If someone enters the wrong password too many times in a row, OrangeHRM temporarily blocks further logins for that username from that network. By default, this happens after 10 failed attempts and lasts 1 hour. The block lifts on its own, after which the user can log in with the correct password. Resetting the password does not lift the block early.
Why this happens
This is a security feature that protects accounts from password-guessing attacks. OrangeHRM counts consecutive failed logins for each username from each IP address, which identifies the network the attempts come from. When the count reaches the limit, logins for that username from that IP address are blocked for the set period. While the block is active, even the correct password is rejected, and the user sees a message that access is temporarily restricted.
If the user has a work email on their profile, OrangeHRM also sends an email with the subject Access to your account has been temporarily restricted. The email states the IP address and when the restriction will end.
This often happens just after a password reset. The user keeps trying an old or saved password, either by typing it or because the browser or a password manager fills it in automatically, until they reach the limit.
What you can do
- Wait for the restriction period to pass. By default, this is 1 hour from the last failed attempt. Check the restriction email for the exact time.
- Before trying again, clear any saved or autofilled password for OrangeHRM in the browser or password manager.
- Log in with the correct, current password. A successful login resets the failed-attempt count.
- If you are not sure of the password, use Forgot your password? on the login page to set a new one. Then wait for the restriction to end before you log in.
- If the user still cannot log in after the period ends, ask an admin to check the account under HR Administration > Users. The status should be Enabled and the employee should not be terminated.
Things to note
- The block applies to the username together with the network it was used from. It is not the same as a disabled user account, and an admin does not need to re-enable anything.
- An admin changing or resetting the user's password does not end the block early.
- After a few failed attempts, and before the block, the login page may ask the user to complete a CAPTCHA.
- Your system may use a different number of attempts or block duration. If you need these settings changed, contact OrangeHRM Support.