diff --git a/setup/templates/steps/config.html b/setup/templates/steps/config.html
index fe8bc0cb..34f22ec1 100644
--- a/setup/templates/steps/config.html
+++ b/setup/templates/steps/config.html
@@ -39,8 +39,7 @@ Or in plain english: if receivers start to classify your mail as spam, this post
 <div class="form-group">
   <label>Authentication rate limit per IP for failed login attempts or non-existing accounts</label>
   <!--   Validates number input only -->
-  <p><input class="form-control" style="width: 9%; display: inline;" type="number" name="auth_ratelimit_ip"
-  		value="60" required > / hour
+  <p><input class="form-control" style="width: 9%; display: inline;" type="number" name="auth_ratelimit_ip" value="5" required > / hour
   </p>
 </div>