how to handle spoofed referers?
 

I have password hackers spoofing the refering url and getting past all my .htaccess files..

Any ideas what I can do to stop them??

:helpme

You need more advanced protection. What is it you have there? Paysite or AVS?

You may need to use .htpasswd along with .htaccess to protect your whole member area (including images ans clips) with passwords (not forgetting to wipe those passwords that were stolen) or you may need to track the surfer session, if you can't use .htpasswd due to some compatibility reasons. Again it can be done in two ways - you can use server scripts, which require damn good knowledge of server side script programming or some money to buy a ready script, or you can make this using php, which also requires some knowledge. Basically, tracking user's session with PHP is not that hard, but you need to restrict all direct downloads and pass all content requests through some king of php hub. Wich is honestly not too complicated as well, but you gotta understand how to do this.

Is it for a plugin type thing? you could use a door/key solution or other's & cookie auth!

jDoG