EventMann

There are two settings here that look almost identical in the interface and do very different jobs. Choosing the wrong one is not a small mistake: for a scarce, in-demand event it is the difference between a working limit and no limit at all.

Maximum per order

This caps a single basket. Set it to 4 and nobody can put 5 tickets in one order.

It is the right tool for keeping group bookings sensible — stopping somebody accidentally buying 40 tickets, keeping a table booking to a table — and it is what most platforms give you. It is also the only one many platforms give you, which is the source of the problem.

Maximum per person

This caps somebody across every order they place. Set it to 2 and the same buyer cannot end up holding 3, no matter how many separate orders they make.

Without it, a per-order maximum is a speed bump rather than a barrier. The buyer places the maximum order, then places it again, and again, until the allocation is gone. For an event where demand exceeds supply this is not a hypothetical vulnerability — it is the standard technique, it is well known, and it is trivially automated.

Which one you want

The question to ask is what you are actually worried about.

Worried about basket size? (Mis-clicks, unmanageable group bookings, a table that seats six.) Use the per-order maximum.
Worried about fairness? (One or two each, real people getting in, resellers not clearing your allocation.) You need the per-person limit. It is the only one that survives somebody simply ordering twice.
Both? Set both. They are independent and they compose sensibly: per-order 4, per-person 4 means one order of four, or two orders of two.

A rule of thumb: if your event sells out, you want the per-person limit. If it does not, the per-order limit is probably all you need and the per-person limit will mostly generate support questions from families.

What the limit counts against

The per-person limit follows the buyer's account rather than the browser session, so opening a private window, clearing cookies or switching devices does not reset it. That is what makes it meaningfully different from a per-order cap.

It is worth being honest about the boundary of any such control: it is tied to an identity, and identities can be created. Somebody sufficiently determined can register another account with another email address. What the limit does is raise the cost of doing so from "click buy again" to "create and manage a second identity per ticket", which is enough to stop casual over-buying and most automated attempts. Combined with a total allocation and a sensible on-sale, it is the practical control available short of requiring identity documents, which is not a trade most events want to make.

When somebody hits the limit, they are told what the limit is. That is a more useful message than a generic refusal — the common case is a parent buying for a family, not somebody gaming you, and they need to know whether to buy fewer or ask you.

Enforced where it matters

Both limits are enforced when the order is submitted, not only in the page that displays them.

This distinction is the whole of the security story. A quantity dropdown that stops at 4 is a user-interface convenience; anyone can send a request that says 40. The check that counts is the one on the server, behind the form, which runs on every order regardless of what the browser sent. If a limit is only in the interface, it is not a limit — it is a suggestion, and the people you are trying to stop are exactly the ones who will not take it.

Practical advice for a high-demand on-sale

Set the per-person limit before the on-sale, not during. Tightening it afterwards does not claw back tickets already sold.
Say what the limit is on the event page. People plan around it, and finding out at checkout that they cannot buy for the whole group is a bad moment.
Two is usually the right number for a genuinely scarce event — most people are attending with somebody, and a limit of one is unpopular out of proportion to what it gains you.
Pair it with a waitlist. The people who hit your limit are exactly the demand you want to capture.

Limiting how many tickets one person can buy