Support

Hi Nicholas,

Can you clarify what triggers the suspicious activity email and whether or not there are settings to adjust its behavior? This does not seem to be in the email templates and it is unclear whether the terms in the documentation regarding "blocked requests" apply to this since the email for too many failed logins appears to be a different email.

We just started having end users login. I expected some failed login attempt issues, but this was the only issue so far. Not sure what triggered it.

Good point about the log. Thanks. I think what I was looking for is some clarity on configuration issues. I have not needed to deal with large numbers of users with logins on Joomla while using Admin tools before. When I go over the documentation, it is not entirely clear to me where some triggers are. For example, 3 logins within 1 minute gets blocked. That makes sense and it is configurable.

Is there anywhere else where X number of failed logins, can also trigger a suspension? I was trying to figure out whether I had a couple of people actually try to login that fast, or if the issue was something else. In particular, one client got the rescue URL and not the "you look suspicious" response. I think the latter is the response you get for 3 tries within 1 minute, correct? So what triggers the "you got blocked" and "here is how to get a rescue link" email? I am certain this person was not trying to hack the site, fake an admin login, or trying to get into the back end.

The log did not really shed any light on this and I did not find another failed login configuration setting besides the X number of times within 1 minute setting. The documentation talks about blocked requests, but is that only logins or are other types of blocked requests included?