How IP Address Banning Works
Repeated failed sign-ins from one address are banned automatically. It is on by default and it is the platform's main defence against password guessing.
Where to find it
Architect Panel → Security:
- Security Settings — Enable IP Address Banning, Attempts, Monitoring Period and Ban Length
- Blocked IP Addresses — the addresses currently banned
The rule
Three settings define it:
- Attempts — how many failures trip the ban. Ships at 10.
- Monitoring Period — the window those failures must fall within, in seconds. Ships at 600, ten minutes.
- Ban Length — how long the ban lasts, in seconds. Ships at 600.
So out of the box: ten failures from one address within ten minutes earns a ten-minute ban.
Why a window rather than a total
Counting failures within a moving window distinguishes an attack from a bad month. Ten failures in ten minutes is somebody guessing; ten failures spread over a year is an ordinary user who mistypes occasionally, and banning them would be a support call for no security benefit.
Why a temporary ban
A ten-minute ban is devastating to automated guessing — it reduces an attacker to a handful of attempts an hour, which makes any realistic password unreachable — while being a minor inconvenience to a real person who has forgotten their password.
Permanent bans sound stronger and are worse in practice: addresses are shared and reassigned, so a permanent ban eventually blocks somebody innocent, and the list grows until nobody dares prune it.
What it does not stop
Be clear-eyed about this. Blocking by address does not stop:
- An attacker rotating through many addresses, which is cheap and common.
- Credential stuffing that tries one password against many accounts — each account sees one failure, and no address exceeds the threshold.
- Anybody who already has valid credentials.
It raises the cost of the crudest attack. It is a useful layer, not a defence on its own — which is the argument for two-factor authentication and passkeys rather than for tighter thresholds here.
Shared addresses
An office, a school or a hospital may present hundreds of users behind one address. A threshold that is reasonable for an individual can be tripped by ordinary Monday-morning fumbling across a large site.
If you serve users behind large shared connections, watch the block list for addresses that reappear and consider whether the account-level control is doing more of the work.
Worked example
An organisation leaves the defaults in place. A scripted attack tries thousands of passwords against one account; after ten attempts the address is banned, and by the time it lifts the attacker has managed perhaps sixty attempts an hour instead of thousands a second. Nothing is compromised, and no administrator was involved.
Recommendations
- Leave it enabled. The defaults are sensible.
- Do not rely on it alone — pair it with a second factor.
- Watch for shared addresses tripping the rule repeatedly.
- Prefer short bans over long ones.