He checks the Referer header[1]. In Firefox you can prevent that header from being sent by setting `network.http.sendRefererHeader` to 0 (in about:config).
That is the way it was done back in the day, usually when admin wanted guests to not come through Google Search or to come through a correct word-of-mouth bouncer page. Client side JS implementations allow content to be viewed by blocking JS.