Sign-in security

To protect mailboxes on this service, sign-in is monitored for abuse. Most people never notice these checks. This page explains what you may see and why — without listing internal thresholds.

What we do at sign-in

• Failed sign-in attempts are tracked. After repeated failures you may be asked to complete a captcha.
• Continued failures from the same network address can temporarily block webmail sign-in from that address.
• A mailbox that receives many wrong passwords in a short time — including attempts from several places — can be temporarily locked to slow password guessing.
• Unusual device or location changes may require an extra captcha before you continue. Signing in from a computer or phone you already use is not treated as unusual.
• Very heavy traffic against the sign-in pages can trigger short protective limits for that visitor.
• When many failures happen across the service at once, captcha may be required more often for everyone until things calm down.

Why you might be blocked

Common causes include mistyped passwords, password managers retrying old credentials, shared Wi‑Fi or VPN addresses used by others, automated scanners probing the login page, or someone else trying to guess a password for your mailbox.

A temporary block is protective. It does not always mean your password was changed or that your account was deleted.

What to do

• Wait a short while and try again carefully with the correct password.
• If you see a captcha, complete it before submitting the form.
• Avoid rapid repeated tries; each failure can lengthen the delay.
• If you remain locked out and need access urgently, contact your administrator or support channel for this service.

What this page does not list

Exact attempt limits, timers, and technical controls are not published here. Sharing those details would help attackers tune automated guessing. The protections above are real; only the fine print stays internal.

After you sign in

A lock icon in the browser only covers the path from your device to this webmail site. Mail still travels again from webmail to IMAP (reading) and SMTP (sending). Signed-in users can open Options → Connection Security to see whether those hops are encrypted, which login method the mail server advertised, and which method this session used.

• The mailbox password stays in the webmail server session. It is not stored in a browser cookie.
• LOGIN or PLAIN over TLS is still secure: TLS encrypts the entire session, including the password. If the mail server offers SCRAM, webmail can use it so the password is not sent even inside that tunnel. You can turn that on or off on Connection Security.
• IMAP can use implicit TLS (port 993) or STARTTLS (port 143). SMTP can use STARTTLS (587) or implicit TLS (465). SASL PLAIN is available when the LOGIN command is disabled. LOGIN or PLAIN without TLS is the insecure case.
• Remote pictures in HTML mail stay off the network unless you allow them. SVG attachments are blocked for download unless you trust that message (Show remote images or an Unsafe Image Rule). Junk folders stay blocked.

Return to login