Rules you mention, based on IP address are not practical - IP adresses change.
Rules based on cookies are not practical if user deletes them and creates
new account in your app.
Also, logging some user action is better done with some SQL database.
User will always try to find some way to circumvent your rules.
Never trust user.