Question

I have a simple session-based PHP hit counter on a website. The problem is that it seems to be adding phantom hits whenever I have the website open for some time (even without me reloading it), so I’m thinking the session timeout is set to a very short amount of time somewhere on the server. However, I have checked php.ini and the timeout is the standard 24 minutes, while phantom hits get added every three minutes or so.

The website has no nameservers pointing to it yet, nothing links to it, so it’s not an issue of robots/crawlers. Here is my code:

            $hit_file = file(__DIR__ . "/hit_file.txt");

            $hit_num = $hit_file[0];
            if(!isset($_SESSION['been']))

                {


                    $hit_num++;

                    $hit_write = fopen(__DIR__ . "/hit_file.txt", 'w');

                    fwrite($hit_write, $hit_num);

                    fclose($hit_write);

                    $_SESSION['been'] = 1;

                }

             echo $hit_num;

UPDATE: I have noticed some weird access.log entries. They all follow this format:
::1 – – [06/Nov/2012:22:05:03 +0100] “GET / HTTP/1.0” 200 3719 “-” “-“

I get one every five minutes or so which is about how often phantom hits get added. What on earth are they?

Answer 1

::1 is localhost IPv6 address. That’s where I’d start looking if I were you. One of the apps is making these requests. Either track it down or just make check $_SERVER['REMOTE_ADDR'] if it’s not ::1.