Preventing referral scams

Question

How can you prevent "referral scams"?

For example, in a wordpress-based site of mine, I suddenly noticed that someone clicked a link from some site I had never heard of. When I followed the link, there was obviously not a link to MY site. The site was selling products, in this case books. All comments followed a similar speech pattern, and the website URL for each owner of these "comments" was the amazon.com link to the product.

Obviously a scam, I quickly backed off the website.

Is there any way to prevent these forged referrals via PHP?

Some way of telling if they are automated or do not come from a reputable source?

This is starting to annoy me.

Thanks for the help, this has been bugging me for ages!

Answer 1

As an answer I am afraid you can't. There is no way to control what referrer people send to you.

You can reduce it by doing as Chris suggested. But as a rule anyone who uses a bot to deliberately create this type of spam will change the User-Agent string. Heck I do it to prevent the stupid firewall I am behind from preventing me using Firefox, because hey we know how safe IE is.

So using that technique will only stop a very small percentage.

The important thing to remember is anyone can fake anything sent to your server, form values, http headers, cookies even IP addresses, so don't trust any of it and don't worry about it.

Not the answer you wanted but unfortunately the only real answer. If you really really must, then you would get the referrer, scrape that page and if no link found ignore it. but thats a lot of work and ignores javascript created links (from ads etc).

Sometimes you get a bad referrer simply from a broken browser or scraping software or even a search bot.

DC

Answer 2

Depending on how much control you have over the server, you might find it useful to install mod_security (Apache module). mod_security acts as a firewall for Apache, allowing you to block requests that match (or do not match) a set of criteria (including user agent, referring site, etc.).

Here is a blog post that has information on using mod_security to deal with referral spam:
http://atomicplayboy.net/blog/2005/01/30/an-introduction-to-mod-security/