Preventing referral scams

How can you prevent "referral scams"?

For example, in a wordpress-based site of mine, I suddenly noticed that someone clicked a link fro开发者_StackOverflow社区m some site I had never heard of. When I followed the link, there was obviously not a link to MY site. The site was selling products, in this case books. All comments followed a similar speech pattern, and the website URL for each owner of these "comments" was the amazon.com link to the product.

Obviously a scam, I quickly backed off the website.

Is there any way to prevent these forged referrals via PHP?

Some way of telling if they are automated or do not come from a reputable source?

As an answer I am afraid you can't. There is no way to control what referrer people send to you.

You can reduce it by doing as Chris suggested. But as a rule anyone who uses a bot to deliberately create this type of spam will change the User-Agent string. Heck I do it to prevent the stupid firewall I am behind from preventing me using Firefox, because hey we know how safe IE is.

So using that technique will only stop a very small percentage.

The important thing to remember is anyone can fake anything sent to your server, form values, http headers, cookies even IP addresses, so don't trust any of it and don't worry about it.

Not the answer you wanted but unfortunately the only real answer. If you really really must, then you would get the referrer, scrape that page and if no link found ignore it. but thats a lot of work and ignores javascript created links (from ads etc).

Sometimes you get a bad referrer simply from a broken browser or scraping software or even a search bot.

Depending on how much control you have over the server, you might find it useful to install mod_security (Apache module). mod_security acts as a firewall for Apache, allowing you to block requests that match (or do not match) a set of criteria (including user agent, referring site, etc.).

Here is a blog post that has information on using mod_security to deal with referral spam:
http://atomicplayboy.net/blog/2005/01/30/an-introduction-to-mod-security/

There are ways to prevent this, even 12 years later this continues to happen. Bizarrely this was a bona-fide tactic to improve rankings for some time. People would install mediawiki two moths before launch and them delete it at launch. The downside was that the site would appear to the educated to have been compromised. But the educated did not click links in spam.

1. Moderate your comments, do not just let them be posted, but review every one. This was "Newsgroup 100" back in the day..
2. Don't allow comments at all. This will hurt your character and your reputation, as something you host may differ from accepted wisdom.
3. Install a plugin to help with moderation. Tune it.

But yes, you need a MODERATOR and/or an APPROVER. A daily task with a queue.