Other answers' checks' are good but are not strictly bound to your website. So for example referer with value http://attacker.com/www.example.com/
will pass almost all the checks. And it is very easy to make such site and just send a cross-domain request.
There is a reliable and secure method to check if referer is really your domain. Of course referer can be spoofed, but a victim of an attacker site will send correct referer.
The trick is in ^
special character. Here is the magic regex:
^https?://(([a-z0-9-]+)\.)*example\.com/
^
- ensures that we are at the start
https?
- protocol - http or https
(([a-z0-9-]+)\.)*
- matches subdomains, also of higher levels, if any
example\.com
- matches main domain
/
- ensures start of path so domain name cannot continue