Login Rate Limiting, Account Locking, and IP Whitelisting Estimated Reading Time: 2 Minutes Ubersmith blocks brute-force login attempts automatically. When a login attempt fails, the system checks how many failed attempts that username, or that IP address, has had in the last 30 minutes. Once either count reaches 5, further attempts from the username or the IP address are blocked and the login page shows Too many login attempts, please try again later. Continued failed attempts keep extending the 30-minute window, since it is measured back from the most recent failure. Whitelisting an IP Address You can exempt trusted IP addresses, for example your office network, from the IP-based part of rate limiting. Go to Settings > Password & Login. Under Rate Limit Whitelist, click Add Group and give the group a description. Click add next to the group to add one or more addresses to it. You can enter a single IP address or a range in CIDR notation (for example, 10.0.0.0/24). Note: Whitelisting an IP address does not make it immune to rate limiting entirely. Logins from that address are still checked against the per-username failure count — only the per-IP-address check is skipped. A whitelisted IP will not get an entire username blocked for other users, but repeated failures against one username from that address still lock that username out. You can also whitelist an address directly from its row on the Login Activity report (see below) by clicking whitelist, which opens the same form pre-filled with that address. Unlocking a Locked Account Administrator or Staff Accounts Go to Reports & Stats > Login Activity. Set the Status filter to Rate Limited to find the blocked login attempt. Click unlock next to that row and confirm. Unlocking requires account management permissions; the unlock action only appears for users who have them. Client Accounts Open the client's profile. In the Login Information section, click edit. Select the Unlock tab. If the account is currently locked, this tab shows This account is currently locked and an active Unlock Account button. If it isn't locked, the message reads This account is not currently locked and the button stays disabled, as shown below. Automatic Unlock on Password Reset Ubersmith can optionally unlock an account automatically whenever that user resets their password, instead of requiring a manual unlock. This is controlled by Unlock locked user account on password reset under Settings > User Authentication, and it is off by default. Note: Because this setting is off by default, resetting a password does not unlock an account unless an administrator has turned it on. Confirm the setting's state in your instance before telling a locked-out user that a password reset alone will restore their access.