Login Attempts Blocker & Rate Limiting

AXQA protects authentication and platform endpoints against repeated requests and brute-force behavior using configurable login-attempt limits and request rate limiting.
Controls can operate by user identity, IP address, or authenticated user depending on the protected workflow.

Why it matters

• Reduces brute-force authentication risk.
• Limits repeated automated requests.
• Protects platform resources from excessive request volume.
• Provides administrators with configurable login-protection controls.

When to use it

• When configuring workspace login security.
• When reviewing authentication protection.
• When investigating repeated failed-login activity.
• When protecting high-frequency or sensitive AXQA endpoints.

Core concepts

• User Login Limit – Maximum failed login attempts allowed for an account before temporary lockout.
• User Lockout Duration – Time the affected account remains temporarily locked.
• IP Login Limit – Failed-login protection applied to a source IP.
• IP Lockout Duration – Temporary block period applied to the source IP.
• Rate Limit – Maximum request frequency allowed during a defined time window.
• HTTP 429 – Response used when the allowed request rate has been exceeded.

How it works

1. A login attempt is received.
2. AXQA checks whether the user or source IP is currently locked.
3. A failed authentication increases the applicable attempt counters.
4. When the configured threshold is reached, temporary lockout is applied.
5. Successful authentication resets applicable failed-login counters.
6. Separate rate-limit controls protect supported application endpoints.
7. Excess requests are rejected before the protected operation continues.

How to use it

Step 1: Open Login Attempts Blocker

Open:

Security → Login Attempts Blocker

Step 2: Configure user protection

Configure:

• User Maximum Login Attempts
• User Lockout Duration

These settings control account-level failed-login protection.

Step 3: Configure IP protection

Configure:

• IP Maximum Login Attempts
• IP Lockout Duration

These settings provide additional protection against repeated attempts originating from the same source network address.

Step 4: Consider shared networks

AXQA also supports configuration for environments where multiple legitimate users share the same public IP.

Use Same IP User Capacity to represent the expected number of identities sharing that public IP when the corresponding login-protection logic applies.

Step 5: Save the security configuration

Save the settings.

The configuration becomes part of the workspace login-protection rules.

Step 6: Understand general request rate limiting

AXQA also applies baseline request limits to supported web and API activity.

Authenticated requests can be limited per user.

Anonymous activity can be limited per source IP.

Sensitive endpoints can also apply their own stricter limits.

Best practices

• Configure login limits according to your organization size and security requirements.
• Avoid extremely high failed-login thresholds.
• Consider shared corporate NAT addresses before applying aggressive IP restrictions.
• Investigate repeated lockouts instead of continuously increasing the limit.
• Combine login-attempt protection with Two-Factor Authentication.

Common mistakes

❌ Disabling practical login protection because multiple users share one public IP.
✔ Configure the shared-network capacity appropriately instead.

❌ Treating rate limiting as a replacement for authentication.
✔ Rate limiting reduces abuse; authentication still verifies identity.

❌ Repeatedly retrying credentials after a lockout.
✔ Wait for the configured lockout period or investigate the authentication issue.

Security & permissions

• Login Attempts Blocker configuration is restricted to Superusers.
• User and IP lockouts are evaluated before protected login processing continues.
• Supported rate limits return HTTP 429 when limits are exceeded.
• Authentication protections can use separate storage for security rate-limit state.
• Security events generated by repeated denied requests can contribute to Security Log monitoring.

Related documentation

• Two-Factor Authentication, Sessions & Auto Logout
• Security Log Tracker & Live Security Monitoring
• IP Whitelist Security
• Security Architecture Overview