title: Preventing cURL Referrer spoofing
body: <p>We received PHP code from a developer with a web-stats script that relies solely on <code>$_SERVER['HTTP_REFERER']</code>. With cURL, you can easily fake it as follows:</p>
  
  <pre><code>curl_setopt($curl, CURLOPT_REFERER, "client website");
  </code></pre>
  
  <p>and I'm looking for a way to prevent it. This can even be done by the client website as well, to have higher stats. I'm looking for a way to prevent this spoofing. Is this possible at all? If so, how can this be achieved?</p>