Protects your collaborators' and administrators' accounts from unauthorized access attempts.
Automatically blocks an attacker attempting to guess passwords en masse.
Also applies to the password recovery flow, not just login.
Does not create additional friction for legitimate users who log in correctly.
This feature operates automatically and transparently, with no configuration required from the user.
Lockout flow:
A user (or attacker) repeatedly attempts to log in with incorrect credentials.
Upon exceeding the limit of consecutive failed attempts, the system temporarily blocks access.
The login screen displays an error message indicating that the attempt limit has been exceeded and that the user must wait before trying again.
Once the lockout period has passed, access is automatically restored.
Password recovery flow:
If multiple recovery requests are made from the same IP or for the same email address, the system applies the same lockout mechanism.
The recovery screen displays a message indicating that a few minutes must pass before requesting it again.
The lockout is temporary. It is not necessary to contact support to unlock the account: access is automatically restored once the waiting period expires.
A successful login before reaching the limit resets the failed attempts counter.
What happens if I enter the wrong password several times?
After a certain number of consecutive failed attempts, your access will be temporarily blocked. Wait a few minutes and you can try again.
How long does the lockout last?
The lockout is temporary and is lifted automatically. You don't need to contact support.
Am I affected if I log in correctly after one or two failed attempts?
No. If you complete the login before exceeding the limit, the counter is reset and there is no lockout.
Is the "Forgot my password" flow also protected?
Yes. If too many recovery requests are made from the same IP or for the same email, the temporary lockout also applies.
What happens if I enter the wrong password several times?
After 5 consecutive failed attempts, your access will be temporarily blocked for 15 minutes. After that time, you can try again.
How long does the lockout last?
The lockout lasts 15 minutes and is lifted automatically. You don't need to contact support.
Do you have feedback or want to request improvements? Let us know at roadmap.whalemate.com/roadmap
