HappyFox includes built-in login security features that help protect your help desk from unauthorized access.
Both features apply to agents and contacts:
Account Lockout
If an agent or contact enters incorrect login details 5 times in a row, HappyFox locks their account for 60 minutes. The login screen shows how many attempts remain before the lockout begins.
Failed agent login
Failed contact login
When an account is locked, HappyFox emails the agent or contact who was locked out. The email lists the following details for their last successful login and their last 5 failed login attempts:
- Date and time
- IP address
- Location
- Browser
- Operating system
A locked-out agent or contact can either:
- Wait 60 minutes for the lock to be released automatically, or
- Send an automated request asking the admins to unlock the account manually.
Note: A lockout doesn't end sessions that are already active. It only blocks new login attempts, including logins through SSO.
Unlock request option for contacts
Unlock request option for agents
Unlocking an Agent Account
Available to agents whose role has the Unlock Agent managerial permission.
Go to Main Menu > Manage > Agents. Locked-out agents have a lock icon next to their name. Click Unlock and confirm. The agent then receives an email letting them know an admin has unlocked their account.
Unlocking a Contact Account
Available to agents whose role has the Unlock Contact managerial permission.
In the Contacts list, locked-out contacts have a lock icon next to their name. Open the contact's details page and click Unlock.
Lock icon in the Contacts list:
Unlock option on the contact details page:
Who Receives Lockout Notifications?
When an agent or contact is locked out, HappyFox emails the admins, along with any manual unlock request the user sends. Who receives these emails depends only on role permissions:
- Agent lockouts go to every agent whose role has the Unlock Agent permission.
- Contact lockouts go to every agent whose role has the Unlock Contact permission.
There's no separate notification list or subscription setting for these emails.
Stop an Agent from Receiving Lockout Notifications
To remove someone from lockout notifications:
- Go to Main Menu >> Manage >> Roles and Permissions and open the agent's role.
- Under managerial permissions, clear Unlock Agent, Unlock Contact, or both.
- Save the role.
If other agents share that role and should keep receiving these emails, create a new role without these permissions (or copy the current role and remove them). Then assign the new role only to the agent you're removing.
Note: Removing these permissions also removes the agent's ability to unlock accounts. An agent can't keep the unlock ability while opting out of just the emails.
Add an Agent to Lockout Notifications
Go to Main Menu >> Manage >> Roles and Permissions and turn on Unlock Agent, Unlock Contact, or both for the agent's role.
Frequently Asked Questions
Several of us get an email when a user is locked out. How do I remove one person?
Remove the Unlock Agent and Unlock Contact permissions from that person's role, or move them to a role that doesn't have them. See the steps above.
Why am I getting lockout emails?
Your role has the Unlock Agent or Unlock Contact permission.
Can agent lockouts and contact lockouts go to different people?
Yes. Give Unlock Agent to the roles that should handle agent lockouts, and Unlock Contact to the roles that should handle contact lockouts.
CAPTCHA Verification
Along with the lockout, failed login attempts on both the agent and contact login pages trigger a CAPTCHA check. It's powered by Google reCAPTCHA, which uses risk analysis to block automated login attempts.
Note: The screenshot below shows invisible reCAPTCHA.
Successful CAPTCHA check on the agent login page
reCAPTCHA asking a contact to verify at login
