title: How to block an user from faking requests? Or how to detect fake requests?
body: <p>Let's suppose that you have a website that contains a single button.</p>
  
  <p>When this button is pushed, an ajax request is sent to the server - who receives the request  and adds 1 in an internal counter on its database.</p>
  
  <p>An user could copy the entire request (and its headers) and create a script to send infinite requests to overload the server (and mess with the counter).</p>
  
  <p>I'm trying to avoid:</p>
  
  <ol>
  <li>Recording the user IP</li>
  <li>Using Captcha</li>
  </ol>
  
  <p>I'm using php in my back-end. Is there any way to prevent this situation? Is there some way to send an "invisible" request?</p>