Prevent duplicate votes and spam
How PHPPoll stops repeated and fake votes: cookie and IP limits, repeat voting after N hours, math captcha, honeypot and bot filter. IP addresses are never stored.
A poll is only useful when the votes are honest. PHPPoll combines several simple protections that work without any external service. Configure them per poll in Voting rules. See Voting rules.
Limit repeated votes
| Option | How it works |
|---|---|
| Cookie and IP address (strict) | The default. A visitor is blocked if the browser cookie or the IP address already voted. |
| Cookie only | Blocks the same browser. People on a shared network (offices, schools) can each vote once. |
| IP address only | Blocks the same connection, even if the cookie is deleted. |
| Do not limit | Unlimited votes. Useful for testing or lively events. |
Allow voting again after some time
Set Allow voting again after (hours) to let people vote again later, for example 24 for a daily poll. 0 means every visitor can vote only once.
Math captcha
Switch on Require a security question to show a question like "What is 3 + 4?". It stops simple bots and needs no images or accounts. The answer is checked on the server with a signed token, so it also works when the poll is embedded in an iframe.
Invisible protection (always on)
- Honeypot field: a hidden field that real visitors never fill in. Bots that do are silently ignored.
- Minimum fill-in time: forms submitted in under two seconds are rejected, and forms older than two days expire.
- Bot detection: requests from crawlers and scripts such as curl or Python are refused.
- Server-side validation: every answer is checked against the poll definition, so manipulated forms cannot add invalid votes.
Privacy: IP addresses are not stored
To check the IP address PHPPoll saves only a short, irreversible hash, never the address itself. This keeps the duplicate check working while respecting the privacy of your visitors. See Security and privacy.
Cap the total number of votes
Set Maximum number of votes and the poll closes automatically when the limit is reached.
If your site is behind a proxy or CDN such as Cloudflare, enable PP_TRUST_PROXY in config.php. Otherwise all visitors may appear to share one IP address and be blocked after the first vote. See Troubleshooting.
When you test your own poll, switch the limit to Do not limit temporarily, or you will see "You have already voted".
Last updated