript.to alternative guides.