A system for protecting uniform resource locators (URLs) comprising: a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising: detecting a request to access one of a plurality of protected URLs from a client computing device; receiving, from the client computing device, a URL password, wherein the received URL password is in response to one of a plurality of challenge-response problems provided in a codebook downloadable by the client computing device, wherein the one challenge-response problem is a hash-based message authentication code (HMAC) operation using a SHA-256 as a hash function of the operation, wherein the one challenge-response problem comprises finding a 256-bit value that, when used as a key in the HMAC operation using the SHA-256 on a nonce provided by the system, produces a signature having a predetermined prefix associated with the one of the plurality of protected URLs for which the request to access is detected, wherein the found 256-bit value and the nonce together constitute the received URL password; and redirecting the request to the protected URL upon determining that the received URL password is valid for the one of the plurality of protected URLs, wherein the received URL password is validated when the found 256-bit value of the received URL password, when used as a key in the HMAC operation using the SHA-256 on the nonce of the received URL password, produces a signature having the predetermined prefix. a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising: detecting a request to access one of a plurality of protected URLs from a client computing device; receiving, from the client computing device, a URL password, wherein the received URL password is in response to one of a plurality of challenge-response problems provided in a codebook downloadable by the client computing device, wherein the one challenge-response problem is a hash-based message authentication code (HMAC) operation using a SHA-256 as a hash function of the operation, wherein the one challenge-response problem comprises finding a 256-bit value that, when used as a key in the HMAC operation using the SHA-256 on a nonce provided by the system, produces a signature having a predetermined prefix associated with the one of the plurality of protected URLs for which the request to access is detected, wherein the found 256-bit value and the nonce together constitute the received URL password; and redirecting the request to the protected URL upon determining that the received URL password is valid for the one of the plurality of protected URLs, wherein the received URL password is validated when the found 256-bit value of the received URL password, when used as a key in the HMAC operation using the SHA-256 on the nonce of the received URL password, produces a signature having the predetermined prefix. detecting a request to access one of a plurality of protected URLs from a client computing device; receiving, from the client computing device, a URL password, wherein the received URL password is in response to one of a plurality of challenge-response problems provided in a codebook downloadable by the client computing device, wherein the one challenge-response problem is a hash-based message authentication code (HMAC) operation using a SHA-256 as a hash function of the operation, wherein the one challenge-response problem comprises finding a 256-bit value that, when used as a key in the HMAC operation using the SHA-256 on a nonce provided by the system, produces a signature having a predetermined prefix associated with the one of the plurality of protected URLs for which the request to access is detected, wherein the found 256-bit value and the nonce together constitute the received URL password; and redirecting the request to the protected URL upon determining that the received URL password is valid for the one of the plurality of protected URLs, wherein the received URL password is validated when the found 256-bit value of the received URL password, when used as a key in the HMAC operation using the SHA-256 on the nonce of the received URL password, produces a signature having the predetermined prefix.