Module Configure screen (Settings → Modules → Security → Configure)
| Setting | Default | What it does |
|---|
| Max Login Attempts | 10 | Wrong passwords allowed for one email or phone before it is locked. |
| Lockout Duration (minutes) | 1 | How long the account stays locked. |
| Enable 2FA | — | No effect. Use the Two-Factor Authentication module. |
Settings → Security → Blocked IPs
| Field | What it does |
|---|
| IP Address | One address or a range such as 203.0.113.0/24. |
| Reason | Your note. |
| Expires In | Hours until the entry expires. Empty = permanent. |
The list is not enforced yet.
