The Two Login Modes
Login Page Mode chooses between two sign-in behaviours. It ships as e-mail check.
Where to find it
Architect Panel → Configuration:
- Site Settings — Login Page Mode
Architect Panel → Security:
- Authentication Methods — the sign-in routes this applies to
- Blocked User Accounts — where repeated failures surface
Standard
E-mail and password on one page, submitted together. The form responds identically whether or not the address is registered — a wrong password and an unknown address produce the same result.
So an attacker trying addresses learns nothing.
E-mail check
Asks for the e-mail first, then adapts: a password field for a known address, a registration route for an unknown one.
Better for the user, because the page responds to who they are. And it necessarily discloses whether an address is registered, because that is what it is reacting to.
The trade is real in both directions
This is not a case of one being secure and the other convenient. Both are defensible and the right answer depends on what an account with you implies.
The question to ask: does knowing somebody has an account here tell you something about them?
Where the disclosure does not matter
A retailer, a general service, anywhere anybody may register. Knowing an address has an account reveals nothing — the person could have created one in a minute anyway.
Here the smoother journey is a straightforward gain, and e-mail check is the better choice.
Where it matters a great deal
Anywhere membership is itself sensitive: a support service, a health context, a service for people in difficulty, a members-only professional body, an internal system where account existence maps to employment.
Being able to test whether somebody has an account with a domestic abuse service, or a particular clinic, is a disclosure that could matter enormously to that person. In those cases standard mode is the right answer and the extra friction is worth it.
It is not the only disclosure
Worth checking the rest of the journey, because the login page is rarely the only place. Password reset forms, registration forms and any "check if you have an account" feature can all disclose the same thing — and fixing one while leaving the others is not much of a fix.
Whatever posture you choose, apply it consistently.
Banning applies either way
Account and address banning work in both modes, so neither leaves you exposed to unlimited guessing. The disclosure question is separate from brute-force protection.
Worked example
A public marketplace uses e-mail check, because anybody may register and the smoother journey measurably improves sign-in completion. The same organisation's staff-facing system uses standard mode, because there an account means employment and that is not something to let anybody test.
Recommendations
- Ask what an account implies about the person.
- Use standard mode where membership is sensitive.
- Check reset and registration for the same disclosure.
- Decide deliberately rather than accepting the default.