Account Protection

This tab protects client accounts from stolen passwords. It scores each sign-in, asks for a code when the risk is high and blocks IP addresses that try many accounts.

Opening the Screen

In the left menu, click Settings, then Security. Click Authentication in the tab row, then Account Protection on the left.

Address: {admin}/settings/security?general=authentication&authentication=accountProtection

What Is on the Screen

Fields

Risk-Based Verification

Every password and JetPass sign-in is scored. A sign-in that reaches the threshold is verified with an email or SMS code. Passkey, social and administrator sign-ins are not scored. If no code can be sent, the sign-in goes through and administrators are alerted.

Many Accounts from One IP Address

Sign-ins and attempts to different accounts from the same IP address within the window are counted. Accounts that have signed in from that IP address before, such as an office network, are not counted.

Risk Signals

A new device, a new country and an account with no sign-in history are always counted. The signals below also add to the score; raising a number weakens its signal.

Attack Mode

Attack mode watches the hourly count of failed attempts together with attempts from IP addresses that tried several accounts. When the count exceeds the baseline, protection hardens for an hour. Sign-in shows a captcha, thresholds are halved and new devices need a code. It turns off by itself after two calm hours; administrators are notified both ways.

Automatic Protection

Sets what happens to the affected accounts when an IP address is blocked. With "Ask an Administrator", an event is opened and the actions are yours. With "Close Sessions and Ask the Client", the accounts lose their sessions and "remember me" tokens. Each client then receives a "was this you?" email. The password is invalidated only if the client answers "no".

Leaked Password Check

The password is looked up in known breach lists. The password itself is never sent; only the first 5 characters of its hash are queried. A leaked password is rejected when it is set. At sign-in, an account with a leaked password is sent to change it. If the lookup service does not respond, the sign-in goes through.

Re-verification for Sensitive Actions

Some actions in the client area ask the client to verify again. They are email and phone changes, turning off 2FA, API keys, stored cards and viewing license keys. Card entry at checkout is not covered, and trusted devices are exempt.

Sign-in Log

Every successful and failed sign-in attempt is recorded with its IP address, result, browser and risk score. An email address without an account is kept only as a hash.

Tasks

Asking for a Code on Every New Device

1. Expand Risk-Based Verification and turn on Account Protection if it is off.
2. Set Verification Mode to On Every New Device.
3. Click Save Changes.

Clients now enter a code on every browser that is not recognized.

Adding a Canary Account

1. Expand Canary Accounts below the settings.
2. Click Add Canary Account. Enter an address that does not reach a real mailbox, such as one ending in .invalid, and an optional note.
3. Click Create.

The account is created blocked and marked. Any attempt to sign in to it opens a security event and alerts administrators.

Things to Watch

• Account Protection is available in 5.0-beta.4 and later.
• The actions for a security event, such as closing sessions or blocking the IP address, are on the Security Events screen.

Required Privileges

Viewing the tab and saving its settings needs the SECURITY_SETTINGS privilege. The record lists, View Events and adding or removing canary accounts need TOOLS_ACTIONS.

Related Articles

• Authentication Security
• Security Events
• Sign-in Attempts