Account Lockout
Account lockout temporarily blocks sign-in for a user after too many wrong passwords. It slows down password-guessing attacks without permanently locking anyone out.
Default behavior
On a self-hosted server account lockout is off by default. Wrong passwords are not counted and no user is ever locked until you turn it on.
Note for upgraded servers: In earlier versions lockout was part of Enhanced Password Security. It is now a separate switch and starts off after upgrade, even if password security is on. Turn it on if your policy requires it.
What lockout does
Rule | Value |
|---|---|
Wrong passwords before lock | 5 |
Lock duration | 5 minutes |
Counter reset | On successful sign-in, when a lock is issued, or when an administrator unlocks |
Applies to | Username-and-password sign-in only |
Only a wrong password counts. A blank submission, a database or directory outage, or a connection error does not count toward a lock. SSO, Windows authentication, external identity providers and sign-in links are never counted and never locked.
The built-in admin account can be locked like any other; it clears after 5 minutes or when another administrator unlocks it.
Turning account lockout on
Go to Settings → Server Settings → Security Settings.
Turn on Lock account for 5 minutes after 5 failed sign-in attempts.
Click Save.
The change takes effect immediately for new sign-in attempts.
What users see
After the fifth wrong password the sign-in page shows a message that the account is temporarily locked and to try again in a few minutes. The message is the same whether or not the password was correct on that attempt, so it does not reveal anything about the account.
After 5 minutes the user can try again. A correct password then signs them in normally.
Unlocking a user early
Administrators can clear a lock without waiting. Locked users show a Locked pill in Settings → Security → Users.
From the list: open the row menu (⋯) and choose Unlock.
From the user editor: the Locked until line shows when the lock expires; click Unlock.
The user can sign in right away. Unlocks are recorded in the Audit Log.
Troubleshooting
A user says they are locked out repeatedly. Check for a saved password in a browser, a mobile app, a scheduled job or an embedded dashboard that is retrying with an old password. Each retry counts. Have the user update the saved password, then unlock. Integration accounts that sign in automatically should be service accounts with a password that is rotated deliberately, not expired.
A user is locked but the Locked until field is empty. On a deployment with more than one application server the lock may have been issued by a different server; it clears within 5 minutes. Restarting the service also clears all locks.
Lockout seems to have no effect. Confirm the switch is on and saved. Also confirm the user signs in with a Yurbi password; SSO and Windows users are not subject to lockout.
Turning account lockout off
Turn the switch off and save. Any users currently locked can sign in immediately.
Frequently asked questions
Can I change the number of attempts or the lock time? No. The values are fixed at 5 attempts and 5 minutes.
Does lockout disable the account? No. Lockout is temporary and clears on its own. To permanently block a user, use Account disabled in the user editor — see Managing User Accounts.
Is lockout recorded? Yes. Lock and unlock events appear in Settings → Audit Log.