# Limit WPForms Submissions per Visitor

> Allows only a few WPForms submissions per IP address each hour and blocks the rest with a polite message, to stop flooding and repeat spam.

- Type: PHP
- Runs: Run everywhere
- Category: [Forms](https://wpide.com/library/category/forms/)
- Tags: wpforms, spam, rate-limit
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/wpforms-rate-limit-ip/

## Code

```php
$wpide_wpf_max_per_hour = 3;

$wpide_wpf_rate_key = function () {
    $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';

    return 'wpide_wpf_rate_' . md5( wp_salt() . $ip );
};

add_action( 'wpforms_process_before', function ( $entry, $form_data ) use ( $wpide_wpf_max_per_hour, $wpide_wpf_rate_key ) {
    if ( (int) get_transient( $wpide_wpf_rate_key() ) >= $wpide_wpf_max_per_hour ) {
        $process = method_exists( wpforms(), 'obj' ) ? wpforms()->obj( 'process' ) : wpforms()->process;
        $process->errors[ $form_data['id'] ]['header'] = 'You have sent several messages recently. Please try again later.';
    }
}, 10, 2 );

add_action( 'wpforms_process_complete', function () use ( $wpide_wpf_rate_key ) {
    $key = $wpide_wpf_rate_key();
    set_transient( $key, (int) get_transient( $key ) + 1, HOUR_IN_SECONDS );
} );
```

## Notes

IPs are kept only as hashes in short-lived transients; raise the limit for forms used from shared offices or schools.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Limit WPForms Submissions per Visitor" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/