 <p>Basically, the idea is as follows:</p> <ol> <li><p>One of your pages checks whether the user knows the "secret". This is kind of authorization.</p></li> <li><p>Some other page(s) works only if the user has been authorized.</p></li> </ol> <p>It's obvious that information about successful authorization should be stored in some place, which is shared between various pages. There are a lot of ways to share information between pages.</p> <p>A) Session. Once the user has submitted the correct promo code, your authorizing page stores something in the Session collection. That could be just a flag indicating the fact of successful authorization, or that could be the promo code - if you would need its value later.</p> <p>Any other page can check what's stored (or not stored) in Session in the Page_Load handler and decide what to do then: continue or render an error, or redirect to another page. Note: sessions expire. What's you store there is forgotten when the session ends.</p> <p>B) Cookies. This way your information lasts as much time as you want - you set the expiry date. But since it's stored in the user's browser, there are disadvantages: the browser may refuse to store your cookies; the user may clear them.</p> <p>C) Database. If you want to make sure the user is authorized once and for ever, store this info in the database.</p>