Protect accounts
Decide how strong passwords must be, what happens when someone guesses at an account, how long a sign-in lasts, and whether a bot challenge guards your hosted forms. Each setting is a section of your tenant's Security page, below the sign-in methods, with its own save button. Saving needs the Manage tenant settings permission.
Set the password policy
Under Security → Password policy:
| Setting | Default | Allowed values |
|---|---|---|
| Minimum length | 8 | 8–128 characters |
| Reject breached passwords | On | On or off |
Choose Save password policy. The policy applies when someone signs up,
resets a password, or changes one; existing passwords are not re-checked. There
are no character-class rules. Reject breached passwords checks the password
against Have I Been Pwned by k-anonymity, so only the first five characters of
the password's SHA-1 hash leave Udibo. If that service cannot be reached, the
password is accepted and auth.breached_password.check_unavailable is recorded
in the audit log.
Enforce or monitor
Security → Attack protection → Mode defaults to Enforce — block
attacks. Monitor — record only records every decision as an audit event
without blocking anyone, and the badge reads Monitor only — nothing is
blocked. The mode governs the sign-in rate limit, lockout, the per-account
email limits below, breached-password rejection, and challenge failures on your
own Turnstile keys. To watch before you enforce, switch to monitor, review the
auth.sign_in.rate_limited, auth.lockout, auth.breached_password.rejected
and auth.captcha.failed events, then switch back. If the page says monitor
mode is forced for every tenant, your choice has no effect until that notice is
gone.
Configure lockout and the sign-in rate limit
The same form holds four numbers. Choose Save attack protection after changing them.
| Setting | Default | Allowed values |
|---|---|---|
| Failed attempts before lockout | 10 | 3–100 consecutive failures |
| Lockout duration (minutes) | 15 | 1–1440 |
| Sign-in attempts per window | 10 | 1–1000 |
| Rate-limit window (minutes) | 15 | 1–1440 |
Lockout counts consecutive wrong passwords on one account. When it trips, password sign-in for that account is refused until the duration passes, and a successful sign-in resets the count. A locked account gets the same "Invalid credentials" answer as a wrong password, so the lock is not revealed to whoever is guessing.
The rate limit counts password sign-in attempts for each identifier as typed, email or username, whether or not an account exists. Past the limit the form answers "Too many attempts. Try again in about N minutes."
Some limits are fixed rather than set on this page. Emails for password reset, email verification, account unlock and sign-in links are each limited to five per hour for the same account or address. Sign-in codes allow ten requests and attempts per hour per address. The hosted forms that email an address someone types share a cap of 20 emails per hour per client IP address, in both modes.
Help a locked-out person back in
Under Enforce, the moment an account locks Udibo emails it an unlock link, if the account has an email address:
The person opens the link and sees Unlock your account. Opening the link changes nothing, so a mail scanner cannot use it up.
They choose Unlock account. The lock and the sign-in rate limit for their username and email are cleared, and the sign-in page says "Account unlocked. You can now sign in."
The link works once and expires after one hour. A person can also wait out the lockout duration, or reset their password from the sign-in page: completing a reset clears the lock and signs out every session. To start that for them, open Users → the person → More → Email a reset link. In monitor mode nobody is locked out, so no unlock email is sent.
Set session lifetimes
Under Security → Session policy:
| Setting | Default | Allowed values |
|---|---|---|
| Session lifetime (hours) | 24 | 1–2160 |
| Remember-me lifetime (days) | 30 | 1–365, and never shorter than the session limit |
| Idle timeout (days) | 7 | 1–365 |
Choose Save session policy. Shortening a lifetime applies at once, to people already signed in as well as new sign-ins. Lengthening the session or remember-me lifetime applies only to new sign-ins, while raising the idle timeout lets back in sessions that had only gone idle. A save is refused if the idle timeout would exceed a first-party application's Refresh token lifetime (seconds), which is set on each application's edit page along with its access token lifetime. Sign-out and device controls are in Sessions and sign-out.
Add bot protection
Security → Bot protection adds a Cloudflare Turnstile challenge to the hosted sign-up, password sign-in, password-reset request, sign-in code or link request, and waitlist join forms. It works alongside the rate limit and lockout and does not replace them. Pick a Challenge, then choose Save bot protection:
Use Udibo's Turnstile account appears only when Udibo provides a shared challenge, and is what a tenant that has saved nothing gets. It is monitor-only: a failed challenge is recorded, never refused.
Use my own Turnstile keys takes the Site key and Secret key from your Cloudflare account. A failed challenge is refused under Enforce and recorded under Monitor. Fail open if Turnstile is unreachable is on by default; turn it off to refuse requests during a Turnstile outage instead.
No challenge shows no widget and runs no check.
The secret key is sealed and never shown again; leave it blank to keep it. Switching challenge keeps your keys; Remove saved keys deletes them once unused. A refused challenge gets the form's usual refusal, so it reveals nothing about the account. Redeeming a waitlist invitation skips the challenge.
New-device sign-in notices
There is no setting for these. Udibo remembers the browsers an account signs in
from with the device_id cookie
and records auth.new_device.detected when a sign-in comes from one it does not
recognize; an account's first device is remembered silently. Emailing the person
about a new device is off by default and cannot be turned on per tenant.
Change policies through the API
The management API's PATCH /api/identity/tenants/{id} accepts
passwordPolicy, lockoutPolicy, sessionPolicy, and protectionMode, merged
into the stored settings. Bot protection has no API. Today you reach these
settings through the dashboard; see
choose the right API.
Limits today
The sign-in rate limit counts per identifier. There is no configurable limit per IP address on password sign-in.
Lockout guards password sign-in only. A locked account can still sign in with an enabled email code, email link or social provider.
No dashboard control lifts a lockout, and setting a temporary password from the user's page does not clear one.
Turnstile is the only bot-protection provider, and Udibo's shared challenge never refuses a request.
The fixed email limits are not configurable.
Next: manage users, set up MFA, or work through the production checklist.
Last verified 2026-09-29.