EntityForms or Webforms appending form ID to confirmation page

We encourage users to post events happening in the community to the community events group on https://www.drupal.org.
left's picture

Hi everyone,

I've a client who has the following requirements:

  1. confirmation page with friendly URL (eg. website.com/thank-you)
  2. confirmation page not accessible directly, redirects to contact form.

In my experience, both Webform and Entityforms append the form id on the confirmation of each form submission (eg. website.com/thank-you?entityform_id=31)

Using Entityform's Confirm URL alias, the confirmation page displays a 403 access denied page when accessed directly (not via form submission path) which is great. Webform does not do this by default it seems.

I know I can set up a custom confirmation page but then I don't know how I would restrict direct access to it.

I am under the impression removing the ?entityform_id=31 would require custom code.

Does anyone have any insight in general on this, or previous experience with requirements like this? Opinions as to the validity of both requirements would also be welcomed.
Does it matter that the thank you page is accessible? Does it matter that the form ID appears in the confirmation URL?

Thanks :)

Lisa