Each rule has its own window, failure limit and lockout duration, and can apply only to certain networks or countries. Exemptions by user, group, profile, network or country, with a validity period, are never blocked. The Dashboard shows the attempts of the last 24 hours and the 10 IPs, users and countries with the most failures over the week; the Test tab simulates an attempt without saving anything.

Behind a reverse proxy or Cloudflare, the user's real IP is only read through the proxies you declare, and the "This request's IP" card shows the result before you turn protection on. Protection ships disabled and the sample rules inactive. The username is never stored in clear text: only an HMAC for correlation and a mask on screen. Each rule chooses the channels where it counts: on password recovery every request counts, by IP or by e-mail; on CalDAV only wrong passwords become events. The GLPI 11 and 12 MFA code shows up in the events and keeps GLPI's own limit; SSO is out of scope.