diff --git a/client/components/Windows/SignIn.vue b/client/components/Windows/SignIn.vue
index 6c095c6f..753051de 100644
--- a/client/components/Windows/SignIn.vue
+++ b/client/components/Windows/SignIn.vue
@@ -46,16 +46,19 @@
 				</RevealPassword>
 			</div>
 
-			<div v-if="errorShown" class="error">Authentication failed.</div>
+			<div v-if="errorMessage" class="error">
+				{{ errorMessage === true ? "Authentication failed." : errorMessage }}
+			</div>
 
-			<button :disabled="inFlight" type="submit" class="btn">Sign in</button>
+			<button :disabled="!canSubmit" type="submit" class="btn">Sign in</button>
 		</form>
 	</div>
 </template>
 
 <script lang="ts">
 import storage from "../../js/localStorage";
-import socket from "../../js/socket";
+import socket, {tryAgainMessage} from "../../js/socket";
+import {store} from "../../js/store";
 import RevealPassword from "../RevealPassword.vue";
 import {defineComponent, onBeforeUnmount, onMounted, ref} from "vue";
 
@@ -65,15 +68,19 @@ export default defineComponent({
 		RevealPassword,
 	},
 	setup() {
-		const inFlight = ref(false);
-		const errorShown = ref(false);
+		// If authFailure reads "disconnected" initially, the user was likely blocked.
+		// ("Authentication failed." should never show on initial page load.)
+		const canSubmit = ref(store.state.authFailure !== "disconnected");
+		const errorMessage = ref<string | boolean>(
+			store.state.authFailure === "disconnected" ? tryAgainMessage : false
+		);
 
 		const username = ref(storage.get("user") || "");
 		const password = ref("");
 
 		const onAuthFailed = () => {
-			inFlight.value = false;
-			errorShown.value = true;
+			canSubmit.value = true;
+			errorMessage.value = true;
 		};
 
 		const onSubmit = (event: Event) => {
@@ -83,8 +90,8 @@ export default defineComponent({
 				return;
 			}
 
-			inFlight.value = true;
-			errorShown.value = false;
+			canSubmit.value = false;
+			errorMessage.value = false;
 
 			const values = {
 				user: username.value,
@@ -96,17 +103,35 @@ export default defineComponent({
 			socket.emit("auth:perform", values);
 		};
 
+		const unwatchAuthFailure = store.watch(
+			(state) => state.authFailure,
+			(authFailure, oldAuthFailure) => {
+				if (authFailure === "disconnected") {
+					// Occurs when long-poll or socket reconnect receives 403 after auth failure
+					// (i.e. block activated)
+					errorMessage.value = tryAgainMessage;
+					canSubmit.value = false;
+				} else if (authFailure === null && oldAuthFailure === "disconnected") {
+					// Occurs when socket connection is successfully established after page reload,
+					// after previously losing connection after auth failure (i.e. block removed)
+					errorMessage.value = false;
+					canSubmit.value = true;
+				}
+			}
+		);
+
 		onMounted(() => {
 			socket.on("auth:failed", onAuthFailed);
 		});
 
 		onBeforeUnmount(() => {
 			socket.off("auth:failed", onAuthFailed);
+			unwatchAuthFailure();
 		});
 
 		return {
-			inFlight,
-			errorShown,
+			canSubmit,
+			errorMessage,
 			username,
 			password,
 			onSubmit,
diff --git a/client/js/socket-events/auth.ts b/client/js/socket-events/auth.ts
index 7159734c..ead416f7 100644
--- a/client/js/socket-events/auth.ts
+++ b/client/js/socket-events/auth.ts
@@ -12,11 +12,16 @@ declare global {
 }
 
 socket.on("auth:success", function () {
+	if (store.state.authFailure) {
+		store.commit("authFailure", null);
+	}
+
 	store.commit("currentUserVisibleError", "Loading messages…");
 	updateLoadingMessage();
 });
 
 socket.on("auth:failed", async function () {
+	store.commit("authFailure", "failed");
 	storage.remove("token");
 
 	if (store.state.appLoaded) {
diff --git a/client/js/socket-events/connection.ts b/client/js/socket-events/connection.ts
index fafc576e..8b3ffeaa 100644
--- a/client/js/socket-events/connection.ts
+++ b/client/js/socket-events/connection.ts
@@ -1,9 +1,14 @@
 import {store} from "../store";
-import socket from "../socket";
+import socket, {tryAgainMessage} from "../socket";
 
-socket.on("disconnect", handleDisconnect);
-socket.on("connect_error", handleDisconnect);
-socket.on("error", handleDisconnect);
+const disconnectionTypes = ["disconnect", "connect_error", "error"] as const;
+type DisconnectionType = typeof disconnectionTypes[number];
+
+for (const type of disconnectionTypes) {
+	socket.on(type, (data) => {
+		handleDisconnect(type, data);
+	});
+}
 
 socket.io.on("reconnect_attempt", function (attempt) {
 	store.commit("currentUserVisibleError", `Reconnecting… (attempt ${attempt})`);
@@ -21,15 +26,39 @@ socket.on("connect", function () {
 	// nothing is sent to the server that might have happened.
 	socket.sendBuffer = [];
 
+	// If previously disconnected due to auth failure (i.e. private instance)
+	// and subsequently able to reconnect, reset state
+	if (store.state.authFailure === "disconnected") {
+		store.commit("authFailure", null);
+		socket.io.reconnection(true);
+	}
+
 	store.commit("currentUserVisibleError", "Finalizing connection…");
 	updateLoadingMessage();
 });
 
-function handleDisconnect(data) {
+function handleDisconnect(type: DisconnectionType, data) {
 	const message = String(data.message || data);
 
 	store.commit("isConnected", false);
 
+	// Prevent auto-reconnecting if disconnected after auth failures (e.g. fail2ban)
+	if (store.state.authFailure === "failed") {
+		if ((type === "disconnect" && message === "transport error") || type === "connect_error") {
+			store.commit("authFailure", "disconnected");
+		}
+	}
+
+	// Note: This is intentionally not an else if;
+	// this can apply directly after the preceding "failed" case
+	if (store.state.authFailure === "disconnected") {
+		store.commit("currentUserVisibleError", tryAgainMessage);
+		// Disable auto-reconnect, which may unwittingly prolong a block
+		socket.io.reconnection(false);
+		updateLoadingMessage();
+		return;
+	}
+
 	if (!socket.io.reconnection()) {
 		store.commit(
 			"currentUserVisibleError",
diff --git a/client/js/socket.ts b/client/js/socket.ts
index a3c0bca3..4c30ec2a 100644
--- a/client/js/socket.ts
+++ b/client/js/socket.ts
@@ -22,3 +22,9 @@ declare global {
 }
 
 export default socket;
+
+/**
+ * Message for use when the socket disconnects and will not reconnect
+ * (e.g. forced disconnects after auth failures)
+ */
+export const tryAgainMessage = "Disconnected from the server. Please try again later.";
diff --git a/client/js/store.ts b/client/js/store.ts
index 15ce9d8d..f389c917 100644
--- a/client/js/store.ts
+++ b/client/js/store.ts
@@ -12,6 +12,8 @@ import {SharedConfiguration, LockedSharedConfiguration} from "../../shared/types
 
 const appName = document.title;
 
+type AuthFailureState = "disconnected" | "failed" | null;
+
 enum DesktopNotificationState {
 	Unsupported = "unsupported",
 	Blocked = "blocked",
@@ -43,6 +45,7 @@ export type ClientSession = {
 export type State = {
 	appLoaded: boolean;
 	activeChannel?: NetChan;
+	authFailure: AuthFailureState;
 	currentUserVisibleError: string | null;
 	desktopNotificationState: DesktopNotificationState;
 	isAutoCompleting: boolean;
@@ -86,6 +89,7 @@ export type State = {
 const state = (): State => ({
 	appLoaded: false,
 	activeChannel: undefined,
+	authFailure: storage.get("thelounge.state.authFailure") as AuthFailureState,
 	currentUserVisibleError: null,
 	desktopNotificationState: detectDesktopNotificationState(),
 	isAutoCompleting: false,
@@ -199,6 +203,7 @@ const getters: Getters = {
 type Mutations = {
 	appLoaded(state: State): void;
 	activeChannel(state: State, netChan: State["activeChannel"]): void;
+	authFailure(state: State, value: AuthFailureState): void;
 	currentUserVisibleError(state: State, error: State["currentUserVisibleError"]): void;
 	refreshDesktopNotificationState(state: State): void;
 	isAutoCompleting(state: State, isAutoCompleting: State["isAutoCompleting"]): void;
@@ -239,6 +244,15 @@ const mutations: Mutations = {
 	activeChannel(state, netChan) {
 		state.activeChannel = netChan;
 	},
+	authFailure(state, value) {
+		state.authFailure = value;
+
+		if (value) {
+			storage.set("thelounge.state.authFailure", value);
+		} else {
+			storage.remove("thelounge.state.authFailure");
+		}
+	},
 	currentUserVisibleError(state, error) {
 		state.currentUserVisibleError = error;
 	},
diff --git a/server/server.ts b/server/server.ts
index 4d63bfad..ffb83908 100644
--- a/server/server.ts
+++ b/server/server.ts
@@ -1024,6 +1024,16 @@ function performAuthentication(this: Socket, data: AuthPerformData) {
 			}
 
 			socket.emit("auth:failed");
+
+			// Forcibly close WS connections from the server side on auth failure,
+			// so that the client reconnects upon next auth submission,
+			// allowing abuse mitigation systems to take effect.
+			// This is unnecessary for HTTP long-polling;
+			// in that case, the existing open HTTP connection will be closed.
+			if (socket.client.conn.transport.name !== "polling") {
+				socket.disconnect();
+			}
+
 			return;
 		}