When a customer entered incorrect email and password 6 times, customer account is locked.That time api is showing error Unauthorized access. After lock_expire_time customer account is not unlocked, why? Anybody tell me.


Once your Magento backend url is known by a robot, the robot can hit this url with random data from a dictionary.

If the random attack from the robot happens to have a valid username but incorrect password, the robots would lock the user so that no harm is done with this user.

Also, the user could still use his backend access let's say the following day without having to go in the database and change the lock for instance. Overall, the robot attack would be stopped.

If you do want to unlock your user though, the sql below should enable your access again:

update admin_user set failures_num=0,first_failure=NULL,lock_expires=NULL where username='<username>';
  • I didn't understand your answer. – Lovely Setia Jun 15 '18 at 5:47
  • Please tell me how to change the lock instance. – Lovely Setia Jul 11 '18 at 4:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.