Title: Question about failed logins Last modified: May 16, 2026 --- # Question about failed logins * Resolved [tomdkat](https://wordpress.org/support/users/tomdkat/) * (@tomdkat) * [1 day, 12 hours ago](https://wordpress.org/support/topic/question-about-failed-logins/) * Hi! I’m a long time user of this plugin. YEARS ago, I actually patched my installed version to display the password that was used for a failed login attempt. I found this INSTRUMENTAL in seeing what kinds of passwords bad actors were using so I could better make sure the passwords our important users had were “safe”, in terms of length and making sure the actual password wasn’t close to what the bad actors were using. I updated the plugin TODAY, which means my changes were wiped out, which is perfectly fine. My question is: would it be possible to add the ability to show the actual password that was used for a failed login attempt? My patch didn’t work for brute force login attempts using xmlrc (I think that’s what was used) but for login attempts via the normal login script were being logged, in the database, so I could show them with the other login attempt information. * Thanks for taking over the maintenance of this great plugin! Viewing 3 replies - 1 through 3 (of 3 total) * Plugin Author [Joris Le Blansch](https://wordpress.org/support/users/apiosys/) * (@apiosys) * [23 hours, 3 minutes ago](https://wordpress.org/support/topic/question-about-failed-logins/#post-18910209) * Thanks for your feedback and support. Your idea indeed sounds interesting for audit purposes. However, this would assume, you will treat all passwords as plaintext since at the moment of login, you don’t know yet if it will fail or pass. Also failures are not necessarily attackers but can be your own users for which you would expose passwords. That is far from best practice and not security by design. * Storing plaintext passwords of failed attempts creates real exposure – both the privacy risk to legitimate users who simply mistyped, and the security risk if the database is ever accessed by someone it shouldn’t be. The diagnostic value doesn’t justify it IMHO. * When I took over the plugin – since I used it myself for years also – we had severe security issues in the code and even a CVE against it. That is now all solved, and we should endeavor to keep the code clean and secure. * Happy to discuss other improvement ideas. You can also contribute to the code directly here: [https://github.com/apio-sys/simple-login-log](https://github.com/apio-sys/simple-login-log). * Thread Starter [tomdkat](https://wordpress.org/support/users/tomdkat/) * (@tomdkat) * [20 hours, 35 minutes ago](https://wordpress.org/support/topic/question-about-failed-logins/#post-18910275) * Hi! Thanks for the response! It’s been sooo long now, I forget the details of my change. I might have added a column to the failed login table to store the failed password or otherwise grabbed it from the same spot where the login log was getting the data it did store. Regardless, it I think it was being stored in plain text. Your points about security and spot on, but there’s got to be a way to what the failed attempted passwords were. I mean WordPress rejected the password and there’s just no record of what that “bad” password was. Your point about the database being accessed by an unauthorized party is completely valid. If database access were actually achieved, they would have access to * all* the passwords and then we have a completely different problem to deal with. 🙂 lolIn any event, the only reason I mention this is because I noticed this plugin was recently updated and I had actually completely forgotten about it, until this update. In fact, when I saw it was updated, I was concerned that a“ bad actor” had taken control of the plugin and well, you can imagine the rest. 🙂Anyway, thanks for taking the time to reply. 🙂 * Plugin Author [Joris Le Blansch](https://wordpress.org/support/users/apiosys/) * (@apiosys) * [17 hours, 34 minutes ago](https://wordpress.org/support/topic/question-about-failed-logins/#post-18910372) * You’re welcome & kind regards, * Joris. Viewing 3 replies - 1 through 3 (of 3 total) You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fquestion-about-failed-logins%2F%3Foutput_format%3Dmd&locale=en_US) to reply to this topic. * ![](https://ps.w.org/simple-login-log/assets/icon-256x256.png?rev=3487526) * [Simple Login Log](https://wordpress.org/plugins/simple-login-log/) * [Support Threads](https://wordpress.org/support/plugin/simple-login-log/) * [Active Topics](https://wordpress.org/support/plugin/simple-login-log/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/simple-login-log/unresolved/) * [Reviews](https://wordpress.org/support/plugin/simple-login-log/reviews/) * 3 replies * 2 participants * Last reply from: [Joris Le Blansch](https://wordpress.org/support/users/apiosys/) * Last activity: [17 hours, 34 minutes ago](https://wordpress.org/support/topic/question-about-failed-logins/#post-18910372) * Status: resolved