Drupal is a registered trademark of Dries Buytaert
cms 2.1.3 — Update released for Drupal core (2.1.3)! drupal 10.5.11 — Update released for Drupal core (10.5.11)! drupal 11.3.11 — Update released for Drupal core (11.3.11)! drupal 11.2.13 — Update released for Drupal core (11.2.13)! drupal 10.6.10 — Update released for Drupal core (10.6.10)! cms 2.1.2 — Update released for Drupal core (2.1.2)! drupal 11.1.10 — Update released for Drupal core (11.1.10)! drupal 10.5.10 — Update released for Drupal core (10.5.10)! drupal 10.4.10 — Update released for Drupal core (10.4.10)! drupal 11.2.12 — Update released for Drupal core (11.2.12)! drupal 11.3.10 — Update released for Drupal core (11.3.10)! drupal 10.6.9 — Update released for Drupal core (10.6.9)! drupal 10.6.8 — Update released for Drupal core (10.6.8)! drupal 11.3.9 — Update released for Drupal core (11.3.9)! drupal 11.3.8 — Update released for Drupal core (11.3.8)! drupal 11.3.7 — Update released for Drupal core (11.3.7)! drupal 11.2.11 — Update released for Drupal core (11.2.11)! drupal 10.6.7 — Update released for Drupal core (10.6.7)! drupal 10.5.9 — Update released for Drupal core (10.5.9)! cms 2.1.1 — Update released for Drupal core (2.1.1)!
← All modules

user_restrictions

1,117 sites Security covered
View on drupal.org

This module blocks users from registering or logging in basing on the entered username or email, or on the IP address used to connect, making it useful for fighting spam accounts.

This module is a drop-in replacement (with some enhancements) for the access rules functionality which was removed from Drupal 7.

The Drupal 8 version implements plugins to allow custom user restrictions to be created above and beyond the name, email, and IP plugins included.

Alternatives

  • If the intention is only allowing or restricting account registration basing on the domain used by email addresses, there is the Restrict Domain Registration module
  • To validate email addresses using advanced, configurable rules, there is the Advanced Email Validation module, which also allows to verify the domain used by email addressed exists and has MX records configured
  • The Disposable Email Address Blocker module protects Drupal form email fields by disallowing email addresses from a custom blacklist of disposable email address domains

Activity

Total releases
6
First release
Sep 2025
Latest release
1 week ago
Release cadence
51 days
Stability
17% stable

Release Timeline

Releases

Version Type Release date
2.1.1-beta2 Pre-release May 21, 2026
4.0.x-dev Dev May 21, 2026
2.1.1-beta1 Pre-release May 19, 2026
2.1.x-dev Dev Oct 12, 2025
3.0.x-dev Dev Sep 18, 2025
2.1.0 Stable Sep 9, 2025