Permissions and roles

• Viewing Settings → Security needs the View security permission.
• Adding or removing blocked IPs needs Manage security.
• Changing the lockout numbers is done on the module's Configure screen in Settings → Modules, which needs permission to manage modules.
• When the module is off, the Security page is hidden. The login lockout still protects every account using the defaults (10 attempts, 1 minute).