---
title: "Account lockout"
source: https://dev.pageseeder.com/reference/glossary/account_lockout.html
description: "This document explains PageSeeder's automatic account lockout security feature, which locks accounts after multiple failed sign-in attempts. It covers configuration options, user warnings, and how administrators can unlock accounts."
last_updated: 2026-09-08T14:03:36+10:00
tokens: ~510
---

# Account lockout

A user account is locked automatically by PageSeeder after multiple consecutive failed sign-in attempts. While their account is locked, users cannot sign in. They must wait for the account lockout time to expire or contact an administrator to unlock their account.



## Configuration

For security reasons, PageSeeder doesn’t disclose how many attempts cause the lockout, nor how long the account is locked for. However, you can configure the account lockout behavior using the following [global properties](../../guide/configuration/properties/global_properties.md):

| Property | Effect |
| --- | --- |
| `minAccount​Lockout` | The minimum number of minutes an account can be locked for |
| `maxAccount​Lockout` | The maximum number of minutes an account can be locked for |
| `minBadLogins` | The minimum number of incorrect sign-in attempts before an account is locked |
| `maxBadLogins` | The maximum number of incorrect sign-in attempts before an account is locked |

## User experience

The sign-in always warns the user after a couple of failed sign-in attempts, irrespective of the configuration. It recommends that users use the [reset password](../../guide/configuration/emails/flows/personal_details.md) flow to avoid having their account locked.

![Sign-in page – Account lockout warning](/content/reference/glossary/../../images/glossary/sign-in_page_account_lockout_warning_v60000.webp)

When the account is locked, there is a warning that the account is locked.

![Sign-in page – Locked account](/content/reference/glossary/../../images/glossary/sign-in_page_account_locked_v60000.webp)

## Unlocking an account

Administrators can unlock an account by going to the user **account profile page** in the system administration and clicking the **Unlock** button.

![Account profile page – Locked account](/content/reference/glossary/../../images/glossary/account_profile_locked_account_v60000.webp)

Or using the API with the [/members/\{member\}/unlock](../../api/services/unlock-member_post.md) service.