Opinionated: I dont get the issue about people (incl. bots) visiting your website, regardless of where they originate from and what url they use.

Publishing something online means I want it to be seen.

Relying or enforcing Referer or query string basically contradicts the intent. Wanting to know where your users come from could be legit but then you basically distort the "public web" aspect to a "public trap" where you try to sneak on visitors.

Not my vibe