CircleCI has several mechanisms in place to protect accounts against brute-force login attempts and credential stuffing attacks. This article explains what protections exist and what you can do to strengthen your account security.
Built-in authentication protections
CircleCI enforces rate limiting on login attempts. After a threshold of failed login attempts is reached, further attempts are temporarily blocked. This applies to email and password logins.
CircleCI also monitors for suspicious login activity and will notify users when an access attempt is detected from an unfamiliar location or IP address. If you receive such a notification and do not recognize the activity, follow the steps in the notification email to secure your account.
Strengthen your account protection
The most effective step you can take is enabling Multi-Factor Authentication (MFA). MFA means that even if your password is guessed or stolen, an attacker cannot access your account without also having access to your authenticator app.
MFA is mandatory for all standalone (email and password) CircleCI accounts as of December 2025. If you have not yet set it up, visit your user settings to do so.
Additional recommendations:
Use a strong, unique password for your CircleCI account that is not reused across other services.
If you log in via GitHub or Bitbucket OAuth, enable MFA on those providers directly — this protects your CircleCI access as well.
Regularly review your active API tokens in user settings and remove any that are no longer needed.
Monitor your organization's audit log for unexpected login events or pipeline activity.
If you suspect an attack is in progress
If you notice repeated failed login attempts on your account or receive unexpected login notifications, contact us at [email protected] with details including your account email and a description of the activity.
Additional resources
Does CircleCI Support Multi Factor Authentication?
What happens to my active sessions when I reset my password?
How do I report a security vulnerability?