IP Ban
Block IP addresses from both panels: a main enforcement switch, automatic banning after failed logins, and a searchable list of banned addresses.
What IP Ban does
The IP Ban page lets you block individual IP addresses from reaching either panel, and to automatically block addresses that fail to log in too many times. It is your platform-wide network-edge defense: where reCAPTCHA stops abusive traffic at the login form, IP Ban stops it before a request ever reaches a sign-in page. The page has three sections stacked top to bottom: a main enforcement switch, automatic blocking on failed logins, and a searchable list of currently banned IPs.
How to reach it
Open Settings from the admin sidebar, then under the System group choose IP Ban. The tab sits next to Security and License.
The enforcement switch
At the top of the page is the IP Ban Enforcement card with a single on/off switch. When it is on, any address in the banned list below is blocked from accessing all panels. When it is off, bans are retained but not applied, so traffic flows normally even for addresses that appear in the list.
This switch saves the moment you flip it — there is no separate Save step for it. A green confirmation banner appears at the top of the page when enforcement is turned on or off.
Auto-Block on Failed Logins
The second card, Auto-Block on Failed Logins, automatically bans an address after it racks up too many failed sign-in attempts in a short period — the standard defense against password-guessing and credential-stuffing bots. It has its own on/off switch in the card header, plus three number fields. After changing any of these, click the Save button at the bottom-right of the card to apply them; a confirmation banner appears when the settings are stored.
Auto-block fields
| Field | What it controls |
|---|---|
| Auto-Block switch (card header) | Turns automatic banning on or off. When off, failed logins are still recorded but never trigger a ban. |
| Max Attempts | How many failed logins an address may make before it is automatically banned. Accepts a value from 1 to 20. |
| Ban (min) | How long an automatic ban lasts, in minutes. After this time elapses the ban expires on its own. |
| Window (min) | The rolling time window, in minutes, over which failed attempts are counted toward Max Attempts. Attempts older than this window no longer count toward the threshold. |
The three auto-block fields work together. With Max Attempts 5 and Window 15, an address is banned only if it fails five times within any fifteen-minute span; one stray typo every hour never trips it. Keep the Ban (min) value short enough that a genuine customer who fat-fingers their password is not locked out for the rest of the day.
The Banned IPs list
The bottom card, Banned IPs, lists every address currently banned — both the ones you added by hand and the ones the auto-block rule created. A search box filters the list by IP address or reason as you type. When the list runs longer than one page, use the arrows at the bottom to move between pages.
Columns in the list
| Column | Meaning |
|---|---|
| IP Address | The blocked address. |
| Reason | The note recorded when the ban was created (a dash if none was given). |
| Duration | The ban length chosen at creation — 6 Days, 1 Month, Permanent, or Auto-block for bans created automatically. |
| Expires | How much time is left before the ban lifts (shown as days/hours remaining), Permanent for bans with no end, or Expired once the time has passed. |
| Banned By | The staff member who created the ban, or System for bans the auto-block rule added. |
| Banned At | The date and time the ban was created. |
| Actions | Two icon buttons per row: an eye icon to view login attempts, and a trash icon to remove the ban. |
Manually banning an address
- Click the Ban IP button at the top-right of the Banned IPs card.
- In the Ban IP Address dialog, type the address into the IP Address field (for example,
192.168.1.1). - Choose a Duration from the dropdown: 6 Days, 1 Month, or Permanent.
- Optionally type a Reason so you remember later why the address was blocked. This field can be left blank.
- Click Ban IP to save. The new entry appears in the list immediately, and a confirmation banner shows at the top of the page.
Manual bans use coarse durations (6 Days, 1 Month, Permanent) because they are usually aimed at known bad actors, whereas auto-block bans are measured in minutes for short-lived brute-force bursts. A Permanent ban never expires on its own — it stays in place until you remove it.
Removing a ban
Find the address in the list (use the search box if needed) and click the trash icon in its Actions column. The address is unbanned right away and the row disappears. This works for both manual and automatic bans.
Reviewing login attempts
To understand why an address was flagged before deciding whether to keep or lift the ban, click the eye icon in its row. A Login Attempts dialog opens listing the sign-in attempts seen from that address, with these columns:
- Time
- When each attempt was made.
- The email address entered during the attempt (a dash if none was captured).
- Panel
- Which panel the attempt targeted — admin or client.
- Status
- Whether the attempt succeeded or failed, shown with a green check or a red cross.
Longer histories are paginated; use the arrows at the bottom of the dialog to page through them.
This view is the fastest way to tell a fumbling customer apart from an attack. A handful of failures all using the same real email is probably someone who forgot their password; dozens of failures cycling through many different emails is almost certainly a bot — leave that one banned.
Tips and notes
- The enforcement switch and the auto-block switch are independent. You can keep a manual blocklist active while leaving automatic banning off, or vice versa.
- Changes to the auto-block number fields only take effect after you press Save. The two on/off switches, by contrast, take effect the instant you flip them.
- If a legitimate customer reports being locked out, search their address in the list and remove the ban, or review their login attempts first to confirm it was a false positive.
- Auto-block bans appear in the list with System as the creator and Auto-block as the duration, so you can always distinguish them from bans your staff added.