Settings.yaml

AE:
  BruteForce:
    # Failed login attempts threshold (account locking)
    failedAttemptsThreshold: 5

    # Notification mail on account locking
    notificationMail: # Available variables "domain", "ip", "userAgent", "accountIdentifier", "failedAttemptsThreshold", "time"
      from:
        email: 'noreply@{domain}'
        name: 'Brute-force prevention - {domain}'
      to: # String or array of recipients (optional)
      subject: 'Account disabled due to failed login attempts - {domain}'
      message: |
        The account "{accountIdentifier}" has been deactivated at {time} on "{domain}" due to exceeding failed login attempts limit ({failedAttemptsThreshold})

        The last failed login came from "{userAgent}" on the following IP address: {ip}