Blocking referrers with Caddy

Create a matcher on the Referer header, followed by a hard-coded respond directive.

Every so often, somebody tells me that I’ve hit the front page of Hacker News. They always imagine I’ll be excited, but it just fills me with a sense of dread. Orange site commenters are a stain on my inbox: arrogant, rude, and condescending. I also get misgendered on the regular, a combination of ignorance and transphobia. Fun!

I’ve finally done what I should have done years ago: block all requests from Hacker News.

The block works by looking for news.ycombinator.com in the Referer header. This is trivial to circumvent, but most commenters will give up if a page doesn’t load on the first click. Even if some find their way to the site, it’ll tank the number of upvotes and minimise the number of readers who see the link.

Everybody wins: Hacker News commenters don’t have to read posts which are so obviously beneath them, and I don’t have to deal with their bile.

How it works

This is straightforward with my web server, which is Caddy. I define a request matcher which checks the Referer header, then use a respond directive to send a hard-coded error:

alexwlchan.net {
	@hacker_news {
		header Referer *ycombinator.com*
	}
	respond @hacker_news "Forbidden" 403

	root * /home/alexwlchan/sites/alexwlchan.net/_out
	file_server
}

Initially I used Caddy’s abort directive, which terminates the entire connection, but that made it a bit too easy to evade the block. If the server drops the connection and the browser reloads, the browser discards the previous value of the Referer header and gets a successful response. But if the server returns an error response and the browser reloads, it sends the same request and gets the same error.