diff --git a/max/audit.py b/max/audit.py
index 27740c4..1fa836b 100644
--- a/max/audit.py
+++ b/max/audit.py
@@ -6,6 +6,9 @@ def audit(event, actor=None, target=None, **fields):
     Logs a security relevant event as one line with the message "audit". actor is the
     acting user, None for anonymous requests. target is the affected user, if any.
     """
+    # The order of the first fields is fixed: fail2ban matches
+    # 'audit event=… actor_user_id=… actor_email=… ip="<HOST>"' (filter max.conf on the VPS).
+    # Change the filter when changing the order or the names.
     values = dict(
         event=event,
         actor_user_id=actor.id if actor is not None else None,