When remote profiles are enabled for a CiviCRM site, it says the following:

> Warning: External profile support (aka "HTML Snippet" support) is enabled in system settings. This setting may be prone to abuse. If you must retain it, consider HTTP throttling or other protections.

[A page on civicrm.org](https://civicrm.org/advisory/civi-sa-2016-17-manage-csrf-overrides-for-external-profile-forms) says the following about "HTML Snippets" (remote profiles):

> if your system has used the "HTML Snippet" technique, then you should evaluate measures such as:

> * Configure HTTP firewalling to prevent POSTs to CiviCRM from unrecognized referrers
> * Replace the "HTML Snippet" with a custom integration that uses a more secure data-flow based on APIv3 and REST.

Using the API for some of our related sites isn't a great option considering how easy it is to add a form to other domains.

What is HTTP firewalling? Does that require scanning referrers of POST requests, and ensuring that the originate from the CiviCRM instance or trusted sites? Is it possible to do this with a CiviCRM extension? Does such an extension already exist?

Thanks for your help. : )