In fact, to fix that (the possibility to obtain APs after the click on the script and without send the vote), you mustn't give the APs directly on the scripts.
When the player voted, he's redirected to the ranking website without obtain any points.
After, the player must click on your server link from the ranking website and he's now anew on your website.
From there, you need to code an other verification using php HTTP_REFERER.
If HTTP_REFERER return the ranking website URL and the time limit is exceeded , it's ok, the player has voted so you can give him his points.
Of course, it's just a simplified scheme, you must adjust that.
However, I don't think it's possible to having a voting script 100% unexploitable but this method is more difficult to exploit than others.
nota : you should also have a member's area, the player's must be logged to detect his UserID when he's return on your website.