How Account Banning Works
Failed sign-ins are counted against the account as well as the address. Both rules run, and either can trigger.
Where to find it
Architect Panel → Security:
- Security Settings — Enable User Account Banning, Attempts, Monitoring Period and Ban Length
- Blocked User Accounts — accounts currently banned
- Blocked IP Addresses — the address-level equivalent
The rule
The same three settings as address banning, applied to the account: Attempts (ships at 10), Monitoring Period (600 seconds) and Ban Length (600 seconds). It is enabled by default.
What it catches that address banning misses
An attacker rotating through addresses defeats the address rule completely — each address stays under the threshold. But if they are working against one account, the failures accumulate against that account regardless of where they came from.
This is the important complement. Address banning stops crude attacks from one source; account banning stops distributed attacks on one target. Neither covers the other, which is why both are on.
What neither catches
Credential stuffing — one password tried against thousands of accounts — stays under both thresholds. Each account sees one failure and each address may see only a few.
Nothing in this pair of settings addresses that. Two-factor authentication and passkeys do, which is the honest recommendation rather than tightening these numbers.
Banned is not disabled
Worth being precise, because the two are separate and produce the same complaint:
- Banned — automatic, temporary, a security response to failed attempts. Clears itself.
- Disabled — an administrative decision, recorded with a reason and who made it, and it stays until reversed.
Check which one you are looking at before acting. Unbanning a disabled account achieves nothing, and enabling a banned one is unnecessary.
Denial of service against a person
Account banning has a genuine downside: anybody who knows a username can lock that person out by failing to sign in as them repeatedly. A short ban keeps that to a nuisance; a long one turns it into a weapon.
This is the reason to keep account ban lengths shorter than address ban lengths, which is the opposite of the instinct.
Watch for repeatedly banned accounts
One account banned again and again is either somebody being targeted or somebody with a saved password that is now wrong — an old mobile client retrying every few minutes will do it indefinitely. Both are worth a conversation.
Worked example
An administrator's account is targeted from dozens of addresses. No single address reaches the address threshold, but the account reaches its own after ten attempts and bans repeatedly. The pattern is visible in the blocked account list, prompting the organisation to require a second factor for administrators — which ends the exposure properly rather than by tuning.
Recommendations
- Keep both rules enabled. They cover different attacks.
- Keep account bans shorter than address bans.
- Distinguish banned from disabled on every lock-out report.
- Investigate repeatedly banned accounts rather than clearing them.