# Account Protection

https://docs.wisecp.com/en/account-protection

This tab protects client accounts from stolen passwords. It scores each sign-in, asks for a code when the risk is high and blocks IP addresses that try many accounts.

## Opening the Screen

In the left menu, click **Settings**, then **Security**. Click **Authentication** in the tab row, then **Account Protection** on the left.

Address: `{admin}/settings/security?general=authentication&authentication=accountProtection`

## What Is on the Screen

- **Status Band**: Shows whether protection is on, the attack mode state, codes requested in the last 24 hours, blocked IP addresses and open security events.
- **Settings**: One row per group described below. A closed row shows its current value; one Save Changes saves all groups.
- **Records**: The Security Events, Sign-in Attempts and Canary Accounts lists below the settings. View Events in the band opens the first one.

## Fields

### Risk-Based Verification

Every password and JetPass sign-in is scored. A sign-in that reaches the threshold is verified with an email or SMS code. Passkey, social and administrator sign-ins are not scored. If no code can be sent, the sign-in goes through and administrators are alerted.

- **Account Protection**: Main switch for the tab. A verification code is required on risky sign-ins; when many accounts are signed in to from one IP address, the IP address is blocked and administrators are alerted.
- **Verification Mode**: "On Risky Sign-ins": a code when the risk score reaches the threshold. "On Every New Device": a code on every browser that is not recognized (clients enter codes more often).
- **Risk Threshold**: A sign-in that reaches this score requires a code. An account with no sign-in history signing in from a new device reaches the default threshold.
- **Remember Verified Device**: A browser that entered the code correctly is not counted as a new device for this long. Accounts that use 2FA are not affected by this setting.

### Many Accounts from One IP Address

Sign-ins and attempts to different accounts from the same IP address within the window are counted. Accounts that have signed in from that IP address before, such as an office network, are not counted.

- **Code Challenge Threshold**: Every sign-in from an IP address that reaches this number of accounts requires a code.
- **IP Address Block**: An IP address that reaches this number of accounts is blocked, a security event is opened and administrators are notified.
- **Counting Window**: Sign-ins from one IP address are counted within this many minutes for the two thresholds above.
- **Block Duration**: How long an IP address stays blocked after it reaches the block threshold.

### Risk Signals

A new device, a new country and an account with no sign-in history are always counted. The signals below also add to the score; raising a number weakens its signal.

- **VPN / Data Center**: The IP address lookup runs only after a correct password and its result is read from the cache. The whitelist on the IP Verification tab applies here too.
- **Dormant Account Period**: A sign-in to an account that has not signed in for longer than this adds to the risk score. Accounts without history that came with an upgrade are counted separately.
- **Attempt Limit per Account**: After this many failed attempts within an hour, a sign-in to that account requires a code. The account is not locked; its owner already receives an informational email.
- **Watched Networks**: Every sign-in from a listed network requires a code. Enter one ASN per line (e.g. AS9009); leave it empty to turn the signal off.

### Attack Mode

Attack mode watches the hourly count of failed attempts together with attempts from IP addresses that tried several accounts. When the count exceeds the baseline, protection hardens for an hour. Sign-in shows a captcha, thresholds are halved and new devices need a code. It turns off by itself after two calm hours; administrators are notified both ways.

- **Harden Automatically**: The baseline is the hourly median of the last 7 days; on a small installation the minimum value protects the baseline.
- **Baseline Factor**: Attack mode turns on when the hourly count exceeds the baseline by this factor.
- **Minimum Event Count**: The hourly count must also reach at least this number, so a few failures on a quiet site do not trigger attack mode.

### Automatic Protection

Sets what happens to the affected accounts when an IP address is blocked. With "Ask an Administrator", an event is opened and the actions are yours. With "Close Sessions and Ask the Client", the accounts lose their sessions and "remember me" tokens. Each client then receives a "was this you?" email. The password is invalidated only if the client answers "no".

- **Action After a Block**: On IP addresses shared by an office or a school network, closing sessions automatically signs clients out in bulk.

### Leaked Password Check

The password is looked up in known breach lists. The password itself is never sent; only the first 5 characters of its hash are queried. A leaked password is rejected when it is set. At sign-in, an account with a leaked password is sent to change it. If the lookup service does not respond, the sign-in goes through.

- **Reject Leaked Passwords**: At every point, including registration, password change, password reset and passwords set by an administrator.
- **Sign-in Check Frequency**: At most this often per account; an outside request on every sign-in would slow sign-ins down.

### Re-verification for Sensitive Actions

Some actions in the client area ask the client to verify again. They are email and phone changes, turning off 2FA, API keys, stored cards and viewing license keys. Card entry at checkout is not covered, and trusted devices are exempt.

- **Require Re-verification**: On an untrusted device session, the password or a code is asked once.
- **Verification Validity**: How long one successful verification covers further sensitive actions.

### Sign-in Log

Every successful and failed sign-in attempt is recorded with its IP address, result, browser and risk score. An email address without an account is kept only as a hash.

- **Retention Period**: Days sign-in attempt records are kept; older records are cleaned up daily.

## Tasks

### Asking for a Code on Every New Device

1. Expand **Risk-Based Verification** and turn on **Account Protection** if it is off.
2. Set **Verification Mode** to **On Every New Device**.
3. Click **Save Changes**.

Clients now enter a code on every browser that is not recognized.

### Adding a Canary Account

1. Expand **Canary Accounts** below the settings.
2. Click **Add Canary Account**. Enter an address that does not reach a real mailbox, such as one ending in .invalid, and an optional note.
3. Click **Create**.

The account is created blocked and marked. Any attempt to sign in to it opens a security event and alerts administrators.

## Things to Watch

- Account Protection is available in 5.0-beta.4 and later.
- The actions for a security event, such as closing sessions or blocking the IP address, are on the [Security Events](https://docs.wisecp.com/en/security-events) screen.

## Required Privileges

Viewing the tab and saving its settings needs the **SECURITY_SETTINGS** privilege. The record lists, **View Events** and adding or removing canary accounts need **TOOLS_ACTIONS**.

## Related Articles

- [Authentication Security](https://docs.wisecp.com/en/authentication-security)
- [Security Events](https://docs.wisecp.com/en/security-events)
- [Sign-in Attempts](https://docs.wisecp.com/en/sign-in-attempts)