Currently, wordpress default is returning 200 on either failed or successfull login attempt. The modern standard, used by all web application framework is to return 401 (or 403) on failed login attempts.
This allows third party tools (think waf, fail2ban, etc) to detect brute forcing attempt and block it from outside of wordpress.
I can't find where I can make this change or is there a plugin providing such a functionality.
Yes, I'm well aware of plugins who attempt to provide "brute force blocking" from inside of Wordpress. But besides being a problem on their own, they are prone to being shut from inside the Wordpress installation. And the defence is placed in the wrong level. Instead of being a perimeter defense, all those requests hit the actual wordpress Installation. So no, this isn't a good option for me.
Thanks for the help!