wordpress return http200 instead of 401 on login error

[aqueos]

hi,

in case of auth error wordpress return a http code of 200 instead of 401 (unauthorised) or 403 but 401 is more fitting.

I guess this is to use "security by obscurity" but the thousands of bots par hour pilling my server's wp-login.php show this has no effect at tall on the obscurity side of things. It also prevent fail2ban filter or home made filter to block abuser ip easely.

So i think this would greatly benefit to return the appropriate http code in case of a bad login/pass or auth result in wordpress.

best regards,
Ghislain.

[johnbillion]

Duplicate of #25446.