I'm not really sure, it's low-hanging fruit for privacy, so it's one of the first things you can do to stop leaking your history around the Web. It's quite easy

I'm not really sure, it's low-hanging fruit for privacy, so it's one of the first things you can do to stop leaking your history around the Web. It's quite easy to defeat a referer check, just like robots.txt can be bypassed by the robot simply not requesting or checking it. But the things that do behave predictably or respect limitations, will. This won't fix the problem, but it lowers the amount of work you have to do to get the rest of them. If I was that concerned about things I think I'd either stop hosting them, or put out a shared secret or something and require a password. I can't blame people for deciding they only want positive interactions on the Web and are willing to put technical things in place to help it be possible. I'd be more interested in a lower-level approach, at the server or network level if possible, to simply isolate unwanted IP ranges and domains. If a server has `0.0.0.0 google.com` in /etc/hosts and Google tries connecting... what happens? Timed out connection? Selective or conditional publishing is an interesting idea that I don't think we've explored enough.