From a6751172b6b78ab65fc73bbc155aba1972e08534 Mon Sep 17 00:00:00 2001
From: githubflyideas <36397539+githubflyideas@users.noreply.github.com>
Date: Fri, 13 Nov 2026 09:20:11 +0900
Subject: [PATCH] Clarify login lockout in README

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 04aa9e8..bfc8c62 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ Format: `target[:port] name [vrf=NAME] [source=LOCAL_IP]`.
 
 Use `--localhost` for loopback-only access; `--help` lists options. Restrict access to trusted management networks.
 
-After 5 wrong passwords from one client address, that address is locked out for 30 s, doubling per further miss up to 15 min; even the right password is refused (HTTP 429) until the lock runs out. The session cookie is `vrfping_session` (it was `pingping_session`, which clashed with a pingping console on the same host); signing in again after the upgrade is expected.
+The first 5 wrong passwords from one client address are only delayed; the 6th locks that address for 30 s, and each further miss doubles the lock up to 15 min; even the right password is refused (HTTP 429) until the lock runs out. The session cookie is `vrfping_session` (it was `pingping_session`, which clashed with a pingping console on the same host); signing in again after the upgrade is expected.
 
 Authenticated users can edit an existing target under **Probe routing**. Web writes are disabled when login is not configured.