Referrer spam summary

[J.D.]

After we discussed this topic a few times (e.g. 6907, 11333) I got a couple of private comments about referrer spam and just wanted to clarify one thing:

Even though it is remotely possible that some low-tech spammers can create a special HTML page with links to your website and simply click on them, this is not how they do this. It is very simple to write a small application (a dozen lines of code, really) that connects to a website and sends an HTTP request with a fake referrer, completely ignoring the results and, consequently, your redirects.

Instead of redirection, simply reject requests with referrers you know about (you can use the [F] flag in mod_rewrite for this). The fake referrer will still make it into your logs, but under a failed code (e.g. 403 if you use [F]). Those of you who have hi-tech hardware can configure your firewall to scan HTTP requests and drop those with spammy referrers.

Personally, when I see someone really going at it trying to submit their referrer, so that they distort my stats, I block their IP addresses. As for those that hit the website just a few times a day - I simply ignore them. I don't publish my stats and don't really care what's at the bottom of the page

J.D.

[S.Phoenix]

This is a very nice solution to prevent these kind of spamming.