WP fail2ban
Add to ListGot a firewall? Use it.
WP fail2ban gives fail2ban the information it needs to block attackers at the firewall. fail2ban is a server-side service that bans abusive IP addresses; WP fail2ban tells it about brute-force attacks, user enumeration, comment abuse, spam, and more.
Once an address is banned, the firewall stops its requests before they reach your site.
Free protection from the usual suspects
The Free edition covers the attacks WordPress sites see every day:
- Brute-force attacks — failed logins and attempts using unknown or blocked usernames give
fail2banthe information it needs to act. - User enumeration — blocks common ways bots discover valid usernames before trying to log in.
- Comment abuse and spam — catches suspicious comment attempts and can act on comments marked as spam.
- Pingbacks and trackbacks — turns abusive or failed requests into useful signals for
fail2ban. - Blocklist — the free Blocklist can stop known hostile IP addresses before they attack your site.
Need more protection? See what Premium adds
How WP fail2ban works
WP fail2ban records security events in a form fail2ban can recognise. fail2ban watches those events and applies the rules you configure on the server. When an address crosses a threshold, it can be banned by the host firewall, so later requests are stopped before they reach WordPress.
WP fail2ban ships with filters that work well for typical sites, so most installations can start with them as they are.
The events themselves are deliberately written for humans as well as fail2ban: they tell you who is doing what, to what, and why it matters. That makes the logs useful to read directly, and makes it much easier to adapt the supplied filters or write your own if your setup needs something unusual.
WP fail2ban also handles exiting keep-alive connections. When abusive activity should result in a ban, it closes the connection so the client cannot simply keep sending requests over a connection that was opened before the firewall rule was added.
The Blocklist works a little differently: it can give the firewall hostile addresses learned from other participating sites, so your site does not have to see the attack first.
Premium protection from the unusual suspects
Premium goes beyond fail2ban.
-
Block bots before they attack — the full Blocklist uses attacks seen across participating sites to give your firewall hostile IP addresses your site has not encountered yet. The free Blocklist helps build that network; Premium gets the full current intelligence available for your site.
-
Block the injection, not the signature — WP fail2ban’s Web Application Firewall (WAF) checks the SQL WordPress is actually about to run. There are no attack signatures: whether it is a zero-day or a well-known exploit, the WAF blocks the injection itself.
-
Investigate after they attack — Premium keeps a structured history of security events, so you can follow activity by IP address, country, username, event type and more instead of relying only on whatever remains in the system log.
-
Maintain your protection — some protection depends on external data that changes over time. Premium keeps geolocation data and trusted Cloudflare and Jetpack network ranges up to date automatically.
Premium also adds controls including geo‑blocking, XML‑RPC restrictions, honeypots, and safeguards around sensitive WordPress operations.
Your firewall can stop an IP address, but it cannot see what that address is doing inside WordPress. WP fail2ban fills that gap: the Free edition gives fail2ban the information it needs to act on everyday abuse, while Premium adds protection and intelligence that go beyond fail2ban.
If you have questions about hosting, the Blocklist, Free and Premium, version requirements, privacy, or how WP fail2ban stores data, the FAQ below covers the practical details.