# Block repeated failed logins and spam

To block repeated failed logins, open Manage Domain(s), expand your domain, click Policy and use the LIMITS FOR box. Switch on the failed-attempts rule, enter the number of attempts and the minutes to block, then click Save. Two more rules block logins for a time you choose and stop users who send too much spam.

## How to block repeated failed logins and spam

1. Open **Manage Domain(s)**, expand your domain and click **Policy**.
2. In the **LIMITS FOR** box, switch a rule to **Yes**. Its number boxes become active.
3. Enter the numbers. For the failed-login rule, fill the number of attempts and **For(Min)**.
4. To block logins at a set time, pick the date and time with the calendar button and fill **For(Min)**.
5. Click **Save** at the bottom of the page.

## The three rules

| Rule | Fields | What it does |
|---|---|---|
| **Block user login for accounts that exceed a number of failed login attempts** | Switch, number of attempts, **For(Min)** | Blocks a user's login for the minutes you enter once they exceed the number of failed attempts. |
| **Block user login from** | Switch, **Date & Time** with a calendar button, **For(Min)** | Blocks logins from the date and time you pick for the minutes you enter. The date box starts with the current date and time. |
| **Block user to send email (smtp-out service) if spam exceeds** | Switch, a percentage | Blocks a user from sending mail when that share of the mail they sent that day is spam. The label reads "% out of his daily emails sent". |

## Example

> Anita at `acme.in` sees repeated wrong-password attempts on the accounts team mailboxes. She switches the failed-login rule to **Yes**, enters 5 attempts and 30 minutes, and clicks **Save**. A person who keeps guessing is locked out for 30 minutes.

## Good to know

- The attempt, minute and percentage boxes accept numbers only, and the attempts and minutes must be greater than zero.
- A rule that is **No** is not applied, and its boxes stay greyed out.
- These limits apply to everyone in your domain. They do not replace a strong password rule, see the password policy page.

## Common questions

**What happens if I leave a number box empty while the switch is Yes?**

A message asks you to fill it and nothing is saved. The numbers must be whole numbers greater than zero.


Source: https://docs.xgenplus.com/admin/login-block-limits/