Hi, I'm sorry for the late reply... Indeed you are right. The php variable doesn't work, and the javascript can be copied - but not altered. My doubt is if the javascript hostname variable can be tampered. Still, I'm thinking in the following: before my app script is called from my client's website, a file must be written in their website with the current date and id which is also stored in my website. When the main app script is called, I catch the referer and get from my client website the file. The values must check. The hacker can't - I think - write or modify this file in my client space - he also can't fake it because I'm getting my real customer pass text file... What do you guys think...? Regards, Kepler