I am trying to write a module in which I have to send a mail if the user enters wrong password three times. In the mail he should have a link to reset his password. What should I write in validation function for failed attempts? Please guide me.

I got one suggestion you could also just set the variable 'user_failed_login_user_limit' to 3, and add an extra validation function to login which triggers an email when flood control triggers.Please guide me how to do this.

 *Implement hook_form_alter()

 function login_form_alter(&$form, &$form_state, $form_id) {
  switch ($form_id) {
    case 'user_login':
    case 'user_login_block':
      $user_login_final_validate_index = array_search('user_login_final_validate', $form['#validate']);
      if ($user_login_final_validate_index >= 0) {
        $form['#validate'][$user_login_final_validate_index] = 'login_final_validate';

 function login_final_validate($form, &$form_state) {
  if($form_state['values']['pass'] != 'abc') {
        form_set_error('pass',t('Sorry, there have being three failed login 
        attempts for this account.A link has being sent to reset pass.'));
  • I think I need to use User Entity to track the attempt not sure. Mar 22, 2016 at 14:32

1 Answer 1


The User module uses 4 persistent variables to limit the number of attempted logins a user can do: user_failed_login_ip_limit (default to 50), user_failed_login_ip_window (3600), user_failed_login_user_limit (5), and user_failed_login_user_window (21600).
The first two are used before to check if the account with those credentials exists; the last two are used after loading the user account matching the credentials passed in the login form. The first two values set a limit of 50 failed attempts per hour for the same IP; the last two values allow 5 failed attempts every 6 hours.

Considering that the first limit is reasonably high limit to handle the case of only one apparent IP for all users at an institution, you could set user_failed_login_user_limit to 3 and user_failed_login_user_window to 3600 (1 hour). If that is the only change you need, there isn't any need to replace the validation handler for the login form: Just set the value of those persistent variables in hook_install(), and eventually check their values in a hook that Drupal executes less or more periodically.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.