The User Agent Blocking feature works great, but I would like to be able to restrict it based on the referrer as well. In my particular case, the bot traffic was masquerading behind common user agents, but the traffic was always direct, meaning the referrer wasn’t set. Ideally, I would like to issue a Challenge to those requests matching the suspected bot’s user agent AND an empty referrer. The ability to specify any pattern for the referrer would be even better. This feature was also suggested in this post.