Question

I had to write a page hit counter for our site. (customers only)
I know my counter is being abused by some customers, and they wrote an application that hit the page several time during the day.

Is it possible to affect the hit counter by requesting the page using .Net WebClient for example??
I’m trying to figure there method and how to counter fight it.

Thank you

Answer 1

Is it possible to affect the hit counter by requesting the page using .Net WebClient for example?

Absolutely. If the customer puts enough work into getting cookies, user-agent strings, and secondary requests (e.g. requesting the JavaScript and CSS resources referenced by the page) right, it is impossible for the server to tell whether a request came from .NET’s WebClient or from a real web browser.

But there’s another problem: the customers don’t even need to put a lot of effort into writing programs that automatically load your site and take some actions. With tools like Selenium, they can write scripts that actually load a web browser and then take the same actions that a real live user might take. So even if you modify your hit counter to include some mythical super-sophisticated check for requests from a real web browser, you’ll still be thwarted by users who fire up a real web browser to make automated requests to your site.

I’m trying to figure there method and how to counter fight it.

Without the code for this hit counter, I can’t suggest too many improvements that would limit the customers’ ability to increase the hit counter by writing programs. You could use a CAPTCHA, but that’s an awfully big inconvenience for the honest customers.

You say that you know that some customers are abusing the site. Presumably, you know who these customers are, and there are some generally useful techniques for making dishonesty not pay. You could kick those customers off the site since they’re being dishonest. In a somewhat less drastic measure, you could include a blacklist of customer usernames that your hit counter ignores, and then those customers’ programs won’t actually affect the hit counter. In an even gentler measure that will be almost invisible to those customers, you could make page loads slower for those customers, which would limit the effects of their nefarious behavior.