I am trying to disallow access to https://example2.com without accessing https://example1.com first.

Solution #1. So My initial solution is to check $_SERVER['HTTP_REFERER'] of the example2.com,

if ($_SERVER['HTTP_REFERER'] != "example1.com") { redirect to example1.com };

but the solution above will not work for hackers as they can just use javascript or python to add <a href="example2.com"> element on the example1.com and then auto click the <a> tag to let the browser know that the referer is from example1.com.

Solution #2. My second solution is to send POST data from example1.com to example2.com. Like this:

<form method="post" action="example2.com">
    <input id="autoSubmit" name="veri" value="DoNotCheatPleaseWeWillBanYouGodIsWatchingYouHaveMercy">
</form>

then on example2.com

if(htmlspecialchars($_POST['veri']) != "DoNotCheatPleaseWeWillBanYouGodIsWatchingYouHaveMercy"){
    header('Location: example1.com');
    die();
}

In the code above, if you access example2.com directly, then it will redirect you to example1.com. So hackers can not add this a tag element on example1.com: <a href="example2.com">

but again, solution #2 was also a failure as any hacker can add a form element on the first website (example1.com) using javascript or python. <form method="post" action="example2.com"><input id="autoSubmit" name="veri" value="DoNotCheatPleaseWeWillBanYouGodIsWatchingYouHaveMercy"></form>

I am out of ideas even if I combine both ( Send POST and Check referer ), hackers can still access my other website directly. I am thinking of sending PHP sessions or cookies to example2.com but I still couldn't do it or maybe not possible. If you guys have any ideas please share. Thanks.