Submission limits
Submission limits let you control how many times a form can be submitted, based on who is submitting it. You can add one or more independent rules to a form; each rule targets a specific audience and carries its own numeric limit.
How rules work
Each rule has exactly one type (audience). When a form is submitted, ACPT evaluates every rule in order:
It checks whether the current visitor matches the rule's audience.
If they do, it counts how many times that audience has already submitted the form.
If the count has reached the configured limit, the submission is blocked and an error is shown. No further processing (email, meta save, custom callback) takes place.
Rules that do not match the current visitor are silently skipped.
Rule types
Anonymous user
Matches visitors who are not logged in. Submissions are tracked by IP address, so each unique IP has its own counter.
Use this to limit how many times a guest can submit the form from the same device/connection.
Logged user
Matches any visitor who is logged in, regardless of their role. Submissions are tracked by WordPress user ID, so the counter is per-account.
Use this as a general cap for all authenticated users.
Specific user
Matches only the logged-in users whose WordPress user IDs appear in the list you configure. Submissions are tracked by user ID.
Use this when you need a per-user limit that applies only to a named set of accounts (e.g. testers, reviewers).
Note: If the visitor is not logged in, this rule never matches — even if you accidentally include user ID
0.
User role
Matches logged-in users whose account has at least one of the WordPress roles you configure. Submissions are tracked by the total form submission count for users in those roles.
Use this to give different quotas to different groups (e.g. subscribers get 3 submissions, editors get unlimited by not adding a rule for them).
Note: If the visitor is not logged in, this rule never matches.
Mutual exclusion
The Anonymous user and Logged user rule types are mutually exclusive at runtime: a visitor is either logged in or they are not, so at most one of those two rules can ever fire on a given request. Adding both to the same form is perfectly valid and lets you set different limits for guests and authenticated users.
The Specific user and User role types are a narrower sub-set of the logged-in audience. A logged-in user can match multiple rules simultaneously (e.g. both a User role rule and the general Logged user rule). Each matching rule is checked independently, and the submission is blocked as soon as any matched rule's limit is exceeded.
What happens when the limit is reached
The form displays a Submission limit reached error message and the submission is not processed. No email is sent, no meta is saved, and no custom callback is triggered.
Submission limits and permissions
Submission limits decide who can submit a form. What a submission can save is also checked against permissions:
a form that edits an existing post, term or user requires the WordPress permission to edit it;
a form that writes a custom content type record requires the table's create (new record) or update (existing record) permission, otherwise the submission is rejected;
a meta field or table column the visitor is not allowed to edit is not saved, while the rest of the form is.
Developers can add their own rules with the acpt/form/authorize_submission and acpt/form/authorize_field filters.
Example combinations
Guests: max 1 submit ever; logged-in users: max 5
Anonymous user → 1 + Logged user → 5
No limit for guests; subscribers capped at 3
User role (subscriber) → 3
Specific beta testers limited to 10 submissions each
Specific user [uid list] → 10
Completely block guests, allow any logged-in user up to 2
Anonymous user → 0 + Logged user → 2
Last updated