# Protect accounts

Decide how strong passwords must be, what happens when someone guesses at an
account, how long a sign-in lasts, and whether a bot challenge guards your
hosted forms. Each setting is a section of your tenant's **Security** page,
below the
[sign-in methods](https://www.udibo.com/docs/identity/sign-in-methods), with its
own save button. Saving needs the **Manage tenant settings** permission.

## Set the password policy

Under **Security** → **Password policy**:

| Setting                   | Default | Allowed values   |
| ------------------------- | ------- | ---------------- |
| Minimum length            | 8       | 8–128 characters |
| Reject breached passwords | On      | On or off        |

Choose **Save password policy**. The policy applies when someone signs up,
resets a password, or changes one; existing passwords are not re-checked. There
are no character-class rules. **Reject breached passwords** checks the password
against Have I Been Pwned by k-anonymity, so only the first five characters of
the password's SHA-1 hash leave Udibo. If that service cannot be reached, the
password is accepted and `auth.breached_password.check_unavailable` is recorded
in the [audit log](https://www.udibo.com/docs/identity/audit-log).

## Enforce or monitor

**Security** → **Attack protection** → **Mode** defaults to **Enforce — block
attacks**. **Monitor — record only** records every decision as an audit event
without blocking anyone, and the badge reads **Monitor only — nothing is
blocked**. The mode governs the sign-in rate limit, lockout, the per-account
email limits below, breached-password rejection, and challenge failures on your
own Turnstile keys. To watch before you enforce, switch to monitor, review the
`auth.sign_in.rate_limited`, `auth.lockout`, `auth.breached_password.rejected`
and `auth.captcha.failed` events, then switch back. If the page says monitor
mode is forced for every tenant, your choice has no effect until that notice is
gone.

## Configure lockout and the sign-in rate limit

The same form holds four numbers. Choose **Save attack protection** after
changing them.

| Setting                        | Default | Allowed values             |
| ------------------------------ | ------- | -------------------------- |
| Failed attempts before lockout | 10      | 3–100 consecutive failures |
| Lockout duration (minutes)     | 15      | 1–1440                     |
| Sign-in attempts per window    | 10      | 1–1000                     |
| Rate-limit window (minutes)    | 15      | 1–1440                     |

**Lockout** counts consecutive wrong passwords on one account. When it trips,
password sign-in for that account is refused until the duration passes, and a
successful sign-in resets the count. A locked account gets the same "Invalid
credentials" answer as a wrong password, so the lock is not revealed to whoever
is guessing.

**The rate limit** counts password sign-in attempts for each identifier as
typed, email or username, whether or not an account exists. Past the limit the
form answers "Too many attempts. Try again in about N minutes."

Some limits are fixed rather than set on this page. Emails for password reset,
email verification, account unlock and sign-in links are each limited to five
per hour for the same account or address. Sign-in codes allow ten requests and
attempts per hour per address. The hosted forms that email an address someone
types share a cap of 20 emails per hour per client IP address, in both modes.

## Help a locked-out person back in

Under **Enforce**, the moment an account locks Udibo emails it an unlock link,
if the account has an email address:

1. The person opens the link and sees **Unlock your account**. Opening the link
   changes nothing, so a mail scanner cannot use it up.
2. They choose **Unlock account**. The lock and the sign-in rate limit for their
   username and email are cleared, and the sign-in page says "Account unlocked.
   You can now sign in."

The link works once and expires after one hour. A person can also wait out the
lockout duration, or reset their password from the sign-in page: completing a
reset clears the lock and signs out every session. To start that for them, open
**Users** → the person → **More** → **Email a reset link**. In monitor mode
nobody is locked out, so no unlock email is sent.

## Set session lifetimes

Under **Security** → **Session policy**:

| Setting                     | Default | Allowed values                                  |
| --------------------------- | ------- | ----------------------------------------------- |
| Session lifetime (hours)    | 24      | 1–2160                                          |
| Remember-me lifetime (days) | 30      | 1–365, and never shorter than the session limit |
| Idle timeout (days)         | 7       | 1–365                                           |

Choose **Save session policy**. Shortening a lifetime applies at once, to people
already signed in as well as new sign-ins. Lengthening the session or
remember-me lifetime applies only to new sign-ins, while raising the idle
timeout lets back in sessions that had only gone idle. A save is refused if the
idle timeout would exceed a first-party application's **Refresh token lifetime
(seconds)**, which is set on each application's edit page along with its access
token lifetime. Sign-out and device controls are in
[Sessions and sign-out](https://www.udibo.com/docs/identity/sessions).

## Add bot protection

**Security** → **Bot protection** adds a Cloudflare Turnstile challenge to the
hosted sign-up, password sign-in, password-reset request, sign-in code or link
request, and waitlist join forms. It works alongside the rate limit and lockout
and does not replace them. Pick a **Challenge**, then choose **Save bot
protection**:

- **Use Udibo's Turnstile account** appears only when Udibo provides a shared
  challenge, and is what a tenant that has saved nothing gets. It is
  monitor-only: a failed challenge is recorded, never refused.
- **Use my own Turnstile keys** takes the **Site key** and **Secret key** from
  your Cloudflare account. A failed challenge is refused under **Enforce** and
  recorded under **Monitor**. **Fail open if Turnstile is unreachable** is on by
  default; turn it off to refuse requests during a Turnstile outage instead.
- **No challenge** shows no widget and runs no check.

The secret key is sealed and never shown again; leave it blank to keep it.
Switching challenge keeps your keys; **Remove saved keys** deletes them once
unused. A refused challenge gets the form's usual refusal, so it reveals nothing
about the account. Redeeming a waitlist invitation skips the challenge.

## New-device sign-in notices

There is no setting for these. Udibo remembers the browsers an account signs in
from with the [`device_id` cookie](https://www.udibo.com/docs/identity/cookies)
and records `auth.new_device.detected` when a sign-in comes from one it does not
recognize; an account's first device is remembered silently. Emailing the person
about a new device is off by default and cannot be turned on per tenant.

## Change policies through the API

The management API's `PATCH /api/identity/tenants/{id}` accepts
`passwordPolicy`, `lockoutPolicy`, `sessionPolicy`, and `protectionMode`, merged
into the stored settings. Bot protection has no API. Today you reach these
settings through the dashboard; see
[choose the right API](https://www.udibo.com/docs/identity/apis#the-management-api).

## Limits today

- The sign-in rate limit counts per identifier. There is no configurable limit
  per IP address on password sign-in.
- Lockout guards password sign-in only. A locked account can still sign in with
  an enabled email code, email link or social provider.
- No dashboard control lifts a lockout, and setting a temporary password from
  the user's page does not clear one.
- Turnstile is the only bot-protection provider, and Udibo's shared challenge
  never refuses a request.
- The fixed email limits are not configurable.

Next: [manage users](https://www.udibo.com/docs/identity/users),
[set up MFA](https://www.udibo.com/docs/identity/mfa), or work through the
[production checklist](https://www.udibo.com/docs/identity/production).

_Last verified 2026-09-29._