Multiple invalid login attempts: why you're being slowed down and how to fix it

Your WebOké Nextcloud keeps track of how often someone logs in with the wrong password from a particular internet address (IP address). If that happens too often, every further attempt from that address is slowed down. This stops a hacker from trying thousands of passwords in a row. Unfortunately, you'll also notice this if one of your own apps keeps sending the wrong password.

How do you notice it?

• Logging in through the browser takes a long time, sometimes up to half a minute per attempt.
• You see a message saying that multiple invalid login attempts have been detected and that your next login will be delayed, or: The maximum number of failed login attempts from your location has been reached. Please wait 30 seconds and try logging in again.
• Apps on your phone or computer show errors such as 401 or 429 (Too Many Requests), or stop synchronising.
• The problem affects everyone on the same network, for example at home or at the office, but not when you use your phone on 4G or 5G.

Where does it come from?

Almost always, it's a device in your own home or office that keeps trying an old or incorrect password without you noticing. For example:

• the calendar or contacts on a phone or tablet that still has your regular password instead of an app password;
• Thunderbird or Outlook with an old app password that you've revoked;
• an old laptop or phone belonging to a housemate or colleague with an account that no longer exists;
• a network drive, NAS, or backup program with outdated login details;
• someone who mistyped their password a few times.

How to fix it

1. Find the culprit. Go through the devices on your network and check which app shows an error or keeps asking for a password. You'll find a step-by-step guide in IP address throttled by an old app: which one is it?.
2. Enter the correct password in that app. Always use an app password for calendar, contacts, and other apps (App passwords: when and how to use them). Or remove the account from an app you no longer use.
3. Have the slowdown lifted. You can do this in two ways:
   • Ask the AI assistant in My WebOké. It checks whether your Nextcloud is really slowing down the internet address you're currently connected from, and shows a card with the details. Only when you click Approve and carry out is the slowdown lifted for that one address. So do this from the network where the problem is occurring.
   • Or contact WebOké support. This isn't available with Nextcloud Free; in that case, use the AI assistant or wait for the slowdown to ease off on its own.
4. Or wait. The slowdown eases off on its own once there have been no further incorrect attempts for a while. As long as the faulty app keeps trying, it will keep coming back.

Please note: Lifting the slowdown without removing the cause will only help briefly. If an app somewhere is still using the wrong password, you'll be slowed down again before long.