> For the complete documentation index, see [llms.txt](https://docs.acpt.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.acpt.io/forms/manage-forms/submission-limits.md).

# Submission limits

Submission limits let you control how many times a form can be submitted, based on who is submitting it. You can add one or more independent rules to a form; each rule targets a specific audience and carries its own numeric limit.

***

## How rules work

Each rule has exactly **one type** (audience). When a form is submitted, ACPT evaluates every rule in order:

1. It checks whether the current visitor **matches** the rule's audience.
2. If they do, it counts how many times that audience has already submitted the form.
3. If the count has reached the configured limit, the submission is **blocked** and an error is shown. No further processing (email, meta save, custom callback) takes place.

Rules that do not match the current visitor are silently skipped.

***

## Rule types

### Anonymous user

Matches visitors who are **not logged in**. Submissions are tracked by **IP address**, so each unique IP has its own counter.

Use this to limit how many times a guest can submit the form from the same device/connection.

### Logged user

Matches any visitor who **is logged in**, regardless of their role. Submissions are tracked by **WordPress user ID**, so the counter is per-account.

Use this as a general cap for all authenticated users.

### Specific user

Matches only the logged-in users whose **WordPress user IDs** appear in the list you configure. Submissions are tracked by user ID.

Use this when you need a per-user limit that applies only to a named set of accounts (e.g. testers, reviewers).

> **Note:** If the visitor is not logged in, this rule never matches — even if you accidentally include user ID `0`.

### User role

Matches logged-in users whose account has **at least one** of the WordPress roles you configure. Submissions are tracked by the total form submission count for users in those roles.

Use this to give different quotas to different groups (e.g. subscribers get 3 submissions, editors get unlimited by not adding a rule for them).

> **Note:** If the visitor is not logged in, this rule never matches.

***

## Mutual exclusion

The **Anonymous user** and **Logged user** rule types are mutually exclusive at runtime: a visitor is either logged in or they are not, so at most one of those two rules can ever fire on a given request. Adding both to the same form is perfectly valid and lets you set different limits for guests and authenticated users.

The **Specific user** and **User role** types are a narrower sub-set of the logged-in audience. A logged-in user can match multiple rules simultaneously (e.g. both a `User role` rule and the general `Logged user` rule). Each matching rule is checked independently, and the submission is blocked as soon as **any** matched rule's limit is exceeded.

***

## What happens when the limit is reached

The form displays a `Submission limit reached` error message and the submission is not processed. No email is sent, no meta is saved, and no custom callback is triggered.

***

## Submission limits and permissions

Submission limits decide **who can submit** a form. What a submission can **save** is also checked against permissions:

* a form that edits an existing post, term or user requires the WordPress permission to edit it;
* a form that writes a [custom content type](/permissions-manager/custom-content-types.md) record requires the table's create (new record) or update (existing record) permission, otherwise the submission is rejected;
* a [meta field](/permissions-manager/meta-fields-permissions.md) or table column the visitor is not allowed to edit is not saved, while the rest of the form is.

Developers can add their own rules with the [`acpt/form/authorize_submission`](/developers/actions/acpt-form-authorize_submission.md) and [`acpt/form/authorize_field`](/developers/actions/acpt-form-authorize_field.md) filters.

***

## Example combinations

| Goal                                                      | Rules to add                             |
| --------------------------------------------------------- | ---------------------------------------- |
| Guests: max 1 submit ever; logged-in users: max 5         | `Anonymous user → 1` + `Logged user → 5` |
| No limit for guests; subscribers capped at 3              | `User role (subscriber) → 3`             |
| Specific beta testers limited to 10 submissions each      | `Specific user [uid list] → 10`          |
| Completely block guests, allow any logged-in user up to 2 | `Anonymous user → 0` + `Logged user → 2` |