It is impossible to identify a user or request as unique since duping is trivial.
However, there are a handful of methods that, combined, can hamper cheating attempts and give a user quasi-unique status.
I know of the following:
- IP Address - store the IP address of each visitor in a database of some sort
- Can be faked
- Multiple computers/users can have the same address
- Users with dynamic IP addresses (some ISP issue them)
- Cookie tracking - store a cookie per visitor. Visitors that don't have it are considered "unique"
- Can be faked
- Cookies can be blocked or cleared via browser
Are there more ways to track non-authorized (non-login, non-authentication) website visitors?