---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Limit Invalid Password Reset Attempts

# Limit Invalid Password Reset Attempts {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The password_reset.request.max_attempt is used to control the
maximum number of unsuccessful attempts that a user can reset or change their password before
being locked out for a specified period of time.
The password_reset.request.max_attempt system property dictates the maximum number of unsuccessful password reset attempts that can be taken before the user is locked out of password reset process. The
lockout period is determined by the value in password_reset.request.max_attempt_window.

Ensure that the property password_reset.request.max_attempt is set to <kbd class="ph userinput">3</kbd> or less.

## More information {#sc-reset-password-request-max-attempts__section_wc1_cqn_phc}

{#sc-reset-password-request-max-attempts__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | password_reset.request.max_attempt |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Integer |
| Recommended value | An integer less than or equal to 3 |
| Default value | \<none\> |
| Fallback value | 3 |
| Category | [Configure Password Reset properties](https://www.servicenow.com/docs/SL7exAv~f3AoiDhxqvnmoQ "You can specify properties that configure the Password Reset experience for end users.") |
| Security risk | * Severity score: 7.5 * CVSS rating: High * Security risk details: If the value is too high, then it could be possible to perform brute force attack against password reset process. {#sc-reset-password-request-max-attempts__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-reset-password-request-max-attempts__table_ajc_b43_3kb}