Account banning is the per-user counterpart to IP banning. It tracks failed sign-in attempts per username rather than per source IP. The distinction matters because a clever attacker rotates source IPs but only tries one or two known usernames.
Why You Want Both Layers
- IP banning catches the “try thousands of passwords against one account from one IP” pattern.
- Account banning catches “try a few passwords against one account from rotating IPs” — the more sophisticated attacker.
- Together they cover most credential-stuffing patterns.
The Three Knobs
- Attempts: Number of failures within the window to trigger a block (typically 5).
- Monitoring period: Window over which attempts are counted (typically 15 minutes).
- Ban duration: Block length (typically 30 minutes; admin unblock available).
What Happens When Banned
- The user (or attacker) sees a generic “Sign-in temporarily unavailable for this account, try again later” message.
- The user is added to the blocked accounts list with reason “auto”.
- If configured, the real user receives an email alerting them that their account has been locked due to failed attempts.
- After the ban duration elapses, sign-in works again. The failed counter is reset.
Worked Examples
- Credential stuffing detected: One username, 5 attempts from 5 different IPs over 12 minutes — account banned. The user logs in fine 30 minutes later.
- Stolen list: Attacker uses a stolen email list; every targeted account hits the threshold within hours. All locked; users notified.
- Forgetful user: Same person mistyping their password 5 times — they get the lockout message; their email arrives with a reset link they can use immediately.
Note: Always pair the lockout message with a password-reset link in the lockout email. Otherwise legitimate users get stuck and call support.