I have **some HTML/PHP pages** that **include javascript calls**.  

**Those calls points** on JS/PHP methods included into **a library** (PIWIK) **stored onto a distant server.**  

They are triggered using an <http://www.domainname.com/> prefix to point the correct files. 

I cannot modify the source code of the library. 

**When my own HTML/PHP pages are locally previewed** within a browser, I mean using a c:\xxxx kind path, not a localhost://xxxx one, **the distant script are called and do their process**.

**I don't want this to happen, only allowing those scripts to execute if they are called from a www.domainname.com page**.

**Can you help me to secure this ?**

One can for sure directly bypass this security modifying the web pages on-the-fly with some browser add-on while browsing the real web site, but it's a little bit harder to achieve.

I've opened an [issue](https://github.com/piwik/piwik/issues/5831) onto the PIWIK issue tracker, but I would like to secure and protect my web site and the according statistics as soon as possible from this issue, waiting for a further Piwik update.

---

EDIT

---

**The process I'd like to put in place would be :** 

* Someone opens a page from anywhere than www.domainname.com
* > this page calls a JS method on a distant server (or not, may be copied locally),
* > this script calls a php script on the distant server
* > the PHP script says "hey, from where damn do yo call me, go to hell !". Or the PHP script just do not execute....

I've tried to play with .htaccess for that, but as any JS script must be on a client, it blocks also the legitimate calls from www.domainname.com