# Does password reset clear user blocks?

**URL:** <https://community.auth0.com/t/does-password-reset-clear-user-blocks/162008>\
**Category:** Get Help\
**Tags:** user-password-management, user-management\
**Created:** [December 12, 2024, 7:56pm UTC](https://community.auth0.com/t/does-password-reset-clear-user-blocks/162008 "2024-12-12T19:56:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kmaloney](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kmaloney/32/44919_2.png) [@kmaloney](https://community.auth0.com/u/kmaloney)\
**Post date:** [December 12, 2024, 7:56pm UTC](https://community.auth0.com/t/does-password-reset-clear-user-blocks/162008/1 "2024-12-12T19:56:06Z")

</div>

I’m working on a custom solution to identify and clear blocked user accounts using the Auth0 SDK and would like to confirm some behavior I am seeing. It looks like when a user’s password is reset, that seems to also clear any user blocks that have been created by a “limit\_wc” condition.

That’s what empirical evidence shows, but I wonder if anyone here can confirm that it’s correct.

---

<div class="post-metadata">

**Author:** ![sumansaurav](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sumansaurav/32/70627_2.png) [@sumansaurav](https://community.auth0.com/u/sumansaurav)\
**Post date:** [December 12, 2024, 9:30pm UTC](https://community.auth0.com/t/does-password-reset-clear-user-blocks/162008/3 "2024-12-12T21:30:20Z")

</div>

In Auth0, when brute force protection is enabled:

- It tracks failed login attempts using this “limit\_wc” condition
- When users exceed the maximum number of failed attempts, their account gets blocked
- By default, the shield is triggered after 10 failed login attempts
- The default block duration is 600 seconds (10 minutes)

Password reset do appears to clear block created by (“limit\_wc”) condition in Auth0.

However, if blocks created due to Suspicious IP or admin applied blocks would remain in place even after a password reset.

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [December 12, 2024, 9:35pm UTC](https://community.auth0.com/t/does-password-reset-clear-user-blocks/162008/4 "2024-12-12T21:35:37Z")

</div>

Hi @kmaloney,

Yes, performing a password reset will remove the block that was enforced from brute force protection.

Our [When Do the Attempts for Brute Force Protection Reset](https://community.auth0.com/t/when-do-the-attempts-for-brute-force-protection-reset/141671) knowledge article mentions this.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 26, 2024, 9:35pm UTC](https://community.auth0.com/t/does-password-reset-clear-user-blocks/162008/5 "2024-12-26T21:35:55Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.