Block Referer Spam
Blocks referer/referral spam bots from accessing your site and keeps them out of your analytics.
Solid choice
Block Referer Spam is a solid plugin choice in 2026, with a few things worth checking first. It runs on 500+ sites, is rated 3.4/5 and was last updated 2 months ago, and scores 70/100 on our health check.
- Small user base (500+ active installs)
- Mixed reviews — 3.4/5 from 21 ratings
How does it stack up?
Side-by-side on installs, updates, ratings & supportDaily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Block Referer Spam stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| analytics spam | #10 |
| referer spam | #1 |
| referral spam | #2 |
| referrer spam | #5 |
| spam | #29 |
Version adoption
Share of active sites per release.
Rating breakdown
★★★★★★★★★★ 3.4 from 21 reviews
About Block Referer Spam
From the official readme · v1.2Description
Block Referer Spam stops the bots that fake an HTTP_REFERER header to advertise their own site in your traffic logs and analytics. They’re good enough at simulating real visits that they show up in Google Analytics right alongside genuine traffic — this plugin blocks the known offenders before they’re ever logged, and needs no configuration to start working.
Two blocking modes cover different hosting setups:
- Rewrite mode (Apache only) — adds
RewriteCondrules to.htaccessso spam requests are rejected by the web server itself, before WordPress even loads. Fastest option, and the default when your host is detected as Apache. - WordPress mode — checks the referer during normal WordPress request handling and returns a 403. Works on any host, including nginx, but can’t intercept a request that’s served entirely from a full-page cache (see the FAQ below) — the plugin will warn you on its settings page if it detects an active caching plugin while running in this mode.
The block list itself is a mix of several public spam-referer sources, merged and refreshed automatically once a day (or on demand from the settings page). You can also add your own domains to block, including internationalized (non-ASCII) domain names — they’re normalized automatically.
From Wikipedia:
Referrer spam (also known as log spam or referrer
bombing) is a kind of spamdexing (spamming aimed
at search engines). The technique involves making
repeated web site requests using a fake referer URL
to the site the spammer wishes to advertise. Sites that
publish their access logs, including referer statistics,
will then inadvertently link back to the spammer's site.
These links will be indexed by search engines
as they crawl the access logs.
This benefits the spammer because the free link improves
the spammer site's search engine ranking owing
to link-counting algorithms that search engines use.
Features
- Automatic daily updates of the referer spam block list, or trigger an update manually
- Add your own custom domains to the block list, with automatic IDN/Punycode normalization
- Two blocking modes to fit Apache or non-Apache hosting: mod_rewrite or WordPress-level
- Warns you if a caching plugin is likely to interfere with WordPress-mode blocking
Pro
Pro plans start at $2/mo. Visit BlockReferSpam.com for more information.
- Sync your custom block list across all of your registered sites
- Access to additional curated block lists
Examples Blocked
- semalt
- buttons-for-website
- floating-share-buttons
- 4webmaster
- ilovevitaly
- … and many more!
Found a bug, or want to contribute? Get in touch — support / supersoju.com
Cover photo by Lukas Budimaier
Installation
- Install Block Referer Spam automatically, or upload the plugin ZIP file.
- Activate the plugin through the “Plugins” menu in WordPress.
- Go to the “Referer Spam” admin menu to review your blocking mode and options — the defaults work for most sites without any changes.
Using WP-CLI
wp plugin install block-referer-spam --activate
Frequently asked questions
What sites are blocked?
This plugin merges several public referer-spam block lists rather than relying on just one, refreshed automatically once a day, to keep coverage broad.
I still see those websites in my Google Analytics history!
Block Referer Spam prevents new spam hits from being logged — it doesn’t retroactively clean up analytics data you already have. To filter out existing spam entries in Google Analytics, see this tutorial.
I tested my site and a known spam referer can still get through!
A few common causes: The site isn’t on the block list yet. The list refreshes once a day, so very new spam domains may take a little while to be added. In the meantime, add it as a custom block yourself. A caching plugin is serving the request from cache. In WordPress blocking mode, a full-page cache (e.g. WP Rocket, W3 Total Cache, WP Super Cache, LiteSpeed Cache) can serve a cached page before WordPress — and this plugin — ever runs. Switch to Rewrite mode (Apache only) if you’re using a caching plugin, since it blocks at the web-server level before caching applies. Your host doesn’t…
Does this work with caching plugins?
Rewrite mode does, since it blocks before caching applies. WordPress mode can be bypassed by full-page caching — the plugin detects common caching plugins and shows a warning on its settings page if you’re running WordPress mode alongside one, so you can switch to Rewrite mode if your host supports it.
I found a bug!
Please report it — we aim to fix reported issues quickly.
Changelog
1.2
- Security: added a CSRF nonce check to the manual list-download action
- Security: enabled TLS certificate verification on the pro license request
- Security: fixed stored XSS in the Blocked Sites list and the pro key status message
- Security: replaced a raw PHP stream request with the WordPress HTTP API for list downloads
- Fix: flash messages no longer rely on PHP sessions (which were never actually started)
- Fix: uninstall now removes all plugin options,
.htaccessrules, and the scheduled cron event - Fix: scheduled cron event is now cleared on deactivation, instead of left running
- Fix: daily cron now respects the Auto Update setting instead of ignoring it
- Fix: PHP notice when no HTTP referer is present on the request
- Fix: removed unused/dead code left over from the bundled IDN library that failed to parse on PHP 8
- Improvement:
.htaccessrewrite rules are kept ahead of caching-plugin rules, so Rewrite mode still blocks spam when a caching plugin is active - Improvement: new admin notice when WordPress Block mode is active alongside a known caching plugin
- Improvement: the merged block list is now cached instead of re-parsed on every request
- Improvement: custom-block domain normalization now uses PHP’s native IDN support when available, only falling back to the bundled library on hosts without it
- Tested up to WordPress 7.0.3
1.1.9.3
- Tested for WordPress 5.0
- Fix issue where updated list sometimes does not get written to .htaccess when called via cron
1.1.9.1
- Cleans up after itself on deactivation
1.1.9
- Pro version available
1.1.8.5
- Readme typo fixes
- Blocklist back to using custom solution
1.1.7
- Readme typo fixes
- Blocklist back to using custom solution
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Block Referer Spam alternatives
All analytics spam plugins →| Rank | Plugin | Active installs |
|---|---|---|
| 2 |
WP Block Referrer Spam
Block 250+ spam sites, such as semalt.com and 4webmasters.org! Keep your website safe and…
|
60+ |
| 3 |
Block Referers
Block unwanted visitors from viewing your WordPress site.
|
10+ |
FAQ
Block Referer Spam: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 3, 2026
Is Block Referer Spam free?
Yes. Block Referer Spam is free to download and use from the official WordPress.org plugin directory.
Is Block Referer Spam safe to use in 2026?
Block Referer Spam is a solid plugin choice in 2026, with a few things worth checking first. It runs on 500+ sites, is rated 3.4/5 and was last updated 2 months ago, and scores 70/100 on our health check.
How many websites use Block Referer Spam?
Block Referer Spam is active on 500+ WordPress websites and has been downloaded 26,151 times since it launched in July 2015. It was downloaded 271 times in the last 30 days.
Does Block Referer Spam work with WordPress 7.1?
Block Referer Spam is officially tested up to WordPress 7.0.6, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
When was Block Referer Spam last updated?
The latest version, 1.2, was released on August 16, 2026 (2 months ago).
Who makes Block Referer Spam?
Block Referer Spam is developed and maintained by supersoju.
What are the best alternatives to Block Referer Spam?
The most popular alternatives to Block Referer Spam are WP Block Referrer Spam (60+ installs) and Block Referers (10+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
