# Clarification on brute force protection velocity

**URL:** <https://community.auth0.com/t/clarification-on-brute-force-protection-velocity/105656>\
**Category:** Get Help\
**Tags:** attack-protection, brute-force-protection\
**Created:** [April 27, 2023, 3:31pm UTC](https://community.auth0.com/t/clarification-on-brute-force-protection-velocity/105656 "2023-04-27T15:31:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jo.humphrey](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jo.humphrey](https://community.auth0.com/u/jo.humphrey)\
**Post date:** [April 27, 2023, 3:31pm UTC](https://community.auth0.com/t/clarification-on-brute-force-protection-velocity/105656/1 "2023-04-27T15:31:22Z")

</div>

Hi there,

In the [docs on Attack protection](https://auth0.com/docs/secure/attack-protection), there is a summary about brute force protection that I think is a bit unclear:

`Brute-force Protection: **Velocity** of login attempts from an IP for a particular account. Detects when a bad actor tries to login to an account too many times within a period of time.`

As velocity is change over time, I think the missing piece of information here is what period of time the login attempts are measured over. As far as I’m aware, the threshold of attempts can be configured, but not the time period, so it would be useful to know what the default time window is.

I saw in another community topic that “The incorrect attempt count reset will be triggered only after the user has successfully logged in”, so this implies that the time window is actually infinite - i.e. it doesn’t matter how long the user takes, but if they consecutively fail to log in up to the threshold number of attempts, they will be blocked regardless of the time period.

Could you clarify what the time period is?

Many thanks,  
Jo

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [May 2, 2023, 7:51pm UTC](https://community.auth0.com/t/clarification-on-brute-force-protection-velocity/105656/3 "2023-05-02T19:51:59Z")

</div>

Hi @jo.humphrey,

The [30 day limit for blocks](https://auth0.com/docs/secure/attack-protection/brute-force-protection) should also apply to the failed attempt counts. i.e. 30 day period for failed attempts.

Hope that helps!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [May 16, 2023, 7:52pm UTC](https://community.auth0.com/t/clarification-on-brute-force-protection-velocity/105656/5 "2023-05-16T19:52:51Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.