I have a page that loads other pages via Ajax (think frames, except without the frames).
Obviously these pages can all be called independently, so I want to detect
You cannot never trust clients and their sent information! The headers can be spoofed by hackers (for example with cURL) and even HTTP_X_REQUESTED_WITH is not reliable. there is no 100% trusted way to know that. The Only way is using captcha...