---
title: Invalid sign-in attempts
related:
  - https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/unlocking-user-accounts.md
  - https://docs.kentico.com/13/configuring-xperience/managing-sites/configuring-settings-for-sites/settings-security-membership/settings-protection.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

One of the most common threats to website security is stealing user accounts. To compromise an account, attackers use methods which try to guess the password for that account, either by combining different characters or by selecting passwords from a dictionary.

This threat can be eliminated for the Xperience administration interface by **limiting the number of invalid sign-in attempts**, which means that users will have their account locked after entering an incorrect password for the specified number of times.

![Locked account after exceeding the number of invalid sign-in attempts](https://docs.kentico.com/docsassets/13/invalid-sign-in-attempts/invalid_sign-in_attempts_exceeded.png "Locked account after exceeding the number of invalid sign-in attempts")

> **Note:** **Administration only**
>
> The invalid sign-in limits described on this page are only supported for the Xperience administration application. They do NOT apply to users who sign in on the live site (via the MVC application).

## Limiting the number of invalid sign-in attempts

To configure the limit:

1. Open the **Settings** application.
2. Select the **Security & Membership -> Protection** setting tree item.
3. Configure settings in the **Invalid sign-in attempts** category:
   - **Maximum invalid sign-in attempts** – specified the number of possible sign-in attempts before the system locks the account and denies access. Type _0_ to disable the account locking.
   - **Send unlock account email** – indicates whether an email notification should be sent to the user if their account is locked. Select the check box to send the notification.
   - **Unlock user account path** – specifies a path to a page where the user can unlock the account. If not specified, the system uses the default path: _\~/CMSModules/Membership/CMSPages/UnlockUserAccount.aspx_

     > **Tip:** For all protection settings, see [Settings - Protection](https://docs.kentico.com/13/configuring-xperience/managing-sites/configuring-settings-for-sites/settings-security-membership/settings-protection.md).
4. Click **Save**.

The system now locks user accounts according to your settings.

To display a friendly message to the users (as you can see on the picture above):

1. Open the **Settings** application.
2. Select the **Security & Membership -> Protection** setting tree item.
3. Enable the **Display account lock information message** setting.
4. Click **Save**.

If you do not enable the setting, users see only a general message that their sign-in attempt was unsuccessful without knowing that their account has been locked.

Users cannot sign in to a _locked_ account. The global or site administrator has to unlock the account for them.

> **Note:** Using this protection may also lead to another security risk. If the users have easy-to-guess user names, then an attacker can block their accounts anytime by submitting wrong passwords with their user names on purpose.

## Resetting the number of invalid sign-in attempts

When a user successfully signs in, the system automatically resets the number of invalid sign-in attempts to zero.

Administrators can also reset the invalid sign-in attempt counter manually:

1. Open the **Users** application.
2. **Edit** () the given user.
3. Click **Reset** at the **Invalid sign-in attempts** field.

The system sets the number back to zero and unlocks the user's account (if the user has reached the limit).