What is the brute-force protection in Nextcloud?
The brute-force protection is a built-in Nextcloud security feature that shields your hosting.fr Managed Nextcloud from automated attacks in which attackers try to guess passwords or tokens through repeated attempts. It specifically protects the login page, the password reset function, and the generation of app tokens.
How does the brute-force protection work?
The protection works on a per-IP basis: if Nextcloud detects an unusually high number of failed login attempts from an IP address, further requests from that IP to protected entry points are deliberately slowed down for up to 24 hours. In concrete terms this means:
- Login attempts are progressively delayed after repeated failures (up to 25 seconds per attempt).
- After 10 failed login attempts within 30 minutes, Nextcloud responds with the HTTP status code 429 (“Too Many Requests”).
- After a successful login, the previous failed attempts for that IP are cleared.
- Individual entries expire automatically after 48 hours.
The brute-force protection is enabled by default on every hosting.fr Managed Nextcloud and works in the background without any action required on your part.
Recommendation
The brute-force protection is an effective first line of defence, but it does not replace strong passwords or two-factor authentication. We recommend that you additionally enable two-factor authentication (2FA TOTP) in your Nextcloud to protect access to your data as effectively as possible.