Wordfence 5.3.2 Released, now with Referer Blocking
The newest version of Wordfence includes a much requested feature and you can thank Tim Cantrell for listening to your requests and getting us to put this in 5.3.2. You can now set up blocking in Wordfence to block certain referring websites. Many of you have asked for this feature because of the referrer spam problem out there.
First a quick primer: When a web browser or robot arrives at your website, it sends a piece of data called a referer (see footnote below if you want to know why this is misspelled). This tells your website which website the visitor arrived from. It’s quite easy to fake this data and to create a web crawler that goes around claiming that it’s arriving from some spammy website when in fact it’s just visiting your site directly.
I wrote about this over a year ago and so have others, but referer spam is when a robot arrives at your website pretending to be arriving from an external site. That external site is often malicious. So your logging applications like Google Analytics will log that the malicious site sent you traffic and put the name of that site in your logs.
This helps the malicious site in two ways. If they send you enough hits, you take a look at your logs, are curious what this wonderful new site is that’s sending you traffic and visit the website. Mission accomplished on the spammers part.
The second way it helps them is if you display your top referers anywhere on your site. Their site will appear at the top with a back-link which helps them in the search rankings.
Each request they send you with a fake referer consumes your site resources and pollutes your logging.
So now, as of Wordfence 5.3.2 which was released a few minutes ago, if you have a referer spam problem you can set up a pattern in advanced blocking to simply stop the rogue crawlers that are spamming you in their tracks. You can read the documentation for how to set up referer blocking on the official Wordfence documentation website.
Wordfence 5.3.2 also includes a new API call which allows the developers of other plugins you use to whitelist their own server IP addresses and ensure interoperability between Wordfence and other plugins.
We regularly work with other plugin authors and vendors to ensure interoperability between Wordfence and the other products that you use, and this feature was a product of that ongoing work.
Footnote: Incidentally if you’re interested in why I’m misspelling “referer” in this blog entry and our documentation, here’s the history of why “referrers” on the web became known as “referers”.
Comments
5:41 am
Thank you, thank you and thrice more thank you.
Goodbye shitty fake SEMalt and buttons-for-websites links in my referral logs!
5:42 am
This referrer blocking is tremendously useful. Thank you. Coupled with the API/default setup option, I'll be able to block the bad referrers (semalt and others) from multiple sites fairly easily and the referrers won't pollute my statistics. Nicely done!
1:06 pm
Hi guys. It's not actually clear that bad referer blocking information transfers with the export/import token function. Is that on purpose?
1:22 pm
Hi Cliff,
Please post this in our forums here: https://wordpress.org/support/plugin/wordfence
Or in our priority ticketing system if you're a paid customer. We don't provide product support on our blog.
Regards,
Mark.
6:00 am
Referer is a really bad way to block people, as these can be easily faked.
11:06 am
The idea is not to use referer to identify those who need to be blocked, but rather, to block rogue bots that are spamming a specific referer.
6:19 am
We need more examples (many) of how best to implement this.
Great feature, want to put it to work, but still not sure I'll recognize the best opportunities; or, be able to implement with best optimization.
8:36 am
Nice feature, thanks! Hasta la vista semalt and their stats skewing.
10:20 pm
Your plugin has helped me more than any other plugin I have. The firewall settings have stopped my server crashing, and the email alerts have educated me as to what is really happening to my website. Thanks.
As richard said above, Id love an example of how to implement this latest addition.
Also, and forgive me if I have missed this feature; Im running multiple websites and often tweak my settings (as i learn what works best), but need to go through each site one by one. Is there a 'save' / 'import' type set up so I can match all my sites more easily than adjusting each parameter individually?