If you're trying to protect from hacking via HTTP Referrer info, you're doing it wrong. Anyone can fake HTTP Referer info, and if they're going to the trouble

If you're trying to protect from hacking via HTTP Referrer info, you're doing it wrong. Anyone can fake HTTP Referer info, and if they're going to the trouble of stealing an API key then they're not just a passing bot.