 <p>If you have some form of session identifier you can increment a count of times that request has been made. This isn't bullet proof however, clearing out session cookies will allow that request to be made again.</p> <p>You will need some form of login to prevent someone clearing their cookies, or even a cURL script looping.</p> <p>Edit:</p> <p>As a stop-gap measure, you could add a form of CSRF protection, a one-time-use hash would need to be applied to each request to make it valid.</p>