The suggestions to use cookies aside, the only comprehensive set of identifying attributes available to interrogate are contained in the HTTP request header. So it is possible to use some subset of these to create a pseudo-unique identifier for a user agent (i.e., browser). Further, most of this information is possibly already being logged in the so-called "access log" of your web server software by default and, if not, can be easily configured to do so. Then, a utlity could be developed that simply scans the content of this log, creating fingerprints of each request comprised of, say, the IP address and User Agent string, etc. The more data available, even including the contents of specific cookies, adds to the quality of the uniqueness of this fingerprint. Though, as many others have stated already, the HTTP protocol doesn't make this 100% foolproof - at best it can only be a fairly good indicator.

cookie和非cookie方法都有缺陷。但是如果你能原谅cookie方法的缺点，这里有一个想法。

如果你已经在你的网站上使用谷歌Analytics，那么你不需要自己编写代码来跟踪独特的用户。谷歌分析为您通过__utma cookie值，如谷歌的文档中所述。通过重用这个值，您不会创建额外的cookie有效负载，这对于页面请求具有效率优势。

您可以很容易地编写一些代码来访问该值，或者使用脚本的getUniqueId()函数。

这些人开发了一种指纹识别方法，可以非常准确地识别用户:

https://panopticlick.eff.org/static/browser-uniqueness.pdf

We investigate the degree to which modern web browsers are subject to “device fingerprinting” via the version and configuration information that they will transmit to websites upon request. We implemented one possible fingerprinting algorithm, and collected these fingerprints from a large sample of browsers that visited our test side, panopticlick.eff.org. We observe that the distribution of our finger- print contains at least 18.1 bits of entropy, meaning that if we pick a browser at random, at best we expect that only one in 286,777 other browsers will share its fingerprint. Among browsers that support Flash or Java, the situation is worse, with the average browser carrying at least 18.8 bits of identifying information. 94.2% of browsers with Flash or Java were unique in our sample.

通过观察回访用户，我们估计浏览器指纹随时间变化的速度。在我们的样本中，指纹变化很大 很快，但即使是一个简单的启发式通常也能猜出指纹是先前观察到的浏览器的“升级”版本 指纹，99.1%的猜测正确率和假阳性率只有 0.86%。

We discuss what privacy threat browser fingerprinting poses in practice, and what countermeasures may be appropriate to prevent it. There is a tradeoff between protection against fingerprintability and certain kinds of debuggability, which in current browsers is weighted heavily against privacy. Paradoxically, anti-fingerprinting privacy technologies can be self- defeating if they are not used by a sufficient number of people; we show that some privacy measures currently fall victim to this paradox, but others do not.

一个技巧:

Create 2 Registration Pages: First Registration Page: without any email or security check (just with username and password) Second Registration Page: with high security level (email verification request and security image and etc.) For customer satisfaction, and easy registration, default registration page should be the (First Registration Page) but in the (First Registration Page) there is a hidden restriction. It's IP Restriction. If an IP tried to register for second time, (for example less than 1 hour) instead of showing the block page. you can show the (Second Registration Page) automatically. in the (First Registration Page) you can set (for example: block 2 attempts from 1 ip for just 1 hour or 24 hours) and after (for example) 1 hour, you can open access from that ip automatically

请注意:(第一注册页)和(第二注册页)不应在分开的页面。你只写了一页。(例如:register.php)，并在第一PHP样式和第二PHP样式之间切换

一种可能是使用flash cookie:

无处不在的可用性(95%的访问者可能会使用flash) 每个cookie可以存储更多数据(最多100 KB) 跨浏览器共享，因此更有可能唯一标识一台机器 清除浏览器cookie不会删除flash cookie。

你需要构建一个小的(隐藏的)flash电影来读写它们。

无论你选择哪种方式，确保你的用户选择被跟踪，否则你就侵犯了他们的隐私，成为坏人之一。

你可能想尝试在evercookie中设置一个唯一的ID(它可以跨浏览器工作，见他们的常见问题): http://samy.pl/evercookie/

还有一家叫做ThreatMetrix的公司，被很多大公司用来解决这个问题: http://threatmetrix.com/our-solutions/solutions-by-product/trustdefender-id/ 它们相当昂贵，而且他们的其他一些产品也不太好，但他们的设备id运行良好。

最后，还有这个开源jquery实现的panopticlick的想法: https://github.com/carlo/jquery-browser-fingerprint 它现在看起来很不成熟，但可以扩展。

希望能有所帮助!