Login & Auth Issues

Locked out of the admin, or something odd happening with your sessions? This page covers the common access problems and how each one is fixed. In every case the static site keeps running; these issues only affect access to the admin interface.

“Too many attempts, please try again later”

Too many failed logins from an IP address trigger escalating lockouts that persist over restarts:

After 5 failures: 60 second wait
After 10 failures: 5 minute wait
After 20 failures: 30 minute wait

The counter is per IP address, so several people behind one office or VPN share it. A successful login clears it, and stale attempt records fade away on their own. Every attempt (success, failure, or blocked) is recorded in the Auth Log tab on the Health page, and per-user login history is reachable from the Users pages.

You can also turn on alerts: when the Security tab’s failure threshold (default 20) is reached within 10 minutes, an error event is logged, and the first such event in any hour emails the address set for build notifications.

It says “Invalid credentials”, but I’m typing the right password

That message covers several situations:

Suspended account. Suspension also revokes any existing sessions. The login attempt is logged as blocked.
Password expired. If password expiry is enabled (Settings → Security), an old password no longer logs you in: you are sent to your Account page with “Your password has expired. Please change it now.” Set a new one there.
Wrong password: deliberately indistinguishable from an unknown username, and both give a short delay before the error is shown.

I lost the admin password

From the server shell, run perl bin/reset-admin.pl [username] (default: the lowest-numbered admin). The target account returns to the placeholder state, and the next request to the admin is redirected to /setup, which is where you set the new password. Once you complete setup, that page disappears (404); this is the expected behavior, and it does not recur unless the account is reset again. Setup requires a password of at least 12 characters with uppercase, lowercase, and a digit; you also choose UI language and initial languages there.

Forgotten password, self-serve (email must be configured)

The login form’s forgot-password option emails whoever owns the username or email address a reset link, valid for 24 hours. The reply is deliberately always “If an account with that username or email exists, a reset link has been sent.”; so someone fishing through usernames can’t tell whether an account exists. Each new reset request invalidates older ones, and each link works only once and only before its 24-hour expiry. If it says the link is invalid or expired, ask for a new one.

Your session was invalidated

Visiting /admin could suddenly land you on /login with “Your session was invalidated. Please log in again.” That happens when a session is revoked server-side; at issue:

session lifetimes: 8 hours by default, or 30 days if the login form’s “Remember me” was checked
changing your password invalidates sessions that opened with the old password; your current one survives
on your Account page you can invalidate your sessions, which keeps your current one and removes older ones
an admin can revoke a specific user’s sessions individually or invalidate all of a user’s sessions at once, except for their own, which must be managed from their Account page

Sessions record the IP and browser user agent with each login, so suspect activity can be reviewed on the user’s sessions and auth-log pages.

Fresh installs that can’t get in

A new install ends up in the same state as a reset password: the placeholder admin can’t log in until /setup has been run once, replacing the placeholder (after that, /setup returns 404).

If none of this matches, remember the lockout counter is per IP address: several people signing in behind one shared office IP or VPN can lock each other out, and the Auth Log tab shows which IPs were blocked.