I know this is an old thread, but I would just like to add one method to hide your scripts, at least in order to make it a little more difficult to view. The key is to use AJAX and fully synchronize it with your server-side scripts like Php. Thus, the whole algorithm is not fully disclosed and will be completely meaningless for anyone who wants to steal your codes. Of course, this is not a 100% reliable solution, since your client scripts will and can be exposed if you press F12 on chrome, for example. In addition, if your java scripts depend on a large number of server processes, in reality you will not need to worry at all.
In this script, the true content - your actual client-side scripts - is retrieved only through the get method (ps: you can still see the content by following the URL - use the post method to avoid this):
<?Php //THE FOLLOWING VARIABLE IS ADDED TO ENABLE TOGGLING OF THIS FUNCTIONALITY: $obscureScripts = TRUE; //IF OBSCURE SCRIPT FUNCTIONALITY IS ALLOWED, //THE SYSTEM SHOULD ONLY ALLOW REQUESTS TRIGGERED BY SPECIFIED GET METHOD //OTHER THAN THAT, OR UNLESS $_GET['fetch'] == 'content', PERFORM THE FOLLOWING SCRIPTS: if ($obscureScripts && !(isset($_GET['fetch']) && $_GET['fetch'] == 'content')) { //OPEN A SESSION session_start(); //CREATE AN INDICATOR THAT THIS METHOD HAS BEEN USED $_SESSION['obscr'] = 'set'; //CLOSE SESSION WRITER session_write_close(); //ECHO THE FAKE CONTENTS OF YOUR PAGE echo "<script type='text/javascript' src='plugins/jquery-1.9.0.min.js'></script> \n". "<script> \n". "$.get \n". "( '?fetch=content', \n". " function(data) \n". " { $('body').fadeOut \n". " ( function() \n". " { $(this).empty().html(data).fadeIn(100); \n". " } \n". " ); \n". " } \n". "); \n". "</script> \n". "<html><head><title>Page Front</title><link rel='icon' href='icon.ico'/></head> \n". "<body bgcolor='#121212'><center>Loading...</center></body></html> \n"; //THE FAKE CONTENTS WOULD IN TURN RUN A JQUERY SCRIPT TO RETRIEVE THE ACTUAL PAGE CONTENT //DO NOT RUN THE REST OF THE SCRIPT/PAGE exit(); } //IF OBSCURE SCRIPT FUNCTIONALITY IS ON, AND IF A FETCH REQUEST WAS MADE, //PERFORM THE FOLLOWING VALIDATION else if ($obscureScripts && isset($_GET['fetch']) && $_GET['fetch'] == 'content') { //ATTEMPT TO RETRIEVE EXISTING SESSION session_start(); //CHECK IF A SESSION WAS SET: THIS IS TO INDICATE THE LOADING OF FAKE CONTENTS AND THAT //THE REAL CONTENTS ARE ONLY LOADED ONCE - BY THE JQUERY SCRIPTS PREVIOUSLY LOADED if (isset($_SESSION['obscr']) && $_SESSION['obscr'] == 'set') { //ONCE CONFIRMED, UNSET THE SESSION TO PREVENT ANOTHER REQUEST unset($_SESSION['obscr']); //IF THE SESSION BECAME EMPTY AFTER UNSETTING THE 'obscr' SESSION VARIABLE, //DELETE THE SESSION if (empty($_SESSION)) { session_unset(); session_destroy(); } //CLOSE THE SESSION WRITER AND PROCEED TO THE REST OF THE CONTENTS session_write_close(); //NOTICE THAT THERE NOT exit() OR die() REQUEST HERE. //THIS MEANS THAT THE SCRIPT WOULD PROCEED TO THE CONTENTS } //IF NO SESSION IS SET, THIS MEANS THAT THE GET METHOD IS PROBABLY BEING REQUESTED //FOR THE SECOND TIME; PROBABLY NOT BY THE PRE-LOADED SCRIPTS //IF SO, PERFORM THE FOLLOWING: else { //CLOSE THE SESSION WRITER session_write_close(); //RELOAD THE PAGE BY REDIRECTING TO SELF header('Location: '.$_SERVER['PHP_SELF']); //PREVENT SHOWING ANYTHING AFTER THIS CODE exit(); } } ?> <html> <head><title>The content you want to hide</title></head> <body>Your precious content.</body> </html>
Again, this is not a stupid method. Anyone can completely overtake a preloaded script while it runs the get method in front of it. I used PHP sessions to restrict access; which can be improved.
Honestly, this is just an extra process load. But that doesn't stop anyone from trying, right?
PS: Forgive me if my codes and use of terminology is a bit rudimentary. I was only doing Php for a year at the time of writing.
Publication Method:
<?Php //THE FOLLOWING VARIABLE IS ADDED TO ENABLE TOGGLING OF THIS FUNCTIONALITY: $obscureScripts = TRUE; //IF OBSCURE SCRIPT FUNCTIONALITY IS ALLOWED, //THE SYSTEM SHOULD ONLY ALLOW REQUESTS TRIGGERED BY SPECIFIED GET METHOD //OTHER THAN THAT, OR UNLESS $_GET['fetch'] == 'content', PERFORM THE FOLLOWING SCRIPTS: if ($obscureScripts && !(isset($_POST['fetch']) && $_POST['fetch'] == 'content')) { //OPEN A SESSION session_start(); //CREATE AN INDICATOR THAT THIS METHOD HAS BEEN USED $_SESSION['obscr'] = 'set'; //CLOSE SESSION WRITER session_write_close(); //ECHO THE FAKE CONTENTS OF YOUR PAGE echo // USING HEREDOC THIS TIME <<<SCRIPT <script type='text/javascript' src='plugins/jquery-1.9.0.min.js'></script> <script> \$.post ( "{$_SERVER['PHP_SELF']}", { fetch:"content" } ).done ( function(data) { \$("body").empty().html(data); } ); </script> <html> <head> <title>Page Front</title> </head> <body> <center>Loading...</center> </body> </html> SCRIPT; //THE FAKE CONTENTS WOULD IN TURN RUN A JQUERY SCRIPT TO RETRIEVE THE ACTUAL PAGE CONTENT //DO NOT RUN THE REST OF THE SCRIPT/PAGE exit(); } //IF OBSCURE SCRIPT FUNCTIONALITY IS ON, AND IF A FETCH REQUEST WAS MADE, //PERFORM THE FOLLOWING VALIDATION else if ($obscureScripts && isset($_POST['fetch']) && $_POST['fetch'] == 'content') { //ATTEMPT TO RETRIEVE EXISTING SESSION session_start(); //CHECK IF A SESSION WAS SET: THIS IS TO INDICATE THE LOADING OF FAKE CONTENTS AND THAT //THE REAL CONTENTS ARE ONLY LOADED ONCE - BY THE JQUERY SCRIPTS PREVIOUSLY LOADED if (isset($_SESSION['obscr']) && $_SESSION['obscr'] == 'set') { //ONCE CONFIRMED, UNSET THE SESSION TO PREVENT ANOTHER REQUEST unset($_SESSION['obscr']); //IF THE SESSION BECAME EMPTY AFTER UNSETTING THE 'obscr' SESSION VARIABLE, //DELETE THE SESSION if (empty($_SESSION)) { session_unset(); session_destroy(); } //CLOSE THE SESSION WRITER AND PROCEED TO THE REST OF THE CONTENTS session_write_close(); //NOTICE THAT THERE NOT exit() OR die() REQUEST HERE. //THIS MEANS THAT THE SCRIPT WOULD PROCEED TO THE CONTENTS } //IF NO SESSION IS SET, THIS MEANS THAT THE GET METHOD IS PROBABLY BEING REQUESTED //FOR THE SECOND TIME; PROBABLY NOT BY THE PRE-LOADED SCRIPTS //IF SO, PERFORM THE FOLLOWING: else { //CLOSE THE SESSION WRITER session_write_close(); //RELOAD THE PAGE BY REDIRECTING TO SELF header('Location: '.$_SERVER['PHP_SELF']); //PREVENT SHOWING ANYTHING AFTER THIS CODE exit(); } } ?> <html> <head><title>The content you want to hide</title></head> <body>Your precious content.</body> </html>