There isn't a foolproof way to stop this completely, the best you can do is to make it somewhat difficult for non-savvy users.
Primary tracking methods:
Cookies - Cookies are the first level of detecting previous visitors. Using a unique cookie (like a nonce) has virtually zero false positives when asserting a user is a previous visitor. Fortunately (or unfortunately in your case) it can be easily evaded by deleting/blocking cookies or using "private browsing" or "incognito" mode.
IP Address - The user's IP address would be the second level of detection used if no matching cookie was received. If the IP matches, it's a decently high level of confidence that it was the previous visitor
Side Note: You could also check if the IP address of the user is a known VPN, Proxy, or Tor exit node, and forbid awards to those if you're really worried about it.
- ETag (web caching) - Servers can use the ETag header on responses for pages that the browser might potentially cache. The ETag contains a unique value for the version of the resource being requested, such as
ETag: 0123456789. The next time the browser requests that resource it will send a
If-None-Match: 0123456789 which either tells the server if it needs to send the latest version of that resource if it doesn't match, otherwise tells the browser to grab it from their cache if it does match. This was originally designed for saving bandwidth, but of course this can also be used for tracking.
If still not able to assert if the user has already received an award with the primary methods, and you're paranoid about people abusing the system, then your next line of detection would be browser/device fingerprinting. This can be decently sophisticated when combining multiple metrics to generate a virtual fingerprint. Examples of such metrics:
- HTTP Headers
- User-Agent (Browser and OS version)
- Accepted MIME types
- HTML5 Canvas and WebGL fingerprinting
- WebRTC fingerprinting
- Enumeration of browser plugins or extensions
- AdBlocker presence
- SSL/TLS protocol and cipher enumeration
- Web Audio API fingerprinting
Web tracking software can factor these metrics together with different weighted scores for each one, to assert the user is a previous visitor with some degree of confidence. Of course if your target audience is tech-savvy people, they can fairly easily avoid tracking.
Curious what your device fingerprint looks like?
These two sites might surprise you with how much information they were able to obtain by using some of these techniques listed above and possibly more: