Limit WPForms Submissions per Visitor
Allows only a few WPForms submissions per IP address each hour and blocks the rest with a polite message, to stop flooding and repeat spam.
Opens WPIDE on
Code
$wpide_wpf_max_per_hour = 3;
$wpide_wpf_rate_key = function () {
$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
return 'wpide_wpf_rate_' . md5( wp_salt() . $ip );
};
add_action( 'wpforms_process_before', function ( $entry, $form_data ) use ( $wpide_wpf_max_per_hour, $wpide_wpf_rate_key ) {
if ( (int) get_transient( $wpide_wpf_rate_key() ) >= $wpide_wpf_max_per_hour ) {
$process = method_exists( wpforms(), 'obj' ) ? wpforms()->obj( 'process' ) : wpforms()->process;
$process->errors[ $form_data['id'] ]['header'] = 'You have sent several messages recently. Please try again later.';
}
}, 10, 2 );
add_action( 'wpforms_process_complete', function () use ( $wpide_wpf_rate_key ) {
$key = $wpide_wpf_rate_key();
set_transient( $key, (int) get_transient( $key ) + 1, HOUR_IN_SECONDS );
} );Notes
IPs are kept only as hashes in short-lived transients; raise the limit for forms used from shared offices or schools.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.