In my site anonymous users has access to create one type of content and all data the site stores is user IP address.

How do I limit lets say e.g. 2 nodes creations per IP in 12 hours? And when limit is reached, they get some message instead of creating another node until 12 hour range pass?

Because now some of anonymous users are just abusing and spamming the node creation which is unlimited by default.

UPDATE: I tried using Node Limit, but it doesn't really work. When I load a page with the form which has the limit set, it doesn't load the page and that's a home-page of the site and form is displayed as Form Block via Panels. So instead of a home-page I get redirected to node/add/ and page not found.

enter image description here

2 Answers 2


You could do it custom with hook_node_access and the Flood API.


 * Implements hook_node_access
function MY_MODULE_node_access($node, $op, $account) {

    // Get node type, can be string or node object
    $type = is_string($node) ? $node : $node->type;
    if ($type == 'type_of_interest') {
      // Check flood limit for anon users node creation
      if ($op == 'create' && user_is_anonymous()) {
        // Ensure checked only once per page request, node/add path only
        $access_checked = &drupal_static(__FUNCTION__);
        if(empty($access_checked) && arg(0) == 'node' && arg(1) == 'add') {
          // Record the access check for drupal_static
          $access_checked = TRUE;
          // Check create_node limit of 2 per 12 hours
          // Note, you could make the threshold and window config variables.
          if(!flood_is_allowed('create_node', 2, 43200)){
            drupal_set_message(t('There is a node creation limit of 2 nodes per 12 hours. Please try again later.'), 'error');
            return NODE_ACCESS_DENY;
            // Register the node create event to test against for 48 hours
            // Note, you could move this somewhere else to ensure the node is actually saved, e.g hook_node_insert
            flood_register_event('create_node', 172800);


  • This. A thousand times this.
    – Clive
    Aug 13, 2014 at 9:17
  • Thanks I will try this, but I do not understand that 48 hours part. Aug 13, 2014 at 17:18
  • So on first try for a new unique never used IP it creates a node, but also prints the drupal_set_message. Also it hides the form, so no chance to create 2nd node within 12 hours. So looks like it almost work, since I'm no PHP guru, I got no idea what needs changing in the code. Aug 13, 2014 at 18:13
  • @OptimusPrime it looks like you may have something else calling node_access as well on your install so it's called twice. The solution would be to add some code to ensure it's only checked once per page load (see updated answer) or alternatively, you may need to check the menu path to ensure it's run once on the target path only. Aug 13, 2014 at 21:39
  • I think this code blocks entirely all anonymous for 2 nodes per 12 hours, in original question I meant 2 nodes per IP. I exceeded limit with one IP now, and with another I get the limit message. Aug 14, 2014 at 7:39

You can use the Node Limit module

The Node Limit module allows administrators to restrict the number of nodes of a specific type that roles or users may create.

  • Per-role node limits
  • Per-user node limits
  • Hmm, will that really work with anonymous users and per IP? Aug 13, 2014 at 7:29
  • Sure it will work for any user role, I have not checked for IP!
    – Inizio
    Aug 13, 2014 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.