diff --git a/controllers/authController.go b/controllers/authController.go
index 2612ad6..52e858b 100644
--- a/controllers/authController.go
+++ b/controllers/authController.go
@@ -363,15 +363,71 @@ func StudentLogin(c *fiber.Ctx) error {
 			"error":   err,
 		})
 	}
-	defer cancel()
+
+	var localAccountDisabled = false
+	if student.Attempts >= 5 {
+		localAccountDisabled = true // Catches newly disbaled account before student obj is updated
+		update_time, _ := time.Parse(time.RFC3339, time.Now().Format(time.RFC3339))
+		update := bson.M{
+			"$set": bson.M{
+				"accountdisabled": true,
+				"attempts":        0,
+				"updated_at":      update_time,
+			},
+		}
+
+		_, updateErr := studentCollection.UpdateOne(
+			ctx,
+			bson.M{"sid": data["sid"]},
+			update,
+		)
+		if updateErr != nil {
+			cancel()
+			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
+				"success": false,
+				"message": "the student could not be updated",
+				"error":   updateErr,
+			})
+		}
+	}
+
+	if localAccountDisabled || student.AccountDisabled {
+		cancel()
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
+			"success": false,
+			"message": "Account is Disabled, contact an Admin",
+		})
+	}
 
 	var verified bool = student.ComparePasswords(data["password"])
 	if verified == false {
+		update_time, _ := time.Parse(time.RFC3339, time.Now().Format(time.RFC3339))
+		update := bson.M{
+			"$set": bson.M{
+				"attempts":   student.Attempts + 1,
+				"updated_at": update_time,
+			},
+		}
+
+		_, updateErr := studentCollection.UpdateOne(
+			ctx,
+			bson.M{"sid": data["sid"]},
+			update,
+		)
+		cancel()
+		if updateErr != nil {
+			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
+				"success": false,
+				"message": "the student could not be updated",
+				"error":   updateErr,
+			})
+		}
 		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
 			"success": false,
 			"message": "incorrect password",
 		})
 	}
+	defer cancel()
 
 	claims := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.StandardClaims{
 		Issuer:    student.SID,
diff --git a/models/studentModel.go b/models/studentModel.go
index 89e4ff5..7f3efed 100644
--- a/models/studentModel.go
+++ b/models/studentModel.go
@@ -12,30 +12,32 @@ import (
 )
 
 type Student struct {
-	ID           primitive.ObjectID `bson:"_id"`
-	FirstName    string             `json:"firstname" validate:"required"`
-	MiddleName   string             `json:"middlename"`
-	LastName     string             `json:"lastname" validate:"required"`
-	Age          int                `json:"age" validate:"required"`
-	GradeLevel   int                `json:"gradelevel" validate:"required"`
-	Email        string             `json:"email" validate:"required"`
-	SchoolEmail  string             `json:"schoolemail"`
-	Password     string             `json:"-" validate:"min=10,max=32"`
-	TempPassword bool               `json:"temppassword"`
-	SID          string             `json:"sid"` // Student ID
-	PEN          string             `json:"ped"` // Personal Education Number
-	Homeroom     string             `json:"homeroom"`
-	Locker       string             `json:"locker"`
-	YOG          int                `json:"yog"` // Year of Graduation
-	Address      string             `json:"address"`
-	City         string             `json:"city"`
-	Province     string             `json:"province"`
-	Postal       string             `json:"postal"`
-	DOB          string             `json:"dob" validate:"required"`
-	Photo        string             `json:"photo"`
-	Contacts     []string           `json:"contacts"` // List of contact ID's rather than contact object
-	Created_at   time.Time          `json:"created_at"`
-	Updated_at   time.Time          `json:"updated_at"`
+	ID              primitive.ObjectID `bson:"_id"`
+	AccountDisabled bool               `bson:"accountdisabled"`
+	FirstName       string             `json:"firstname" validate:"required"`
+	MiddleName      string             `json:"middlename"`
+	LastName        string             `json:"lastname" validate:"required"`
+	Age             int                `json:"age" validate:"required"`
+	GradeLevel      int                `json:"gradelevel" validate:"required"`
+	Email           string             `json:"email" validate:"required"`
+	SchoolEmail     string             `json:"schoolemail"`
+	Password        string             `json:"-" validate:"min=10,max=32"`
+	TempPassword    bool               `json:"temppassword"`
+	Attempts        int                `json:"attempts"` // login attempts max 5
+	SID             string             `json:"sid"`      // Student ID
+	PEN             string             `json:"ped"`      // Personal Education Number
+	Homeroom        string             `json:"homeroom"`
+	Locker          string             `json:"locker"`
+	YOG             int                `json:"yog"` // Year of Graduation
+	Address         string             `json:"address"`
+	City            string             `json:"city"`
+	Province        string             `json:"province"`
+	Postal          string             `json:"postal"`
+	DOB             string             `json:"dob" validate:"required"`
+	Photo           string             `json:"photo"`
+	Contacts        []string           `json:"contacts"` // List of contact ID's rather than contact object
+	Created_at      time.Time          `json:"created_at"`
+	Updated_at      time.Time          `json:"updated_at"`
 }
 
 func (s *Student) HashPassword(password string) string {