Question: Can anyone point me in the way of a guide/tutorial on how to limit the number of unique IP's a user can have to around 5-6 for a members area. It seems like many users on a site i help manage share their user names with tens to hundreds of other people. Or can anyone explain how i can implement some kind of security against this?

Answer: 
IP blocking isn't the way to go.

Consider a bunch of users inside the same corporate firewall. When they browse the net ALL of them will appear to have the same IP address due to a proxy server. The proxy server is responsible for making sure the requests/responses get to the right people.

So, that won't work.

What you can do is tie logins to sessions and kick out the previous ones. Essentially:

1. Login request comes in.
2. Server assigns a session id to that request, stores it locally in that user table and sends it back in a cookie.
3. On each subsequent request the session id is validated to see if it is still associated with the user. If not, kick them out to the login page.

What will happen is that user Bob will login and get session ID 10. Bob starts browsing your site and everything is A-OK.

Then Sue logs in (with Bob's credentials). This assigns session ID 22 to the bob account. She starts browsing the site.

The very next request that Bob issues get's revalidated .. and the server sees that session 10 is no longer associated with Bob. Boom: kicked to the login screen.

Bob logs back in while scratching his head. This assigns a new ID: 30. The next request from Sue kicks *her* to the login page. Hilarity ensues.

Just for kicks, if a few session ids are assigned to the same account within a certain period of time (like 2 minutes) send a message to the email address on file that their account might have been hacked. Potentially even shut off the account while asking them to reconfirm, via clicking a link in the email, that the account is good. Make them change the password right then.

Two things are going to happen. First, a number of users will complain (some people have no shame).. be sure to have a nice, but firm, response about how you are protecting *them* with this fancy new security feature. Don't budge on it.

The second thing is that all of those anonymous users will get their own accounts (or go away). The reason is that being kicked out of the site just because *they* shared the password is not a good thing. Which, if I'm understanding correctly, is the desired behavior.

---

Interestingly, this is a similar design to how some companies, like GoToMeeting work. If a user account is currently hosting a meeting AND then that account logs in somewhere else then the original meeting is terminated. Pretty effective.
What I would do is create a database table that stores the userId, IP address used and date that IP was seen. Something like this:

```
Table IP

Id    UserId    IP       Date
-------------------------------
0    42       192.168.1.3   2-21-12:01:32:00

```

Then in your php count how many IPs the user in question has for the current day. If more than 5, block the user.

Though, reading some of the answers just posted I would go with Chris Lively's response as it is a better solution.