Account lockouts, bans and recovery¶
Find out why a person cannot sign in and use the recovery control for that account.
Needs: Pro · Security
A wrong password, missing MFA method, suspended account and blocked IP address need different remedies. Begin by identifying the exact site and user account, then check which protection has blocked access.
Investigate a failed sign-in¶
- Confirm whether the person is using production or staging.
- Confirm the username or account email, rather than relying on a company or display name.
- Open Security activity and inspect that account's status.
- Check the password, enrolled method, policy and grace period, then look for an account lockout, IP block or site ban.
- Verify the person's identity through your organization's recovery process and use the supported action for the specific block.
Depending on permissions and the account state, an administrator can reset eligible MFA enrollment, grant a supported grace period or unlock the account. Check the result and have the person enroll again when required. Resolving one person's problem should not require disabling protection for the whole site.
Distinguish account and network blocks¶
The reviewed default account lockout lasts ten minutes. Configured protections can also block an IP address, while a full site ban can apply beyond the login page.
Review the scope of CIDR allowlists and coordinated-attack thresholds before changing them. The system has guards against banning loopback or its own server addresses; these do not justify allowing a broad public network unnecessarily.
Review related protections¶
Check XML-RPC modes, security-change emails, trusted devices and active sessions as appropriate. On a self-hosted site with another security plugin installed, use the available compatibility or import information to establish which system controls each protection.
During offboarding, treat login suspension as its own step. Archiving a client or setting an employee to terminated does not necessarily prevent authentication.