WordPress events connected to fail2ban
WP fail2ban Premium is an integration between WordPress and fail2ban. It does not replace fail2ban; instead, it provides the connection that lets WordPress write security-related events for fail2ban filters to process. This gives site administrators a structured way to respond to suspicious activity across login, comments, pingbacks, and related WordPress actions.
The plugin includes three fail2ban filters: wordpress-hard.conf, wordpress-soft.conf, and wordpress-extra.conf. They support a distinction between events that should lead to immediate banning and events that are better handled through a more gradual approach. Additional rules can be used for custom configurations.
Premium security controls
- XML-RPC controls: Block XML-RPC requests while allowing Jetpack and/or pingbacks.
- Country blocking: Block traffic from selected countries when attacks are concentrated in particular locations.
- Akismet support: Log the IP address when Akismet discards obvious spam, in addition to logging comments marked as spam.
- Cloudflare support: Automatically update the list of Cloudflare IP addresses and configure a separate list of trusted proxies.
- Event history: Keep a full history in the syslog dashboard widget instead of showing only the latest five messages.
- Event hooks: Run a custom action when WP fail2ban detects a particular event.
Events and behaviors it can record
WP fail2ban can log failed login attempts so their IP addresses can be banned. It can also block user enumeration, which is commonly used before password-guessing attacks. Where user enumeration cannot be blocked, the plugin can require users to log in with an email address rather than a username.
Specified usernames can be blocked during login. Empty username attempts are logged as soft failures, while attempted comments on content that does not exist are detected and logged as hard failures. Spam comments can produce hard failures, and pingbacks can be logged as soft failures to help rate-limit potential attackers without disabling pingbacks completely.
Monitoring and configuration
The Premium dashboard widget helps you review the complete event history and analyze patterns over time. The Site Health Check tries to verify that the fail2ban configuration is sensible and that filters are current, since outdated filters can reduce how well the integration works. WP fail2ban can also be configured as a must-use plugin, and its API allows other plugins to extend its behavior.
Installation
Install WP fail2ban Premium in WordPress, then configure the integration and its filters with your fail2ban setup. Review the available hard, soft, and extra filter files, configure trusted proxies if needed, and select the WordPress events and Premium controls appropriate for your site. Use the Site Health Check and event history to review the configuration after setup.
