will this block weird referrers?

Hi Ken,

Yes, it will. The plugin doesn’t decide based on the referrer ( anyone can fake that header, which is what you’re seeing ). It checks for a proof that only exists when the checkout page was actually rendered in a browser. A script posting straight to /?wc-ajax=checkout never loaded the page, so it never has the proof, and the request is refused before an order or payment attempt is created. What referrer it claims doesn’t matter.

The referrer is only used as a secondary signal ( logged in free, and used in Pro to tighten Permissive mode ). The blocking itself comes from the missing proof.

Two things after installing: submit your own checkout once, that’s what arms it. And if you’d rather watch first, Learning mode logs what would have been blocked so you can compare against your access log.

Regards,
Ali