Q:

Chrome Instant invald URLs triggering website lockout

My website uses obscure, random URLs to provide some security for sensitive documents.  E.g. a URL might be http://example.com/<random 20-char string>.  The URLs are not linked to by any other pages, have META tags to opt out of search engine crawling, and have short expiration periods.  For top-tier security some of the URLs are also protected by a login prompt, but many are simply protected by the obscure URL.  We have decided that this is an acceptable level of security. 
We have a lockout mechanism implemented where an IP address will be blocked for some period of time following several invalid URL attempts, to discourage brute-force guessing of URLs. 
However, Google Chrome has a feature called "Instant" (enabled in Options -> Basic -> Search), that will prefetch URLs as they are typed into the address bar.  This is quickly triggering a lockout, since it attempts to fetch a bunch of invalid URLs, and by the time the user has finished, they are not allowed any more attempts. 

Is there any way to opt out of this feature, or ignore HTTP requests that come from it? 
Or is this lockout mechanism just stupid and annoying for users without providing any significant protection? 

(Truthfully, I don't really understand how this is a helpful feature for Chrome.  For search results it can be interesting to see what Google suggests as you type, but what are the odds that a subset of your intended URL will produce a meaningful page?  When I have this feature turned on, all I get is a bunch of 404 errors until I've finished typing.) 

A:

Without commenting on the objective, I ran into a similar problem (unwanted page loads from Chrome Instant), and discovered that Google does provide a way to avoid this problem:

When Google Chrome makes the request to your website server, it will send the following header:
X-Purpose: preview

Detect this, and return an HTTP 403 ("Forbidden") status code.