Daniel,

Do the blocking in the web server, not PHP. You want to push this kind
of stuff as upstream in your system as you can get it - if you can
block them at your firewall, even better.
Look at the Access Control section, if you are using httpd 2.4:
https://httpd.apache.org/docs/2.4/howto/access.html

the section - Access control by arbitrary variables - looks to have
what you want with HTTP_REFERER -  like so:

<If "%{HTTP_REFERER} == 'Badland.org'">
    Require All Denied
</If>

that's just some quick cut & paste, but a good example of what httpd
2.4 might look like - ymmv