how to restrict website more than 3 times visit?

Not reliably, no. You could store a visit count in a cookie but they could delete\amend the cookie. You could hook it off their IP address but that might affect people using proxy servers. The only reliable way would be if you supported some kind of authentication, and you'd log the access against the user. The next problem is what you do define as a "visit"? You would have to say that a set time between requests constitutes a new visit.