Failed sign ins, lockouts and how long they last

The rule

Sign in attempts are counted per address.

• Three failures in a row locks that address out for 20 minutes.
• If, after serving that, the same address fails three more times in a row, it is locked out for 24 hours.
• Any subsequent round of three failures is another 24 hours.

One successful sign in clears the count completely. So does a full day with no failed attempts: the record of previous strikes ages out after 24 hours, and an address that behaved itself for a day starts again from a clean slate.

Waiting is the only way through

A locked address stays locked for the full period. Attempting again during a lockout does not extend it, but it does not shorten it either, and it is recorded. Refreshing, switching browser, clearing cookies and using a private window all make no difference, because the lock is on the network address rather than on the browser.

The countdown is shown on the sign in page, so you can see exactly how long is left rather than guessing.

Why these numbers

Twenty minutes is long enough to make automated guessing pointless — three tries every twenty minutes is about 216 guesses a day, which will not find a real password in any useful timeframe — and short enough that a person who mistyped their own password twice is not locked out of their own account for the evening.

Twenty four hours is for whoever is still there after the first lockout, because at that point it is no longer somebody fumbling their own password.

The rest of the protection

Lockouts are the visible layer. Underneath, every sensitive endpoint has its own limit measured by time window rather than by failures: sign in is capped at five attempts a minute, registration and password reset requests at three, password changes at five every five minutes, and the contact form at three a minute. These are recorded but rarely noticed, because normal use never gets near them.

Administrators can also block or allow specific addresses outright, and an allowed address is never locked out by the rules above.

If it was not you

Failed attempts on your account appear in your audit log as Failed sign in attempt, with the address and the time. A run of them from an address you do not recognise means somebody is guessing at your password. The lockout has already stopped them, but it is worth changing your password and turning on two factor authentication the same day.