If the user does something wrong, be very specific about what they did wrong

If there’s a problem when a user tries to log in, be as specific as you can about what that problem is. Wrong email address? “We don’t have an account with this email address registered”. Wrong password? “That password is incorrect. Please check your spelling and try again”. You may feel a bit limited in what you can do to help here, but it’s much better than just saying “Login failed. Try again.”

Bonus tip: This applies to sign up as well, particularly when it comes to passwords. If there are requirements for the password, immediately state those very clearly, and explain what went wrong if the password doesn’t match the requirements.