diff --git a/setup/templates/steps/config.html b/setup/templates/steps/config.html
index 34f22ec1..b3b5fe87 100644
--- a/setup/templates/steps/config.html
+++ b/setup/templates/steps/config.html
@@ -37,7 +37,7 @@ Or in plain english: if receivers start to classify your mail as spam, this post
 </div>
 
 <div class="form-group">
-  <label>Authentication rate limit per IP for failed login attempts or non-existing accounts</label>
+  <label>Authentication rate limit per IP for failed login attempts on unique non-existing accounts (password spraying counter-measure)</label>
   <!--   Validates number input only -->
   <p><input class="form-control" style="width: 9%; display: inline;" type="number" name="auth_ratelimit_ip" value="5" required > / hour
   </p>