If you run Home Assistant and can reach it from outside your house, you will have seen this notification: “Login attempt failed”. Then another. Then another. Home Assistant tells you an IP address and not much else, so you’re left wondering who it was, where they are, and what they were trying to do. Login Analyser is my answer: a free add-on for Home Assistant that tells you all of that, and then shows the persistent ones the door.
What it is
Login Analyser is a custom integration for Home Assistant (version 1.0.0 at the time of writing, for Home Assistant 2026.11 or newer). It installs from the Home Assistant Marketplace (what used to be called HACS) in a couple of clicks, adds a Login Analyser page to the sidebar, and quietly records every failed login and every request that turns up without a valid login.
The code is on GitHub: github.com/Rickkendall/ha-login-analyser.
Why I made it
The notifications kept coming, and I wanted to know what was behind them. Was somebody actually trying to guess my password, or was it something else?
Almost all of it is robots. There are programs that crawl the whole internet day and night, knocking on every door they find, looking for websites with known holes in them: WordPress, Joomla, routers, cameras. Home Assistant answers them with “you’re not logged in”, and Home Assistant counts each of those as a failed login. So most of the notifications aren’t a person at all, just a scanner on a rented server somewhere asking for files that don’t exist on a Home Assistant box.
Knowing that is reassuring, but I still wanted the detail, and I wanted the repeat visitors blocked automatically, the way fail2ban does it on Linux servers.
What it tells you about each attempt
- Where it came from. Country, region, city, the internet company and network, and whether it came from a datacenter, a VPN or proxy, or a mobile network. City-level only, so it’s a rough location, not someone’s front door.
- What it was after. The exact address it asked for and how it identified itself, sorted into plain-English labels such as “HA login brute force”, “Joomla probe”, “WordPress probe”, “Secrets file hunt” or “Router exploit”, each with a severity from 1 to 5.
- Usernames tried. Every username typed into the login form.
- Passwords tried, carefully. A password is only recorded when the username doesn’t exist on your system. Someone trying admin and admin123 gets written down. If you mistype your own password, it never is. And if anyone tries one of your real usernames, the page tells you so, because that’s worth knowing.
- What their machine looks like. Using the free Shodan InternetDB service, it shows which ports the attacking computer has open and any known security holes it has. Quite often the “attacker” is itself somebody’s hacked server.
- Its reputation. Optionally, with a free AbuseIPDB key, a score for how many other people have reported the same address.
Blocking, like fail2ban
- Three failed attempts within an hour gets an address banned for 24 hours. You can change all the numbers.
- Requests that are never legitimate on Home Assistant, like asking for WordPress or Joomla files, are banned on the first try.
- Repeat offenders get double the time on each ban, and the third ban is permanent.
- Bans run out on their own, unlike Home Assistant’s built-in ones, which last forever.
- It never bans your home network, addresses you’ve whitelisted, or anywhere you’ve logged in successfully in the last 30 days. If your phone’s app has an expired login and keeps knocking, it recognises the Home Assistant app and goes easy on it.
- You can ban or unban any address by hand from the page.
The Login Analyser page
The sidebar page shows the last 24 hours and last 7 days at a glance, a chart of attempts per hour, and tabs for attackers, a live feed of every attempt, the usernames and passwords tried, the current bans and the successful logins. Click any address to see everything about it: the map location, network, open ports, every request it made with all its details, and links to look it up on AbuseIPDB, Shodan, GreyNoise and VirusTotal.
It also swaps Home Assistant’s vague “Login attempt failed” notification for a proper one that says who, where from and what happened, can send a push notification to your phone, and adds sensors you can use in your own automations and dashboards.
Install it, it’s free
Login Analyser is free and open source under the MIT licence. To install it:
- In Home Assistant, go to Settings, then Marketplace (HACS on older versions), open the three-dot menu and choose Custom repositories.
- Add
https://github.com/Rickkendall/ha-login-analyserwith the category Integration, then download Login Analyser. - Restart Home Assistant, then go to Settings, Devices & services, Add integration and pick Login Analyser.
The GitHub page has a one-click button that does the first two steps for you, plus the full instructions and what to do if you ever lock yourself out. Updates then appear in Home Assistant like any other add-on.
A word of honest advice
Blocking the robots cuts the noise, but it’s worth knowing how they find you. If you use Home Assistant Cloud (Nabu Casa) for remote access, that address is a way in too. Nabu Casa saves you opening a port on your router, but every one of those addresses gets a security certificate, certificates are listed in public logs, and the scanners read those logs to find new targets. Login Analyser shows you which way each one came in: open a request and look at the full address it was sent to.
Only a private connection like Tailscale or WireGuard keeps the scanners out completely. If you only need Home Assistant at home, you can switch remote access off. And whatever you do, switch on two-step verification for every user (in your Home Assistant profile, under Security). Login Analyser is there to show you what’s going on, and to slam the door on the ones who keep trying.
If you try it, I’d love to hear what turns up at your door.