Security Settings

Use Security Settings to configure administrator access IPs, login protection, device approval, whether administrator two-factor authentication is required, and general API limits. Related settings are grouped into eight cards and saved from one screen.

Before you begin

Required role: an administrator with permission to manage security settings

Open Security Settings

Open the administrator page.
Select Security Management in the left menu.
Select Security Settings.

You can also find a card or field with Search menus and settings in the header. Selecting a settings result opens its card and briefly highlights the destination.

Security Settings

Select the arrow on a card to expand its settings. Collapsed cards summarize the current values.

Card	Related settings
`IP Access Restriction`	IP addresses and ranges allowed to access administrator pages
`Security controls and alerts`	Overall security filter and administrator alerts
`Login protection`	Failure counts, time windows, block durations, and repeat or distributed detection
`Sign-in from a new device`	Allow, notify, or approve sign-ins from new devices
`Administrator two-factor authentication`	Whether every administrator must use authenticator app two-factor authentication, and your own two-factor status
`Login request rate limiting`	Bursts of sign-in requests
`General API requests per IP`	Sustained general API requests and temporary bursts
`Login exceptions and shared networks`	Login protection exceptions and networks shared by multiple users

IP Access Restriction

Restrict which IPs can access administrator pages. Enable Enable IP Access Restriction and check that the allow list includes your current IP. See IP Access Restriction for editing, saving, and lockout precautions.

This list is separate from login exceptions. A login whitelist entry does not grant access to administrator pages.

Security controls and alerts

Enable Overall Security Filter turns login security checks and automatic blocking on or off. It is enabled by default. Turning it off stops blocking based on login failures, sign-in request limits, and pattern detection. Failed sign-ins are still recorded.

Administrator IP restrictions, new-device login policy, and general API limits are independent of this toggle. Configure security alerts inside this card.

Item	Default · allowed range	Description
`Enable Admin Notification`	On	Enable real-time administrator notifications for security events.
`Notification Threshold`	50 · 1–100000	Send a warning when failures reach this count within the failure time window. Matching warnings are grouped into ten-minute intervals.

Automatic blocks generate alerts regardless of the threshold. New-device login notifications are independent of this alert setting.

Security controls and alerts

Configure failure counts, the counting period, and block durations in the same card. Choose whether recently used locations are exempt from account lockout.

Item	Default · allowed range	Description
`Max Failed Attempts per User`	5 · 1–100	Temporarily lock an account when its failed sign-ins reach this count.
`Failures per IP and Login ID`	5 · 1–100	Failure threshold for the same login ID from the same IP.
`Max Failed Attempts per IP`	50 · 10–10000	Total failed sign-ins allowed from one IP.
`Max Failed Attempts per Fingerprint`	15 · 1–1000	Failure threshold for the same device fingerprint.
`Exempt recently used locations from account lockout (recommended)`	On	Exempt IPs with recent successful sign-ins from account lockout. The IP and login ID limit still applies.
`Recent sign-in period (days)`	30 · 1–365	Number of days a successful sign-in counts as recent. Enable the exception above to edit this value.

Failure time window and block duration

Item	Default · allowed range	Description
`Failure Time Window`	60 · 1–1440	Period in minutes used to count failed sign-ins.
`Block Duration`	30 · 1–10080	Base block duration in minutes, up to seven days.

Repeat blocking and advanced detection

Expand Repeat blocking and advanced detection to configure progressive blocking, pattern detection, and failures across multiple IPs. Progressive blocking and pattern detection are enabled by default. Turning off either toggle disables its numeric fields.

Item	Default · allowed range	Description
`Progressive Block Multiplier`	2 · 1–10	Multiplier for repeated blocks. Enter increments of 0.1.
`Max Block Duration`	24 · 1–720	Maximum progressive block duration in hours, up to 30 days.
`Suspicious Pattern Threshold`	20 · 2–10000	Block when failures from one IP reach this count and involve more than ten IDs or more than five User-Agents.
`Max Failed Attempts per User-Agent`	30 · 5–10000	Threshold for failures by the same User-Agent across multiple IPs.
`Minimum IPs per User-Agent`	3 · 2–1000	Distinct IP count required for a User-Agent block.

Progressive duration is block duration × multiplier^(previous automatic block count) and cannot exceed the maximum duration. A User-Agent identifies a browser or app. Common browsers and trusted official apps are excluded from the User-Agent failure count.

Repeat blocking and advanced detection

Choose how to handle sign-ins from unfamiliar devices. The default is No control.

Option	Behavior
`No control`	Do not require device approval. Account status and other sign-in protection conditions still apply.
`Allow and notify`	A sign-in from an unfamiliar device is allowed but recorded in the administrator security alerts and the auth log.
`Administrator approval required`	Only administrator-approved devices can sign in. Other devices are added to the approval queue.

Select Administrator approval required, then apply it with Save in the top-right corner. This option can be selected on Team or higher. Approve or deny requests under Needs your attention on administrator Home or Security Management > Devices awaiting approval. For the detailed procedure, see Process pending device approvals.

Regular accounts need approval for their first device and when signing in from a whitelisted IP.
Devices automatically registered under No control or Allow and notify also need explicit administrator approval after approval mode is enabled.
The owner and full administrators are exempt so they can recover the policy.
Behind a reverse proxy, check that the actual client IP is passed through. Neither an IP whitelist entry nor the availability of the client IP exempts regular accounts from device approval.

Sign-in from a new device

Administrator two-factor authentication

Turning on Require two-factor authentication for administrators means every administrator account must set up authenticator app two-factor authentication. The default is off. Administrators who have not set it up are sent to the setup screen after they sign in and cannot use the administrator pages, files, or live connections until they finish.

The My two-factor authentication section of the same card shows the status of your own account. If the administrator turning on the policy has not set it up yet, select Open setup first and set it up for your own account. For the setup procedure and recovery options, see Set up administrator two-factor authentication.

Limit bursts of sign-in requests. This is enabled by default. Turning it off disables the numeric fields in this card.

Item	Default · allowed range	Description
`Rate Limit Window`	60 · 1–3600	Period in seconds used to count sign-in requests.
`Requests per IP and Login ID`	10 · 1–1000	Requests allowed for one IP and login ID combination.
`Total Requests per IP`	120 · 10–10000	Total sign-in requests allowed from an IP that is not an internal shared network.

General API requests per IP

Configure per-IP throughput for general APIs, including file WebSocket connection requests. These limits are independent of login protection and Webspace concurrent connection limits.

Item	Default · allowed range	Description
`Sustained requests per second`	60 · 10–10000	General API requests continuously allowed from one IP.
`Burst requests`	300 · 20–100000	Requests temporarily allowed when loading initial data. Set this to at least the sustained per-second rate.

With office NAT, initial loads from multiple users and tabs can share one IP. Account for temporary bursts and adjust using actual peak traffic and HTTP 429 metrics.

General API requests per IP

Use each list’s add button to add an entry and its trash icon to remove one. Enter an IP such as 203.0.113.10 or a CIDR range such as 203.0.113.0/24. Blank rows are removed when saving. The defaults below are used by Reset to Defaults; an existing empty saved list is not filled automatically.

Item	Default · allowed range	Description
`Whitelist IPs`	`127.0.0.1`, `::1`	Sign-ins from these IPs or CIDR ranges bypass login protection checks.
`Whitelist Users`	—	Sign-ins by these usernames bypass login protection checks.
`Shared Corporate Networks`	—	Relax total IP request limits and IP or fingerprint failure limits. Account lockout, IP and login ID, User-Agent, and pattern checks still apply.

Register only the required shared office IPs or ranges as Shared Corporate Networks. The administrator page allow list is managed separately.

Save or reset to defaults

Select Save in the top-right corner.
Select Confirm in the dialog.
Check the completion message and that the unsaved-changes indicator has disappeared.

Save changes from one screen without separate per-card save buttons. Out-of-range numbers show guidance below the input. A validation error opens the affected card and advanced section and moves focus to the field to correct.

If IP restriction saving fails, read the failure message and save the remaining changes again. A partial-save message appears if the other security settings were saved first.

Select Reset to Defaults and confirm to change the values on screen. This also disables IP restriction and clears its allow list. Select Save again to apply the reset.

An indicator appears while changes are unsaved. Navigating to another page asks whether to discard them. Canceling keeps your current edits.

Good to Know

Low failure thresholds can block users who have forgotten their passwords. Review the scope of Exempt recently used locations from account lockout (recommended).
Add only the IPs and users that need a login exception. A login whitelist does not bypass new-device approval or administrator IP restrictions.
After saving, use a regular test account to check failed sign-ins, new-device approval, and unblocking.
Run Security Test in Security Overview checks your current session. Check regular accounts and external connections separately.
Review and remove existing blocks under Block Management.

← Previous

Block Management

Process pending device approvals