Limit Password Reset Requests
Allows only a few password reset requests per hour from the same IP address, which stops reset-email flooding.
Opens WPIDE on
Code
// Requests allowed per IP address per hour.
$wpide_reset_limit = 3;
add_action( 'lostpassword_post', function ( $errors ) use ( $wpide_reset_limit ) {
$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? (string) $_SERVER['REMOTE_ADDR'] : 'unknown';
$key = 'wpide_reset_' . md5( $ip );
$hits = (int) get_transient( $key );
if ( $hits >= $wpide_reset_limit ) {
$errors->add( 'wpide_reset_limit', '<strong>Error:</strong> Too many password reset requests. Please try again in an hour.' );
return;
}
set_transient( $key, $hits + 1, HOUR_IN_SECONDS );
} );How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.