@@ -1432,20 +1432,32 @@ protected static function log_login_nonce_failure( $user_id, $reason ) {
 		 */
 		do_action( 'two_factor_login_nonce_failed', $user_id, $reason );
 
+		/*
+		 * Only 'expired' and 'mismatch' are written to the error log. Both require a nonce
+		 * to already be stored for the user, which only happens after a successful password
+		 * check, so their volume is bounded by real login activity.
+		 *
+		 * 'no_nonce_stored' is not. Any unauthenticated request carrying a guessed user ID
+		 * reaches it, so logging it by default would hand anyone an unbounded write to the
+		 * error log -- and it is the least informative of the three, firing for every stale
+		 * bookmark and resubmitted form. Sites that want it can opt in via the filter below.
+		 */
+		$log_by_default = in_array( $reason, array( 'expired', 'mismatch' ), true );
+
 		/**
-		 * Filters whether failed login nonce verifications are written to the PHP error log.
+		 * Filters whether a failed login nonce verification is written to the PHP error log.
 		 *
-		 * These are written unconditionally so that the failures are visible without any
-		 * configuration. Sites that would rather not carry the log volume, or that handle
-		 * the `two_factor_login_nonce_failed` action themselves, can return false here.
+		 * Defaults to true for 'expired' and 'mismatch', and false for 'no_nonce_stored'.
+		 * Sites that would rather not carry the log volume, or that handle the
+		 * `two_factor_login_nonce_failed` action themselves, can return false for everything.
 		 *
 		 * @since 0.17.0
 		 *
-		 * @param bool   $log     Whether to write the failure to the error log. Default true.
+		 * @param bool   $log     Whether to write this failure to the error log.
 		 * @param int    $user_id The user ID the nonce was presented for.
 		 * @param string $reason  One of 'no_nonce_stored', 'expired', or 'mismatch'.
 		 */
-		if ( ! apply_filters( 'two_factor_log_login_nonce_failures', true, $user_id, $reason ) ) {
+		if ( ! apply_filters( 'two_factor_log_login_nonce_failures', $log_by_default, $user_id, $reason ) ) {
 			return;
 		}
 
 
@@ -779,14 +779,36 @@ public function data_login_nonce_failure_reasons() {
 	/**
 	 * Error log output for failed nonces can be turned off, and is passed the context.
 	 *
+	 * The incoming value differs by reason: 'expired' and 'mismatch' both require a stored
+	 * nonce, so they are bounded by real logins and default to true. 'no_nonce_stored' is
+	 * reachable by any unauthenticated request and defaults to false.
+	 *
+	 * @dataProvider data_login_nonce_failure_log_defaults
+	 *
 	 * @covers Two_Factor_Core::log_login_nonce_failure()
+	 *
+	 * @param string $reason           The expected failure reason.
+	 * @param bool   $expected_default The expected incoming filter value.
 	 */
-	public function test_login_nonce_failure_logging_can_be_filtered() {
+	public function test_login_nonce_failure_logging_can_be_filtered( $reason, $expected_default ) {
 		$user_id = self::factory()->user->create();
 		$args    = array();
+		$nonce   = 'not-a-real-nonce';
+
+		if ( 'no_nonce_stored' !== $reason ) {
+			$created = Two_Factor_Core::create_login_nonce( $user_id );
+
+			if ( 'expired' === $reason ) {
+				$nonce = $created['key'];
+
+				$stored               = get_user_meta( $user_id, Two_Factor_Core::USER_META_NONCE_KEY, true );
+				$stored['expiration'] = time() - 1;
+				update_user_meta( $user_id, Two_Factor_Core::USER_META_NONCE_KEY, $stored );
+			}
+		}
 
-		$recorder = function ( $log, $logged_user_id, $reason ) use ( &$args ) {
-			$args[] = array( $log, $logged_user_id, $reason );
+		$recorder = function ( $log, $logged_user_id, $logged_reason ) use ( &$args ) {
+			$args[] = array( $log, $logged_user_id, $logged_reason );
 
 			return false;
 		};
@@ -795,15 +817,28 @@ public function test_login_nonce_failure_logging_can_be_filtered() {
 		remove_filter( 'two_factor_log_login_nonce_failures', '__return_false' );
 		add_filter( 'two_factor_log_login_nonce_failures', $recorder, 10, 3 );
 
-		$this->assertFalse( Two_Factor_Core::verify_login_nonce( $user_id, 'not-a-real-nonce' ) );
+		$this->assertFalse( Two_Factor_Core::verify_login_nonce( $user_id, $nonce ) );
 
 		remove_filter( 'two_factor_log_login_nonce_failures', $recorder, 10 );
 		add_filter( 'two_factor_log_login_nonce_failures', '__return_false' );
 
 		$this->assertSame(
-			array( array( true, $user_id, 'no_nonce_stored' ) ),
+			array( array( $expected_default, $user_id, $reason ) ),
 			$args,
-			'The filter receives the incoming value plus the user and reason'
+			'The filter receives the per-reason default plus the user and reason'
+		);
+	}
+
+	/**
+	 * Data provider for the per-reason error log defaults.
+	 *
+	 * @return array
+	 */
+	public function data_login_nonce_failure_log_defaults() {
+		return array(
+			'nothing stored'  => array( 'no_nonce_stored', false ),
+			'wrong value'     => array( 'mismatch', true ),
+			'past expiration' => array( 'expired', true ),
 		);
 	}