Then the problem is the browser makers enabling referrer by default, not my Webserver looking at it. Is looking at the user agent string immoral surveillance too, because most people probably don’t know that exists either?