The "Lock to Account" feature has been enabled for all users without Basic or PLUS account upgrades.

If your account has stopped working, do NOT email or call. Instead READ our previous instructions and then update your account: "My Account" -> "Security" -> enter referrers into "Allowed Referrers"... Read more in this thread...

Since even I was surprised by the number of mis-configured accounts and accounts with no referrers, I pulled another all-nighter to ease into this lock-down. I expect to get a LOT of emails and calls regarding this change but THEY WILL ALL BE IGNORED, because this has been announced many times. I managed to work all day yesterday and just barely made the "Go Live" deadline. However, there were so many issues with bad data and duplicate accounts that I had to monitor the entire process all night long (going on 20 hours work since yesterday morning). And, unfortunately, I had to tweak the lock-down script so much that it ended up taking nearly 1 second per account, which is a lot with so many accounts in the system.

So anyway, this was a major change that affects access and the script to lock-down users had a wide margin for error. However, I believe that my monitoring and tweaking things helped keep it in check and I believe that we are in good shape, moving forward. There are still a few, small issues to clear up but those will have to wait until after I get a few hours of rest.

I also took care of a small bug in the Drupal CMS template while I was waiting on the script at one point. The bug had to do with some usernames that contained strange characters, underscores, and hyphens. Some, not all, of those accounts were unable to navigate the "My Account" areas fully. This was because I did not realize that Drupal doesn't always use the [user-raw] value for navigation via url_alias. To be fully compliant, we must use drupal_get_path_alias('user/'.$user->uid). Still learning.

GEEK-SPEAK
I thought it might be interesting to post some of the stats gathered from the lock-down exercise, as they surprised even me... and I was expecting a lot of trash accounts already.

Accounts with no referrers (and no website listed*): ~14,000

Accounts with no referrers (with website listed*): ~7,000

Accounts with duplicate referrers: ~75

*My script handled accounts with no referrer by checking for a listed website. If listed, then I took that, tested against all other referrers across all other accounts and added it to the allowed list for that user. If there was no site listed, then that account got locked down without a referrer allowed (meaning that account will no longer work until updated with an allowed referrer). I suspect that the majority of those accounts are dormant/inactive accounts anyway.