Support

Hi,
A new user just got blocked because he hit the validate email link and then entered the wrong username. He got an appropriate message to go back to his validation email and check his access details where he realized that he entered the wrong username, but when he returned to the site he was blocked, and I had to get his IP address to unblock him.

This seems overly sensitive to me. A user shouldn't be blocked unless he's repeatedly trying with incorrect access details.

Is there a way I can affect this sensitivity?

Thanks.

Hi Peter!

There are two possible places that you could adjust this. Go to Web Application Firewall, Configure WAF, on the Auto-Ban tab. Here you see the number of exceptions and time period for the ban and the length of time for the ban. The lower your number of exceptions and the higher you time period, the more bans you're going to get. And if you're not banning bad guys quickly, they get more chances. It's a trade off, there is no one right answer.

The second place doesn't really ban users, it deactivates the user ID. I don't think that is what is happening here. That setting is on the Hardening Options tab.

Thanks Dale. The user told me he got the message after entering the wrong access info just once, but he now realizes that it was after the second time. Odd because it's configured to only block after 3 times in 1 minute.

But at least I know how to affect this one direction or the other for the future. Thanks.

You're welcome! Have a good weekend!

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.