When a user forgets their password multiple times on one my front-end login screen, they sometimes get locked out of the system until an admin can unlock them in the control panel. Is there any way to prevent this behaviour?
It’s not currently possible to disable that behavior altogether, but you can increase the number of times the user can enter the incorrect password before their account gets locked using the maxInvalidLogins config setting.
You can also customize how long Craft will track invalid logins before that maxInvalidLogins counter resets using the invalidLoginWindowDuration config setting.
For example you, if you wanted the users to get locked out if they entered more than two* incorrect passwords in 10 seconds, you could set these in craft/config/general.php:
'maxInvalidLogins' => 3, // see the note below 'invalidLoginWindowDuration' => 'PT10S',
You can also customize what happens when a user gets locked out with the cooldownDuration config setting. By default they will only be locked out for 5 minutes, so it’s not actually necessary for an admin to log in and unlock their account. That would only happen if the config setting was set to
*There’s actually a bug in Craft right now where a user will get locked out as soon as they’ve hit the maxInvalidLogins count, which I think is incorrect; if the setting is set to 2, they should be able to login incorrectly 2 times, and still have a 6th chance to get it right. I’ve just adjusted that behavior for the upcoming 2.2 release.