There is no such thing as a "private URL" that is hosted on a public web site. You need to augment the URL with something like: - A server-side authentication

There is no such thing as a "private URL" that is hosted on a public web site. You need to augment the URL with something like: - A server-side authentication scheme; so if the URL is visited, it can't trigger anything important without a password. - An expiration mechanism; so that after a certain amount of time, a particular URL has no effect even if it is "visited". - A cookie; so that the URL only works if visitors are people you expect (because they have the right cookie on the client side, and someone like Google would not). Cookies are actually another way to implement expiration, too.