diff --git a/wwwroot/up_login.dspy b/wwwroot/up_login.dspy
index 2e251900..e29180d0 100644
--- a/wwwroot/up_login.dspy
+++ b/wwwroot/up_login.dspy
@@ -11,6 +11,8 @@ db = DBPools()
 async with db.sqlorContext('sage') as sor:
 	r = await sor.sqlExe('select * from users where username=${username}$ and password=${password}$', ns.copy())
 	if len(r) == 0:
+		# 登录失败：连续失败次数 +1（超过5分钟则重置为1）
+		await sor.sqlExe("UPDATE users SET login_fail_count = CASE WHEN last_login_fail IS NULL OR last_login_fail < NOW() - INTERVAL 5 MINUTE THEN 1 ELSE login_fail_count + 1 END, last_login_fail = NOW() WHERE username=${username}$", {'username': ns['username']})
 		return {
 			"widgettype":"Error",
 			"options":{
@@ -19,6 +21,8 @@ async with db.sqlorContext('sage') as sor:
 				"message":"user name or password error"
 			}
 		}
+	# 登录成功：清除连续失败次数
+	await sor.sqlExe("UPDATE users SET login_fail_count = 0, last_login_fail = NULL, last_login = NOW() WHERE id=${id}$", {'id': r[0].id})
 	await remember_user(r[0].id, username=r[0].username, userorgid=r[0].orgid)
 	return {
 		"widgettype":"Message",