I think once you look at the whole picture you'll understand why there really isn't anything reliable for this information.
First, the only information the server has is this:
- Remote IP address
- Web Browser and Version *
- What page they're looking for
- Where the user came from *
The two * entries are sent by the browser, and can't always be trusted. I can spoof those to quite easily using 'wget', or any Perl script using LWP::UserAgent, etc. And of course the UserAgent can be hacked in the Windows registry for IE (mine has the string "37331 h4x0r" appended to it
.
Back to the referer string though. The browser sends you the URL of the last page it was on. Now some browsers will only send this information if there was an actual link on the page.
Some versions of IE, though, will send an HTTP_REFERER when you hit the 'back' button. This had me confused a while back until I dug through the logs -- I thought Microsoft was linking to me, but it was just a user hitting the back button.
Some browsers also send a referer of the last page you were on if you click one of your bookmarks. For example, let's say my "home page" in IE was Yahoo.com. I open a fresh browser window, and click my link to your website. You will see "yahoo.com" as a referer, even though it really had nothing to do with how I got to your site.
The worst part is, with IE, this behavior seems to change from version to version and platform to platform... I don't know about Netscape, but I've seen it send "[Bookmark]" as the referer if the user clicked a bookmark...
---
Now, since the only referer information the web server has is that one little string, there really is no other way to determine how the user got to your site.
Even the Remote IP address can be spoofed easily under NT or any *nix. Plus, it could be that of a proxy, cache, anonymiser, etc. BTW, that X_FORWARDED_FOR has nothing to do with a referer, it's something sent by some proxies.
End result (and I believe I said this in the X_FORWARDED_FOR thread as well): never trust user input. If it came from outside your own control, it is user input, and it is not to be trusted
Sorry if this long rant doesn't help... mind if I ask what exactly you're trying to accomplish btw? I'm curious... if you're just looking for a count of people who get to your site via a bookmark, there's not much you can do about that...