What a rotating salt actually protects

If you are not storing a cookie, you still need some way of telling one visitor from another for the length of a visit. The usual approach is to build a short identifier out of things the request already carries, then throw the ingredients away.

The identifier is only as durable as the secret mixed into it. Replace that secret every day and destroy the old one, and yesterday’s identifiers stop matching today’s. The same person visiting on Monday and Thursday is two rows, not one.

That sounds like a loss, and on paper it is. In practice it removes a whole category of question from the table. Nobody can ask which pages a particular visitor read last month, because the key that would have joined those rows together no longer exists anywhere.

It also means the daily unique visitor figure is genuinely a daily figure. Adding up a week of them gives you something larger than the number of people involved, and any tool that lets you do that without saying so is not being straight with you.