Restrict users to view custom form(s) without complete other formalities

Question

I wrote 3 custom forms using hook_menu() for resetting password. All forms have these functionalities.

Form # 1. On submit, sends OTP (code) after entering mobile number and redirect to form # 2

From # 2. On submit, validate OTP and redirect to form # 3

From # 3. The last form where user can enter password and confirm password and submit.

How to restrict user from accessing form#2 without submit form#1?

                        AND

How to restrict user from accessing form#3 without submit form#2?

Answer 1

Check the referring page using $_SERVER['HTTP_REFERER'] if it doesn't match the previous page either throw an error or redirect him to the first page.