# Limit Password Reset Requests

> Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, passwords, rate-limit
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/limit-password-reset-requests/

## Code

```php
// Requests allowed per IP address per hour.
$wpide_reset_limit = 3;

add_action( 'lostpassword_post', function ( $errors ) use ( $wpide_reset_limit ) {
    $ip  = isset( $_SERVER['REMOTE_ADDR'] ) ? (string) $_SERVER['REMOTE_ADDR'] : 'unknown';
    $key = 'wpide_reset_' . md5( $ip );
    $hits = (int) get_transient( $key );

    if ( $hits >= $wpide_reset_limit ) {
        $errors->add( 'wpide_reset_limit', '<strong>Error:</strong> Too many password reset requests. Please try again in an hour.' );
        return;
    }

    set_transient( $key, $hits + 1, HOUR_IN_SECONDS );
} );
```

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Limit Password Reset Requests" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/