Drupal blocks the IP used to access the site, when a user tries to log in many times.

How can I disable this functionality?

3 Answers 3


What you can do is adding the following code in the settings.php file.

$conf['user_failed_login_ip_limit'] = PHP_INT_MAX;

In this way, the IP will not blocked.

user_login_authenticate_validate() contains the following code.

  if (!empty($form_state['values']['name']) && !empty($password)) {
    // Do not allow any login from the current user's IP if the limit has been
    // reached. Default is 50 failed attempts allowed in one hour. This is
    // independent of the per-user limit to catch attempts from one IP to log
    // in to many different user accounts.  We have a reasonably high limit
    // since there may be only one apparent IP for all users at an institution.
    if (!flood_is_allowed('failed_login_attempt_ip', variable_get('user_failed_login_ip_limit', 50), variable_get('user_failed_login_ip_window', 3600))) {
      $form_state['flood_control_triggered'] = 'ip';
    $account = db_query("SELECT * FROM {users} WHERE name = :name AND status = 1", array(':name' => $form_state['values']['name']))->fetchObject();
    if ($account) {
      if (variable_get('user_failed_login_identifier_uid_only', FALSE)) {
        // Register flood events based on the uid only, so they apply for any
        // IP address. This is the most secure option.
        $identifier = $account->uid;
      else {
        // The default identifier is a combination of uid and IP address. This
        // is less secure but more resistant to denial-of-service attacks that
        // could lock out all users with public user names.
        $identifier = $account->uid . '-' . ip_address();
      $form_state['flood_control_user_identifier'] = $identifier;

      // Don't allow login if the limit for this user has been reached.
      // Default is to allow 5 failed attempts every 6 hours.
      if (!flood_is_allowed('failed_login_attempt_user', variable_get('user_failed_login_user_limit', 5), variable_get('user_failed_login_user_window', 21600), $identifier)) {
        $form_state['flood_control_triggered'] = 'user';
    // We are not limited by flood control, so try to authenticate.
    // Set $form_state['uid'] as a flag for user_login_final_validate().
    $form_state['uid'] = user_authenticate($form_state['values']['name'], $password);

The limits are actually two: one for the case Drupal always has an IP, and one for when Drupal has also a user ID. The latter is for the case the user enters a username for an existing account; in that case, Drupal register the user ID, and the IP.
If you want to avoid also that case, then you need to add also this line to the setting.php file.

$conf['user_failed_login_user_limit'] = PHP_INT_MAX;
$conf['user_failed_login_user_window'] = 5;
  • Hi Kiamlaluno, so it means i ONLY NEED to add these 2 lines in the settings.php? Is PHP_INT_MAX the infinite limit? Can i also set that infinite limit (PHP_INT_MAX) to user_failed_login_user_window also? Because it is set as 5 there. Nov 16, 2012 at 3:35
  • PHP_INT_MAX is the maximum value PHP can assign to an integer. I set the other value to 5 because that is the number of seconds for which the limit is valid. If you set user_failed_login_user_limit to 10, and user_failed_login_user_window to 5, it means 10 login attempts are allowed in 5 seconds. Just change the settings.php file, and the IPs/users are not blocked anymore.
    – apaderno
    Nov 16, 2012 at 3:39
  • Sorry for my understandability but i'm still not so cleared yet. I searched and found that [PHP_INT_MAX] is 2 Billions. Ok then, does it means we will allow upto 2 Billions attempts between 5 Sec now? Is it already ready for both of IP & Username also? Nov 16, 2012 at 3:50
  • My final concern is to TOTALLY DISABLE the IP and/or USERNAME attempt Blocking. [NO LIMITATIONS anymore to set] Are these only 2 lines solve it already? Nov 16, 2012 at 3:55
  • For a 64-bit machine, PHP_INT_MAX is 9223372036854775807; for a 32-bit machine its value is 2147483647. You are correct; that is the number of attempts in 5 seconds. If the number of attempts are lower than that, the IP/user is not blocked.
    – apaderno
    Nov 16, 2012 at 4:00

In Drupal 8, you can change the flood settings in the config file user.flood.yml.

uid_only: false
ip_limit: 50
ip_window: 3600
user_limit: 5
user_window: 21600
  default_config_hash: UYfMzeP1S8jKaaaavxf7nQNe8DsNS-3bc2WSNNXBQWs

This means that per IP and per user, there is a limit:

  • Per 3600 seconds (1 hour), 50 attempts per IP address are allowed
  • Per 21600 seconds (6 hours), 5 attempts per user account are allowed (quite few)

You might change and import the settings (i set it to 100 attempts per 5 minutes):

uid_only: false
ip_limit: 100
ip_window: 300
user_limit: 100
user_window: 300
  default_config_hash: UYfMzeP1S8jKaaaavxf7nQNe8DsNS-3bc2WSNNXBQWs
  • Is there any way to do this in settings.php, or similar, instead of modifying core/modules/user/config/install/user.flood.yml? Feb 27, 2020 at 18:02
  • @dhruveonmars you can override every setting in your settings.php. It would be something like $config['user.flood']['user_limit'] = 100; Feb 28, 2020 at 11:16
  • 1
    Brilliant! Thanks so much!! Mar 1, 2020 at 0:03

The Flood Control module will handle this elegantly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.