Wrong client sign-ins are limited wherever they come from: the sign-in page, the cart and the client API.
- Sign-in
- After 5 wrong attempts for one account, or 20 from one address, within 15 minutes, every attempt is refused, even with the right password, until the 15 minutes pass.
- Getting back in
- Setting a new password through the reset email lifts the limit at once.
- Reset emails
- At most 3 per address and 10 per visitor in 15 minutes. Past that, the page looks the same and sends nothing.
Nobody is banned for longer, and nothing on screen tells a limited attempt from a wrong one. Repeated failed administrator sign-ins ban the address; bans are listed and removable under blocked addresses.
Point monitors elsewhere
An uptime check that hits the administrator sign-in page counts as failed sign-ins and can ban your own office.
Full guide
The complete reference is Sign-in and password-reset limits in the WBAMS documentation.