diff --git a/ajax/actorDetails.php b/ajax/actorDetails.php
index e7ca81a..bbe7ecc 100644
--- a/ajax/actorDetails.php
+++ b/ajax/actorDetails.php
@@ -1,5 +1,12 @@
 <?php
 require_once("../helper.php");
+
+// Der Endpunkt gibt Geraetenamen und Steuer-URLs aus der homeMesh-
+// Datenbank aus und war bisher ohne Anmeldung erreichbar.
+if (!checkLogin()) {
+    http_response_code(403);
+    exit;
+}
 if(isset($_GET["actorID"])){
     $actorID = intval($_GET["actorID"]);
     $qry = "SELECT command_name, command_url, parameter_type, min_value, max_value, possible_values, command_parameters.url AS parameter_url, parameter_name FROM actor_commands LEFT JOIN command_parameters ON actor_commands.id = command_id LEFT JOIN state_types ON parameter_type = state_types.id WHERE actor_id=".$actorID;
diff --git a/ajax/fillActorDD.php b/ajax/fillActorDD.php
index d129140..7f03011 100644
--- a/ajax/fillActorDD.php
+++ b/ajax/fillActorDD.php
@@ -1,5 +1,12 @@
 <?php
 require_once("../helper.php");
+
+// Der Endpunkt gibt Geraetenamen und Steuer-URLs aus der homeMesh-
+// Datenbank aus und war bisher ohne Anmeldung erreichbar.
+if (!checkLogin()) {
+    http_response_code(403);
+    exit;
+}
 $qry = "SELECT name, actors.id FROM actors INNER JOIN actor_commands ON actor_id  = actors.id GROUP BY actors.id";
 $mysql = new mysqli($mysql_server, $mysql_MeshUser, $mysql_MeshPass, $mysql_MeshDB);
 $result = mysqli_query($mysql, $qry);
diff --git a/ajax/fillSensorDD.php b/ajax/fillSensorDD.php
index 5c47f7e..036381d 100644
--- a/ajax/fillSensorDD.php
+++ b/ajax/fillSensorDD.php
@@ -1,5 +1,12 @@
 <?php
 require_once("../helper.php");
+
+// Der Endpunkt gibt Geraetenamen und Steuer-URLs aus der homeMesh-
+// Datenbank aus und war bisher ohne Anmeldung erreichbar.
+if (!checkLogin()) {
+    http_response_code(403);
+    exit;
+}
 $qry = "SELECT name, actors.id FROM actors INNER JOIN actor_states ON actor_id  = actors.id GROUP BY actors.id";
 $mysql = new mysqli($mysql_server, $mysql_MeshUser, $mysql_MeshPass, $mysql_MeshDB);
 $result = mysqli_query($mysql, $qry);
diff --git a/ajax/sensorDetails.php b/ajax/sensorDetails.php
index 36a33a6..cc06dad 100644
--- a/ajax/sensorDetails.php
+++ b/ajax/sensorDetails.php
@@ -1,5 +1,12 @@
 <?php
 require_once("../helper.php");
+
+// Der Endpunkt gibt Geraetenamen und Steuer-URLs aus der homeMesh-
+// Datenbank aus und war bisher ohne Anmeldung erreichbar.
+if (!checkLogin()) {
+    http_response_code(403);
+    exit;
+}
 if(isset($_GET["sensorID"])){
     $sensorID = intval($_GET["sensorID"]);
     $qry = "SELECT state_name, url, state_types.type, unit, current_value, possible_values FROM actor_states LEFT JOIN state_types ON state_type = state_types.id WHERE actor_id=".$sensorID;