{"id":1371,"date":"2026-07-15T09:31:45","date_gmt":"2026-07-15T09:31:45","guid":{"rendered":"https:\/\/www.jolt.co.uk\/help\/identifying-and-troubleshooting-account-lockout-notifications\/"},"modified":"2026-07-15T09:31:45","modified_gmt":"2026-07-15T09:31:45","slug":"identifying-and-troubleshooting-account-lockout-notifications","status":"publish","type":"post","link":"https:\/\/www.jolt.co.uk\/help\/identifying-and-troubleshooting-account-lockout-notifications\/","title":{"rendered":"Identifying and troubleshooting account lockout notifications"},"content":{"rendered":"\n<p>Account lockouts can be confusing, especially when you receive a notification but don\u2019t know which system triggered it. <\/p>\n\n\n\n<p>This guide helps you identify the source of a lockout, review the relevant logs, and gather the right information before contacting support.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>1. Common Sources of Account Lockouts<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1.1 WordPress Security Plugins<\/strong><\/h3>\n\n\n\n<p>Plugins such as <strong>Wordfence<\/strong>, <strong>iThemes Security<\/strong>, <strong>All\u2011In\u2011One Security (AIOS)<\/strong>, and <strong>Limit Login Attempts Reloaded<\/strong> can block IP addresses after repeated failed logins.<\/p>\n\n\n\n<p>Typical triggers:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Incorrect WordPress admin password<\/li>\n\n\n\n<li>Bots attempting brute\u2011force logins<\/li>\n\n\n\n<li>XML\u2011RPC authentication failures<\/li>\n\n\n\n<li>Login attempts to invalid usernames<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1.2 Email Authentication Failures<\/strong><\/h3>\n\n\n\n<p>Mail servers block IPs after repeated failed logins to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IMAP \/ POP3<\/li>\n\n\n\n<li>SMTP (sending mail)<\/li>\n\n\n\n<li>Webmail<\/li>\n<\/ul>\n\n\n\n<p>Common causes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Incorrect password saved on a device<\/li>\n\n\n\n<li>A phone or mail client retrying with outdated credentials<\/li>\n\n\n\n<li>A compromised device attempting authentication<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1.3 cPanel \/ Plesk Login Protection<\/strong><\/h3>\n\n\n\n<p>Control panels include built\u2011in security systems such as <strong>LFD<\/strong> (cPanel) or <strong>Fail2Ban<\/strong> (Plesk).<\/p>\n\n\n\n<p>Triggers include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Incorrect cPanel\/Plesk login attempts<\/li>\n\n\n\n<li>Failed FTP\/SFTP logins<\/li>\n\n\n\n<li>Failed SSH logins<\/li>\n\n\n\n<li>Incorrect database credentials used by scripts<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1.4 Server-Level Security Tools<\/strong><\/h3>\n\n\n\n<p>Additional security layers may also exist on servers such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>ModSecurity<\/strong> (WAF)<\/li>\n\n\n\n<li>Config Server Firewall (CSF)<\/li>\n\n\n\n<li><strong>Fail2Ban<\/strong><\/li>\n\n\n\n<li>Sentry<\/li>\n<\/ul>\n\n\n\n<p>These may block IPs for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Suspicious HTTP requests<\/li>\n\n\n\n<li>Repeated 404\/403 errors<\/li>\n\n\n\n<li>Malicious URL patterns<\/li>\n\n\n\n<li>Excessive API calls<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>2. Checking WordPress Security Plugin Logs<\/strong><\/h2>\n\n\n\n<p>If your site uses WordPress, start by checking whether a plugin blocked your IP.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2.1 Wordfence<\/strong><\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Log in to WordPress (or ask another admin to do so).<\/li>\n\n\n\n<li>Navigate to <strong>Wordfence \u2192 Tools \u2192 Live Traffic<\/strong>.<\/li>\n\n\n\n<li>Look for entries marked <strong>Blocked<\/strong>, <strong>Failed Login<\/strong>, or <strong>Brute Force<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p>Check:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IP address<\/li>\n\n\n\n<li>Reason for block<\/li>\n\n\n\n<li>Username attempted<\/li>\n\n\n\n<li>Timestamp<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2.2 iThemes Security \/ AIOS \/ Other Plugins<\/strong><\/h3>\n\n\n\n<p>Logs are typically found under:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Security \u2192 Logs<\/strong><\/li>\n\n\n\n<li><strong>Tools \u2192 Logs<\/strong><\/li>\n\n\n\n<li><strong>Dashboard \u2192 Security Events<\/strong><\/li>\n<\/ul>\n\n\n\n<p>Look for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Failed logins<\/li>\n\n\n\n<li>Lockouts<\/li>\n\n\n\n<li>IP blocks<\/li>\n\n\n\n<li>XML\u2011RPC failures<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>If you cannot access WordPress<\/strong><\/h3>\n\n\n\n<p>Your IP may already be blocked. Try:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Connecting via a different network (e.g., mobile hotspot)<\/li>\n\n\n\n<li>Asking another admin to unblock your IP<\/li>\n\n\n\n<li>Checking logs via the hosting file manager<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>3. Checking Email Authentication Logs<\/strong><\/h2>\n\n\n\n<p>If the lockout affects email services, review your mail logs or device settings.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3.1 Check your devices<\/strong><\/h3>\n\n\n\n<p>Common causes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A phone or laptop repeatedly retrying an old password<\/li>\n\n\n\n<li>Outlook\/Apple Mail stuck with outdated credentials<\/li>\n\n\n\n<li>SMTP plugins in WordPress using incorrect login details<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3.2 cPanel Email Logs<\/strong><\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Log in to cPanel.<\/li>\n\n\n\n<li>Go to <strong>Email \u2192 Track Delivery<\/strong>.<\/li>\n\n\n\n<li>Look for:\n<ul class=\"wp-block-list\">\n<li>Authentication failures<\/li>\n\n\n\n<li>Rejected logins<\/li>\n\n\n\n<li>SMTP errors<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3.3 Plesk Email Logs<\/strong><\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Go to <strong>Tools &amp; Settings \u2192 Mail Server Settings \u2192 Logs<\/strong>.<\/li>\n\n\n\n<li>Look for:\n<ul class=\"wp-block-list\">\n<li><code>authentication failed<\/code><\/li>\n\n\n\n<li><code>invalid login<\/code><\/li>\n\n\n\n<li><code>password mismatch<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p>Repeated failures from your IP indicate the likely cause.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>4. Reviewing cPanel \/ Plesk Access Logs<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>4.1 cPanel <\/strong><\/h3>\n\n\n\n<p>If you have WHM access:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Go to Config Server Firewall<\/li>\n\n\n\n<li>Use the Search IP to check if your IP has been blocked <\/li>\n\n\n\n<li>Unblock IP if listed <\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"295\" src=\"https:\/\/kb.jolt.co.uk\/wp-content\/uploads\/sites\/5\/2026\/07\/image-1024x295.png\" alt=\"\" class=\"wp-image-1372\" style=\"width:552px;height:auto\" srcset=\"https:\/\/kb.jolt.co.uk\/wp-content\/uploads\/sites\/5\/2026\/07\/image-1024x295.png 1024w, https:\/\/kb.jolt.co.uk\/wp-content\/uploads\/sites\/5\/2026\/07\/image-300x86.png 300w, https:\/\/kb.jolt.co.uk\/wp-content\/uploads\/sites\/5\/2026\/07\/image-768x221.png 768w, https:\/\/kb.jolt.co.uk\/wp-content\/uploads\/sites\/5\/2026\/07\/image-770x222.png 770w, https:\/\/kb.jolt.co.uk\/wp-content\/uploads\/sites\/5\/2026\/07\/image.png 1048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>If you only have cPanel access:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check <strong>Metrics \u2192 Errors<\/strong> for related entries and reach out to support.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>4.2 Plesk (Fail2Ban)<\/strong><\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Go to <strong>Tools &amp; Settings \u2192 IP Address Banning (Fail2Ban)<\/strong>.<\/li>\n\n\n\n<li>Review:\n<ul class=\"wp-block-list\">\n<li>Jail logs<\/li>\n\n\n\n<li>Banned IPs<\/li>\n\n\n\n<li>Authentication failures<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>5. Other Server-Level Logs<\/strong><\/h2>\n\n\n\n<p>Depending on your hosting environment, additional logs may be available:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>\/var\/log\/secure<\/code><\/li>\n\n\n\n<li><code>\/var\/log\/auth.log<\/code><\/li>\n\n\n\n<li><code>\/var\/log\/maillog<\/code><\/li>\n\n\n\n<li><code>\/var\/log\/messages<\/code><\/li>\n\n\n\n<li><code>\/usr\/local\/apache\/logs\/error_log<\/code><\/li>\n<\/ul>\n\n\n\n<p>Look for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>authentication failure<\/code><\/li>\n\n\n\n<li><code>invalid user<\/code><\/li>\n\n\n\n<li><code>password incorrect<\/code><\/li>\n\n\n\n<li><code>mod_security<\/code> blocks<\/li>\n\n\n\n<li><code>fail2ban<\/code> bans<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>6. What to Provide When Reporting a Lockout<\/strong><\/h2>\n\n\n\n<p>Providing complete information helps support resolve the issue quickly.<\/p>\n\n\n\n<p>Please include:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u2714 Your IP address<\/strong><\/h3>\n\n\n\n<p>Find it at: <a href=\"https:\/\/whatismyipaddress.com\">https:\/\/whatismyipaddress.com<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u2714 Approximate timestamp of the lockout<\/strong><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u2714 The service you were trying to access<\/strong><\/h3>\n\n\n\n<p>Examples:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WordPress admin<\/li>\n\n\n\n<li>Email (IMAP\/SMTP)<\/li>\n\n\n\n<li>cPanel\/Plesk<\/li>\n\n\n\n<li>FTP\/SFTP<\/li>\n\n\n\n<li>Webmail<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u2714 Any error messages or screenshots<\/strong><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u2714 Whether you recently changed a password<\/strong><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u2714 Whether multiple devices use the same login<\/strong><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u2714 Whether you checked WordPress\/email\/control panel logs<\/strong><\/h3>\n\n\n\n<p>Include what you found (or didn\u2019t find).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>7. Quick Reference Table<\/strong><\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Symptom<\/th><th>Likely Source<\/th><th>What to Check<\/th><\/tr><\/thead><tbody><tr><th>WordPress admin inaccessible<\/th><td>WP security plugin<\/td><td>Wordfence\/AIOS logs<\/td><\/tr><tr><th>Email stops working on all devices<\/th><td>Email auth failures<\/td><td>Mail logs, device passwords<\/td><\/tr><tr><th>cPanel\/Plesk inaccessible<\/th><td>cPHulk \/ Fail2Ban \/ CSF \/ LFD<\/td><td>Control panel access logs<\/td><\/tr><tr><th>Website loads but admin blocked<\/th><td>Plugin or ModSecurity<\/td><td>WP logs, Apache logs<\/td><\/tr><tr><th>Lockout after password change<\/th><td>Device retrying old password<\/td><td>Update all devices<\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Account lockouts can be confusing, especially when you receive a notification but don\u2019t know which system triggered it. This guide helps you identify the source of a lockout, review the relevant logs, and gather the right information before contacting support. 1. Common Sources of Account Lockouts 1.1 WordPress Security Plugins&hellip;<\/p>\n","protected":false},"author":8,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14,3,17,18],"tags":[],"class_list":["post-1371","post","type-post","status-publish","format-standard","hentry","category-access","category-cpanel","category-plesk","category-wordpress"],"_links":{"self":[{"href":"https:\/\/www.jolt.co.uk\/help\/wp-json\/wp\/v2\/posts\/1371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jolt.co.uk\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jolt.co.uk\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jolt.co.uk\/help\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jolt.co.uk\/help\/wp-json\/wp\/v2\/comments?post=1371"}],"version-history":[{"count":1,"href":"https:\/\/www.jolt.co.uk\/help\/wp-json\/wp\/v2\/posts\/1371\/revisions"}],"predecessor-version":[{"id":1373,"href":"https:\/\/www.jolt.co.uk\/help\/wp-json\/wp\/v2\/posts\/1371\/revisions\/1373"}],"wp:attachment":[{"href":"https:\/\/www.jolt.co.uk\/help\/wp-json\/wp\/v2\/media?parent=1371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jolt.co.uk\/help\/wp-json\/wp\/v2\/categories?post=1371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jolt.co.uk\/help\/wp-json\/wp\/v2\/tags?post=1371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}