diff --git a/common/locales/en/messages.json b/common/locales/en/messages.json
index d597b5b5a1..d812cf28c5 100644
--- a/common/locales/en/messages.json
+++ b/common/locales/en/messages.json
@@ -30,6 +30,7 @@
 
   "messageAlreadyPurchasedGear": "You purchased this gear in the past, but do not currently own it. You can buy it again in the rewards column on the tasks page.",
   "messageAlreadyOwnGear": "You already own this item. Equip it by going to the equipment page.",
+  "messageHealthAlreadyMax": "You already have maximum health.",
 
   "armoireEquipment": "<%= image %> You found a piece of rare Equipment in the Armoire: <%= dropText %>! Awesome!",
   "armoireFood": "<%= image %> You rummage in the Armoire and find <%= dropArticle %><%= dropText %>. What's that doing in here?",
diff --git a/common/script/ops/buyHealthPotion.js b/common/script/ops/buyHealthPotion.js
index ab2d0101e4..b7a2e21db7 100644
--- a/common/script/ops/buyHealthPotion.js
+++ b/common/script/ops/buyHealthPotion.js
@@ -15,6 +15,10 @@ module.exports = function buyHealthPotion (user, req = {}, analytics) {
     throw new NotAuthorized(i18n.t('cannotBuyItem', req.language));
   }
 
+  if (user.stats.hp >= 50) {
+    throw new NotAuthorized(i18n.t('messageHealthAlreadyMax', req.language));
+  }
+
   user.stats.hp += 15;
   if (user.stats.hp > 50) {
     user.stats.hp = 50;
diff --git a/test/api/v3/integration/user/POST-user_buy.test.js b/test/api/v3/integration/user/POST-user_buy.test.js
index ffad12f2a0..429f551218 100644
--- a/test/api/v3/integration/user/POST-user_buy.test.js
+++ b/test/api/v3/integration/user/POST-user_buy.test.js
@@ -31,6 +31,7 @@ describe('POST /user/buy/:key', () => {
   it('buys a potion', async () => {
     await user.update({
       'stats.gp': 400,
+      'stats.hp': 40,
     });
 
     let potion = content.potion;
@@ -42,6 +43,19 @@ describe('POST /user/buy/:key', () => {
     expect(res.message).to.equal(t('messageBought', {itemText: potion.text()}));
   });
 
+  it('returns an error if user tries to buy a potion with full health', async () => {
+    await user.update({
+      'stats.gp': 40,
+      'stats.hp': 50,
+    });
+
+    await expect(user.post('/user/buy/potion'))
+      .to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('messageHealthAlreadyMax'),
+      });
+  });
   it('buys a piece of gear', async () => {
     let key = 'armor_warrior_1';
 
diff --git a/test/common/ops/buyHealthPotion.js b/test/common/ops/buyHealthPotion.js
index 6a70f71b62..23a590bbdd 100644
--- a/test/common/ops/buyHealthPotion.js
+++ b/test/common/ops/buyHealthPotion.js
@@ -61,5 +61,20 @@ describe('shared.ops.buyHealthPotion', () => {
         done();
       }
     });
+
+    it('does not purchase if hp is full', (done) => {
+      user.stats.hp = 50;
+      user.stats.gp = 40;
+      try {
+        buyHealthPotion(user);
+      } catch (err) {
+        expect(err).to.be.an.instanceof(NotAuthorized);
+        expect(err.message).to.equal(i18n.t('messageHealthAlreadyMax'));
+        expect(user.stats.hp).to.eql(50);
+        expect(user.stats.gp).to.eql(40);
+
+        done();
+      }
+    });
   });
 });