diff --git a/login_security.admin.inc b/login_security.admin.inc
index 57fc523..6c4381b 100644
--- a/login_security.admin.inc
+++ b/login_security.admin.inc
@@ -66,10 +66,21 @@ function login_security_admin_settings() {
   );
   $form['login_messages']['login_security_disable_core_login_error'] = array(
     '#type' => 'checkbox',
-    '#title' => t('Disable login failure error message'),
+    '#title' => t('Disable default login failure error message'),
     '#description' => t('Checking this option prevents the display of login error messages. A user attempting to login will not be aware if the account exists, an invalid user name or password has been submitted, or if the account is blocked. The core messages "Sorry, unrecognized username or password. Have you forgotten your password?" and "The username {username} has not been activated or is blocked." are also hidden.'),
     '#default_value' => variable_get('login_security_disable_core_login_error', LOGIN_SECURITY_DISABLE_CORE_LOGIN_ERROR),
   );
+  $form['login_messages']['login_security_simple_login_error'] = array(
+    '#type' => 'textfield',
+    '#title' => t('Simple login failure error message'),
+    '#description' => t('If you choose to disable the default login failure messages, you can set a simple error message instead. For optimum security and to avoid account enumeration vulnerabilities, this should be a generic message applicable to all situations such as "There was a problem with your login.", and not indicate username or password errors. If this field is empty, no message will be set.'),
+    '#default_value' => variable_get('login_security_simple_login_error', LOGIN_SECURITY_SIMPLE_LOGIN_ERROR),
+    '#states' => array(
+      'visible' => array(
+        ':input[name="login_security_disable_core_login_error"]' => array('checked' => TRUE),
+      ),
+    ),
+  );
   $form['login_messages']['login_security_notice_attempts_available'] = array(
     '#type' => 'checkbox',
     '#title' => t('Notify the user about the number of remaining login attempts'),
diff --git a/login_security.module b/login_security.module
index 01b9b5d..8ff65bb 100644
--- a/login_security.module
+++ b/login_security.module
@@ -13,6 +13,7 @@ define('LOGIN_SECURITY_USER_WRONG_COUNT', 0);
 define('LOGIN_SECURITY_HOST_WRONG_COUNT', 0);
 define('LOGIN_SECURITY_HOST_WRONG_COUNT_HARD', 0);
 define('LOGIN_SECURITY_DISABLE_CORE_LOGIN_ERROR', 0);
+define('LOGIN_SECURITY_SIMPLE_LOGIN_ERROR', '');
 define('LOGIN_SECURITY_NOTICE_ATTEMPTS_AVAILABLE', 0);
 define('LOGIN_SECURITY_ACTIVITY_THRESHOLD', 0);
 define('LOGIN_SECURITY_NOTICE_ATTEMPTS_MESSAGE', t("You have used @user_current_count out of @user_block_attempts login attempts. After all @user_block_attempts have been used, you will be unable to login."));
@@ -248,6 +249,10 @@ function login_security_validate($form, &$form_state) {
         // helpful to an attacker it should not reset the attempts message
         // because it is a warning, not an error.
         drupal_get_messages('error', TRUE);
+
+        if (variable_get('login_security_simple_login_error', LOGIN_SECURITY_SIMPLE_LOGIN_ERROR)) {
+          drupal_set_message(login_security_t(variable_get('login_security_simple_login_error', LOGIN_SECURITY_SIMPLE_LOGIN_ERROR), $variables), 'error', TRUE);
+        }
       }
 
       // Should the user be advised about the remaining login attempts?
@@ -428,6 +433,7 @@ function _login_security_get_variables_by_name($name) {
     '@hard_block_attempts' => variable_get('login_security_host_wrong_count_hard', LOGIN_SECURITY_HOST_WRONG_COUNT_HARD),
     '@soft_block_attempts' => variable_get('login_security_host_wrong_count', LOGIN_SECURITY_USER_WRONG_COUNT),
     '@user_block_attempts' => variable_get('login_security_user_wrong_count', LOGIN_SECURITY_USER_WRONG_COUNT),
+    '@simple_login_error'  => variable_get('login_security_simple_login_error', LOGIN_SECURITY_SIMPLE_LOGIN_ERROR),
     '@user_ip_current_count' => db_select('login_security_track', 'lst')
     ->fields('lst', array('id'))
     ->condition('name', $name)