Is it possible to block direct access to a portlet render URL?

Issue

• We would like prevent direct access to portlet render URLs (/c/portal/render_portlet) that bypass normal navigation within the portal. 
• These portlets have been manually added to the page.
• Example URL:

  /c/portal/render_portlet?p_l_id=17&p_p_id=com_acme_z3x1_portlet_MyPortlet_INSTANCE_X4QSG&p_p_lifecycle=2

Environment

• Any Liferay DXP Version

Resolution

There is no supported way to block these URLs out of the box. Out-of-the-box portlet permissions are not granular enough to cover this use case.

Possible workarounds include:

1. Blocking the URL pattern in the app server/web server.
2. Adding a custom portlet filter to restrict, intercept, and block the portlet rendering if it is not loaded within a page.

However, note that these approaches are not recommended as they might cause unexpected behavior.