# Limit How Many Files Non-Administrators Can Upload per Hour

> Caps uploads at 30 files per hour for each user who is not an administrator, which limits the damage a compromised author account or a buggy front-end upload form can do.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: uploads, rate-limit, users
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-upload-rate-limit/

## Code

```php
// Uploads allowed per user per hour.
$wpide_upload_hourly = 30;

add_filter( 'wp_handle_upload_prefilter', function ( $file ) use ( $wpide_upload_hourly ) {
    if ( ! empty( $file['error'] ) || ! is_user_logged_in() || current_user_can( 'manage_options' ) ) {
        return $file;
    }

    $key   = 'wpide_uploads_' . get_current_user_id();
    $count = (int) get_transient( $key );

    if ( $count >= $wpide_upload_hourly ) {
        $file['error'] = sprintf( 'You have reached the limit of %d uploads per hour. Please try again later.', $wpide_upload_hourly );
        return $file;
    }

    set_transient( $key, $count + 1, HOUR_IN_SECONDS );

    return $file;
}, 20 );
```

## Notes

Raise $wpide_upload_hourly for teams that upload large batches of photos.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Limit How Many Files Non-Administrators Can Upload per Hour" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/