No way to stop that, bar a annoying captcha detector maybe. Because you can control the whole http request using say curl and use proxies. Conversely I wouldn

No way to stop that, bar a annoying captcha detector maybe. Because you can control the whole http request using say curl and use proxies. Conversely I wouldn’t be surprised if some privacy extensions hide the referrer. You could do some basic bot detection though. Even a css hidden non-hidden field might catch the bots.