diff --git a/login_security.module b/login_security.module
index a3e289b..e90f15a 100644
--- a/login_security.module
+++ b/login_security.module
@@ -74,25 +74,44 @@ function login_security_form_alter(array &$form, FormStateInterface $form_state,
  * message before it gets updated with the current login instance.
  */
 function login_security_set_login_timestamp(array $form, FormStateInterface $form_state) {
-  // Always save entry in security log, Username and IP Address.
-  $ip_address = \Drupal::request()->getClientIp();
-  $account = _login_security_user_load_by_name($form_state->getValue('name'));
-  _login_security_add_event($account->getAccountName(), $ip_address);
-
-  // For active users set static login and access:
-  $account = \Drupal::database()->select('users_field_data', 'u')
-    ->fields('u', ['login', 'access'])
-    ->condition('name', $form_state->getValue('name'))
-    ->condition('status', 1)
-    ->execute()
-    ->fetchAssoc();
-  if (!empty($account)) {
-    // @todo This implementation using static is dirty!
-    _login_security_login_timestamp($account['login']);
-    _login_security_access_timestamp($account['access']);
-  }
+    // Always save entry in security log, Username and IP Address.
+    $ip_address = \Drupal::request()->getClientIp();
+    $username = $form_state->getValue('name');
+    $password = $form_state->getValue('pass');  // The password entered by the user.
+
+    // Load the user account by username.
+    $account = _login_security_user_load_by_name($username);
+
+    // Check if the user exists and validate the password.
+    if ($account instanceof \Drupal\user\Entity\User) {
+        // Check if the password is correct using Drupal's password service.
+        if (\Drupal::service('password')->check($password, $account->getPassword())) {
+
+            // For active users, set static login and access timestamps.
+            $account_data = \Drupal::database()->select('users_field_data', 'u')
+                ->fields('u', ['login', 'access'])
+                ->condition('name', $username)
+                ->condition('status', 1) // Only active users.
+                ->execute()
+                ->fetchAssoc();
+
+            if (!empty($account_data)) {
+                // Static method for handling timestamps (this part still uses direct data access).
+                _login_security_login_timestamp($account_data['login']);
+                _login_security_access_timestamp($account_data['access']);
+            }
+            return; // Exit the function after successful login.
+        } else {
+            // Invalid password, record the failed login attempt.
+            _login_security_add_event($username, $ip_address);
+        }
+    } else {
+        // User not found, record the failed login attempt.
+        _login_security_add_event($username, $ip_address);
+    }
 }
 
+
 /**
  * Returns account login timestamp.
  */