restricting access to prevent phishing