About this block

Locked Account Page is the temporary lockout state, the Acme lockup above a padlock icon, the heading Account temporarily locked, the duration stated in weight (15 minutes from the last attempt), a Reset your password instead button for the user who does not want to wait, the reassurance that a reset link arrives at the registered address within a minute, and a security note below the card: we lock accounts after repeated failures to protect you and the real account owner is never permanently locked out because a password reset always works. A not-you line links to security@acme.com.

The block is static; the 15-minute figure is the only number users need and it is the one most auth pages omit. The permanent-lockout reassurance is the line that stops the security-conscious user raising an urgent ticket.

When to use

Reach for this block as the full-page response to a lockout event, shown after your auth system exceeds the failed-attempt threshold. Wire the Reset button to your password reset flow and pass the obfuscated address to the confirmation step.

A natural flow around it on an Application Pro page:

Before

• Nothing, lockout pages are shown in place of sign in

After

• Sso login page
• Verify email page

What you can display

One strong use is the brute-force lockout page. Other variants:

• Countdown timer. Show the remaining lock time live so the user knows exactly when to retry.
• Suspicious activity warning. Extend the note when the pattern looks like a credential stuffing attack rather than a forgotten password.
• Admin unlock. An additional call to action for workspace admins who can unlock from their panel.

Tip: state the lockout duration explicitly, an indefinite lock with no information is the fastest way to lose a legitimate user to a competitor.