WordPress custom admin functions security

Read about “Nonces”.

Create one and append it to your URL:

$url="example.php?filename=whatever&nonce=" . wp_create_nonce('my_sensitive_action');

When your request is fulfilled check for it:

// here verify if the nonce was used before
if(wp_verify_nonce($_GET['nonce'], 'my_sensitive_action')){
  // it's ok, it wasn't used before
}

Also the validity of these nonces has a time limit, like one day or so.
If the nonce is not used within this period, it will expire…