Reading source code and extracting json from a url
The Security
The main point here is your assumption that HTTP_REFERER could prevent someone from using this code. Unfortunately it doesn't. Referrer, just like any other HTTP header, is easily faked, one is setting it routinely with any software that is doing HTTP requests. So be advised that it is an ostrich-style defense.
You should understand that there is absolutely no way to protect the information which is shown in the browser. The only way to restrict an access to a script is to make it password protected.
Moreover, I suppose that a concerned user could easily guess the domain from which you are requesting the data, and then just bluntly take the token from the source of your page and then just use it at their own disposal. Consider storing the token inside your PHP code instead.
The code.
That said, your code could be syntactically improved as well. First of all, just like it said in the other answer, you could combine all conditions in one. But it mustn't be done at the expense of readability. So first define your conditions and then check them at once.
After that you could just write your code without any conditions. A loop is unnecessary if there is only one value in the array
$referrer = $_SERVER['HTTP_REFERER'] ?? '';
$access = preg_match('!^http://localhost/test!', $referrer);
$token = $_GET['token'] ?? '';
$source = $_GET['source'] ?? '';
$source_ok = $source == 'player';

if (!$referrer || !$access || !$token || !$source || !$source_ok) {
    header('HTTP/1.1 404 Not Found');
    die;
}
$urlPost = 'https://www.player.com/?token='.$token;
$url = file_get_contents($urlPost);
preg_match('/CONFIG = (.*)/', $url, $matches);
$jsn =  json_decode($matches[1]);
$vdUrl = $jsn-&gt;streams[0]-&gt;url;
header('location:'.$vdUrl);

Note: if $_GET['source'] ?? ''; operator is giving you an error, consider upgrading your PHP version immediately, because it is not supported anymore.