# Log Invalid Login Attempts for Fail2ban and upstream server action

**URL:** https://meta.discourse.org/t/log-invalid-login-attempts-for-fail2ban-and-upstream-server-action/171884
**Category:** Feature
**Created:** [December 1, 2020, 3:33pm UTC](https://meta.discourse.org/t/log-invalid-login-attempts-for-fail2ban-and-upstream-server-action/171884 "2020-12-01T15:33:38Z")
**Posts on this page:** 1
**Showing post:** 10

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [December 20, 2021, 4:58pm UTC](https://meta.discourse.org/t/log-invalid-login-attempts-for-fail2ban-and-upstream-server-action/171884/10 "2021-12-20T16:58:31Z")

</div>

Twitter uses 400 for wrong password, but Facebook, LinkedIn, Google and Amazon returns a 200. IMO a 200 sounds wrong, but it appears to be the “normal” thing?

Maybe you can start with a plugin that hooks into this method here

> <https://github.com/discourse/discourse/blob/b6c3e9aa037f8ceed04dec25ad9cbc08470c3177/app/controllers/session_controller.rb#L570>

And does what you need?

---

_[View the full topic](https://meta.discourse.org/t/log-invalid-login-attempts-for-fail2ban-and-upstream-server-action/171884)._