ADS-010
Gate earning by referer without blocking the page
Check that the request came from the site the slot belongs to. Refuse the credit, never the content — the same rule that keeps you out of trouble everywhere else.
A publisher's ad embed is a URL. Anyone can copy it onto a different site, or hit it directly in a loop, and the slot earns wherever it runs. Binding the slot to the site it was issued for closes that.
The referer header is the evidence available, and it is imperfect: privacy settings strip it, some browsers send only the origin, and it can be forged. So it is a factor in whether you pay, not a gate on whether you serve.
Serving anyway is the important half. An embed that breaks on a page where the referer is missing looks like your network is broken, and the publisher removes it.
function referer_matches(string $expectedHost): string
{
$ref = (string) ($_SERVER['HTTP_REFERER'] ?? '');
if ($ref === '') {
return 'missing'; // stripped by policy: common and innocent
}
$host = strtolower((string) (parse_url($ref, PHP_URL_HOST) ?: ''));
$want = strtolower($expectedHost);
if ($host === '') {
return 'missing';
}
if ($host === $want || str_ends_with($host, '.' . $want)) {
return 'match';
}
return 'mismatch'; // running somewhere it was not issued for
}
function may_credit_slot(array $slot): bool
{
$result = referer_matches((string) $slot['site_host']);
if ($result === 'mismatch') {
return false; // serve it, pay nothing
}
if ($result === 'missing') {
// Policy decision: pay it, or pay it only if the visitor key is unseen today.
return setting_bool('pay_on_missing_referer', true);
}
return true;
}Using it
Count the three outcomes separately in your stats. A publisher whose mismatch rate suddenly climbs has either moved domain or handed the embed to someone else, and you want to know which.
Tell publishers the rule in the documentation. Someone testing on localhost and seeing zero earnings will otherwise open a ticket.
What bites people
A referer can be forged, so this is not a security control. It raises the effort, nothing more.
Refusing to serve on a mismatch punishes the visitor for the publisher's mistake and makes your network look unreliable. Serve, and withhold the credit.