WP fail2ban Premium connects WordPress activity to the server-side fail2ban service. WordPress records security events, configured filters match them, and fail2ban can ban abusive IP addresses at the host firewall. That firewall can stop later requests before they reach WordPress. WP fail2ban provides the integration; fail2ban and the firewall must be configured on the server.

Events and filters

The included filters are wordpress-hard.conf, wordpress-soft.conf and wordpress-extra.conf. Hard filters cover events that may warrant an immediate ban. Soft filters handle activity where several attempts may be reasonable first. Administrators can adapt filters and add rules for custom configurations.

Recorded events can include failed logins, attempts to use specified blocked usernames, empty usernames, user enumeration, comments on nonexistent content, spam and pingbacks. Empty username attempts and pingbacks can be logged as soft failures; comments on nonexistent content and spam can be logged as hard failures. WP fail2ban can block user enumeration. If it cannot be blocked, the plugin can require email address login instead of username login.

Premium controls

• Web Application Firewall: Checks the SQL WordPress is about to execute and can block SQL injection without relying on attack signatures.
• Blocklist: Uses hostile IP addresses identified from attacks seen across participating WP fail2ban sites. Premium receives the full current intelligence available for the site.
• Geo-blocking: Blocks traffic from selected countries and keeps geolocation data updated automatically.
• XML-RPC restrictions: Blocks XML-RPC requests while allowing Jetpack and/or pingbacks.
• Trusted network updates: Automatically updates Cloudflare and Jetpack network ranges and works with a separate trusted proxy list.
• Event history: Provides a structured history for reviewing activity by IP address, country, username, event type and more.
• Akismet logging: Logs the IP address when Akismet discards obvious spam, as well as comments marked as spam.
• Additional controls: Includes honeypots, safeguards around sensitive WordPress operations and hooks for custom actions when an event is detected.

Monitoring and configuration

The Site Health Check reviews the fail2ban configuration and whether filters are current. Outdated filters can reduce how well the integration works. WP fail2ban can also run as a must-use extension, and its API lets other extensions extend its behavior.

Install and activate WP fail2ban in WordPress, then configure fail2ban with the supplied filters and jails. Set trusted proxies if needed, select the events and Premium controls for the site, and test the setup. Use Site Health and the event history to review the configuration. Premium requires PHP 8 or later, and hosting must allow fail2ban and the firewall to be configured on the server.