Recognising a returning visitor in PHP: sessions, not fingerprints
The reliable way to recognise a visitor is a session cookie; “fingerprinting” is fragile and invasive.
From the archive: first published on mohamedsharaf.net in July 2012. Rewritten and checked in 2026; some details may be out of date.
A question I kept seeing: how do you build a unique “fingerprint” of a visitor? The honest answer is that the simplest tool is also the best one: PHP sessions.
session_start();
if (empty($_SESSION['visitor_id'])) {
$_SESSION['visitor_id'] = bin2hex(random_bytes(16));
}PHP gives each browser a random session ID in a cookie, and you store what you need against it. Set the cookie as Secure, HttpOnly and SameSite=Lax (in php.ini or with session_set_cookie_params()).
Why not fingerprint?
Combining IP address, user agent, screen size and so on looks clever but works badly: many people share one IP, one person changes IPs all day, and browsers deliberately make themselves look alike. It identifies a browser at best, never a person. And in many countries, tracking people without consent is a legal problem. Use a session for convenience, and a proper login for anything that matters.