Return the same response for unknown accounts and wrong passwords

If your login says "No account with that email" for one input and "Wrong password" for another, anyone can test which emails are registered. That list feeds targeted phishing and credential stuffing. OWASP's Authentication Cheat Sheet says to return one generic message for a wrong username, a wrong password, and a locked or disabled account:

The same applies beyond the message:

• Status codes: return the same code for every failure. A 404 for unknown users and 401 for wrong passwords leaks the same information.
• Sign-up and reset: use neutral wording such as "If that address is registered, we have sent an email", and send the "you already have an account" note by email rather than on screen.
• Timing: see the next practice.

Check by trying a registered and an unregistered email with a wrong password. The two responses should be identical in body, status and headers.