diff --git a/entityreference_prepopulate.module b/entityreference_prepopulate.module
index 9c06140..9bc540b 100644
--- a/entityreference_prepopulate.module
+++ b/entityreference_prepopulate.module
@@ -121,17 +121,25 @@ function entityreference_prepopulate_field_attach_form($entity_type, $entity, &$
           $form[$field_name]['#access'] = FALSE;
         }
       }
-      elseif (in_array($settings['fallback'], array('form_error', 'redirect', 'hide'))) {
+      elseif (in_array($settings['fallback'], array('form_error', 'redirect', 'hide', 'denied'))) {
         $message = t('Field @label must be populated via URL.', array('@label' => $instance['label']));
-        if ($settings['fallback'] == 'form_error') {
-          form_error($form, $message);
-        }
-        elseif ($settings['fallback'] == 'redirect') {
-          drupal_set_message($message, 'notice');
-          drupal_goto();
-        }
-        elseif ($settings['fallback'] == 'hide') {
-          $form[$field_name]['#access'] = FALSE;
+
+        switch ($settings['fallback']) {
+          case 'form_error':
+            form_error($form, $message);
+          break;
+          case 'redirect':
+            drupal_set_message($message, 'notice');
+            drupal_goto(isset($settings['redirect_path']) ? $settings['redirect_path'] : NULL);
+          break;
+          case 'denied':
+            drupal_set_message($message, 'notice');
+            drupal_access_denied();
+            drupal_exit();
+          break;
+          case 'hide':
+            $form[$field_name]['#access'] = FALSE;
+          break;
         }
       }
     }
diff --git a/entityreference_prepopulate.test b/entityreference_prepopulate.test
index 20a7822..a22001c 100644
--- a/entityreference_prepopulate.test
+++ b/entityreference_prepopulate.test
@@ -360,3 +360,96 @@ class EntityReferenceProvidersTestCase extends DrupalWebTestCase {
     }
   }
 }
+
+
+class EntityReferenceFallback extends DrupalWebTestCase {
+  private $user;
+  private $content_type;
+
+  public static function getInfo() {
+    return array(
+      'name' => 'Prepopulate fallback',
+      'description' => 'Verify the prepopulate fallback settings.',
+      'group' => 'Entity reference prepopulate',
+    );
+  }
+
+  public function setUp() {
+    parent::setUp(array('entityreference', 'entityreference_prepopulate'));
+
+    $this->content_type = $this->drupalCreateContentType();
+    $field = array(
+      'field_name' => 'node_ref',
+      'type' => 'entityreference',
+      'cardinality' => 1,
+    );
+    field_create_field($field);
+
+    $instance = array(
+      'field_name' => 'node_ref',
+      'entity_type' => 'node',
+      'label' => 'Node ref',
+      'bundle' => $this->content_type->type,
+      'settings' => array(
+        'behaviors' => array(
+          'prepopulate' => array(
+            'status' => TRUE,
+            'action' => 'none',
+            'fallback' => 'denied',
+          )
+        ),
+      ),
+    );
+    field_create_instance($instance);
+
+    $this->user = $this->drupalCreateUser(array('bypass node access'));
+
+  }
+
+  /**
+   * Set various settings of the entity reference prepopulate settings.
+   */
+  function testFallbackSetting() {
+    $this->drupalLogin($this->user);
+
+    // test default setting of access denied
+    $this->drupalGet('node/add/' . $this->content_type->type);
+    $this->assertResponse('403', 'Fell back to access denied due to non prepoulated value');
+
+
+    // Show form error when the prepopulate value is missing
+    $this->changeInstanceSettings(array('fallback' => 'form_error'));
+
+    $edit = array('title' => 'Referencing node');
+
+    $this->drupalPost('node/add/' . $this->content_type->type, $edit, t('Save'));
+    $this->assertTrue($this->getUrl() == url('node/add/' . $this->content_type->type, array('absolute' => TRUE)), 'Fallback did not redirect to a different path.');
+    $this->assertText('Field Node ref must be populated via URL', 'Error messages is shown');
+
+
+    // Redirect when the prepopulate value is missing
+    $this->changeInstanceSettings(array('fallback' => 'redirect'));
+
+    $this->drupalGet('node/add/' . $this->content_type->type);
+    $this->assertTrue($this->getUrl() == url('<front>', array('absolute' => TRUE)), 'Redirect to front due to non prepoulated value.');
+
+
+    // Redirect with configured path when the prepopulate value is missing
+    $this->changeInstanceSettings(array('redirect_path' => 'user'));
+    $this->drupalGet('node/add/' . $this->content_type->type);
+    $this->assertTrue($this->getUrl() == url('user', array('absolute' => TRUE)), 'Redirect to configured path due to non prepoulated value.');
+
+
+  }
+
+  /**
+   * Change the settings of the instance.
+   */
+  private function changeInstanceSettings($settings) {
+    $instance = field_info_instance('node', 'node_ref', $this->content_type->type);
+    $old_settings = $instance['settings']['behaviors']['prepopulate'];
+    $instance['settings']['behaviors']['prepopulate'] = $settings + $old_settings;
+    field_update_instance($instance);
+  }
+
+}
diff --git a/plugins/behavior/EntityReferencePrepopulateInstanceBehavior.class.php b/plugins/behavior/EntityReferencePrepopulateInstanceBehavior.class.php
index 088db39..77233d0 100644
--- a/plugins/behavior/EntityReferencePrepopulateInstanceBehavior.class.php
+++ b/plugins/behavior/EntityReferencePrepopulateInstanceBehavior.class.php
@@ -35,6 +35,18 @@ class EntityReferencePrepopulateInstanceBehavior extends EntityReference_Behavio
         'hide' => t('Hide field'),
         'form_error' => t('Set form error'),
         'redirect' => t('Redirect'),
+        'denied' => t('Access denied'),
+      ),
+    );
+
+    $form['redirect_path'] = array(
+      '#type' => 'textfield',
+      '#title' => t('Redirect Path'),
+      '#description' => t('Path to redirect to if no values are provided via URL'),
+      '#states' => array(
+        'visible' => array(
+          ':input[name="instance[settings][behaviors][prepopulate][fallback]"]' => array('value' => 'redirect'),
+        ),
       ),
     );