WP fail2ban – Advanced Security

Plugin Banner

WP fail2ban – Advanced Security

by invisnet

Download
Description

Got a firewall? Use it.

WP fail2ban gives fail2ban the information it needs to block attackers at the firewall. fail2ban is a server-side service that bans abusive IP addresses; WP fail2ban tells it about brute-force attacks, user enumeration, comment abuse, spam, and more.

Once an address is banned, the firewall stops its requests before they reach your site.

Free protection from the usual suspects

The Free edition covers the attacks WordPress sites see every day:

  • Brute-force attacks — failed logins and attempts using unknown or blocked usernames give fail2ban the information it needs to act.
  • User enumeration — blocks common ways bots discover valid usernames before trying to log in.
  • Comment abuse and spam — catches suspicious comment attempts and can act on comments marked as spam.
  • Pingbacks and trackbacks — turns abusive or failed requests into useful signals for fail2ban.
  • Blocklist — the free Blocklist can stop known hostile IP addresses before they attack your site.

Need more protection? See what Premium adds

How WP fail2ban works

WP fail2ban records security events in a form fail2ban can recognise. fail2ban watches those events and applies the rules you configure on the server. When an address crosses a threshold, it can be banned by the host firewall, so later requests are stopped before they reach WordPress.

WP fail2ban ships with filters that work well for typical sites, so most installations can start with them as they are.

The events themselves are deliberately written for humans as well as fail2ban: they tell you who is doing what, to what, and why it matters. That makes the logs useful to read directly, and makes it much easier to adapt the supplied filters or write your own if your setup needs something unusual.

WP fail2ban also handles exiting keep-alive connections. When abusive activity should result in a ban, it closes the connection so the client cannot simply keep sending requests over a connection that was opened before the firewall rule was added.

The Blocklist works a little differently: it can give the firewall hostile addresses learned from other participating sites, so your site does not have to see the attack first.

Installation and server setup

Premium protection from the unusual suspects

Premium goes beyond fail2ban.

  • Block bots before they attack — the full Blocklist uses attacks seen across participating sites to give your firewall hostile IP addresses your site has not encountered yet. The free Blocklist helps build that network; Premium gets the full current intelligence available for your site.

  • Block the injection, not the signature — WP fail2ban’s Web Application Firewall (WAF) checks the SQL WordPress is actually about to run. There are no attack signatures: whether it is a zero-day or a well-known exploit, the WAF blocks the injection itself.

  • Investigate after they attack — Premium keeps a structured history of security events, so you can follow activity by IP address, country, username, event type and more instead of relying only on whatever remains in the system log.

  • Maintain your protection — some protection depends on external data that changes over time. Premium keeps geolocation data and trusted Cloudflare and Jetpack network ranges up to date automatically.

Premium also adds controls including geo‑blocking, XML‑RPC restrictions, honeypots, and safeguards around sensitive WordPress operations.

See Premium plans and pricing

Your firewall can stop an IP address, but it cannot see what that address is doing inside WordPress. WP fail2ban fills that gap: the Free edition gives fail2ban the information it needs to act on everyday abuse, while Premium adds protection and intelligence that go beyond fail2ban.

If you have questions about hosting, the Blocklist, Free and Premium, version requirements, privacy, or how WP fail2ban stores data, the FAQ below covers the practical details.

WP fail2ban has two parts to set up: WordPress needs to generate the events, and fail2ban needs to know how to act on them.

WordPress

  1. Install WP fail2ban from the Plugin Directory and activate it.
  2. The Free edition is configured in wp‑config.php. The defaults are a good starting point; change them only where your site needs different behaviour.
  3. Check the WP fail2ban settings pages to see the effective configuration.

Configure WP fail2ban

fail2ban

WP fail2ban includes the wordpress-hard.conf and wordpress-soft.conf filters. Copy them into your fail2ban filter directory and configure jails for both.

The hard filter is for events that can normally be banned immediately. The soft filter is for events such as failed logins where several attempts may be reasonable.

Exactly where fail2ban reads its logs depends on your operating system and whether it uses traditional syslog files or the systemd journal, so use the installation documentation for the current examples.

Configure fail2ban

Once both sides are configured, test the installation before relying on it.

Is WP fail2ban “fail2ban for WordPress”?

No. fail2ban is the service that watches logs and bans abusive IP addresses at the firewall. WP fail2ban is the bridge between WordPress and fail2ban: it tells fail2ban what is happening inside WordPress in a form it can act on.

The name dates from 2011, when “WP + something” was commonly understood to mean an integration between WordPress and that thing.

Why does a dismissed Premium notice sometimes come back?

It shouldn’t.

The Premium notices are provided by Freemius and use WordPress’s normal admin request handling to remember when you dismiss them. If another plugin mishandles that request before WP fail2ban or Freemius sees it, the dismissal is never saved and the notice can appear again.

Because plugins are usually loaded alphabetically, this can be caused by almost any plugin loaded before WP fail2ban. There is very little WP fail2ban can do to work around another plugin breaking the request.

Will WP fail2ban work with my hosting?

If you can configure fail2ban and the firewall, yes.

That normally includes VPSs, dedicated servers, and other hosting where you have control of the operating system. WP fail2ban supplies the WordPress side of the integration; fail2ban and the firewall run on the server.

On managed hosting, it depends on what your provider allows. If you cannot install or configure fail2ban yourself, ask your host whether they support it or can add the WP fail2ban filters for you.

What is the Blocklist?

The WP fail2ban Blocklist uses attacks seen by participating WP fail2ban sites to identify hostile IP addresses.

That means your firewall can block an address before it attacks your site, rather than waiting for your site to see enough activity for fail2ban to act.

The Blocklist is built from WP fail2ban’s own data, not third-party threat feeds. The Free edition receives a reduced list; Premium receives the full current intelligence available for your site.

Learn more about the WP fail2ban Blocklist add-on

Why is the WordPress.org edition 5.x while Premium is 6.x?

The WordPress.org edition remains on 5.x so it can continue to support PHP 7.4. There are still a lot of WP fail2ban sites running PHP 7.4, even though PHP itself stopped supporting it nearly four years ago.

Premium is based on 6.x and requires PHP 8 or later. It has moved on significantly from 5.x as WP fail2ban continues to develop.

WordPress.org does not provide parallel release channels for different major versions, so 5.x and 6.x cannot both be offered for different PHP versions. Keeping the WordPress.org edition on 5.x is therefore a compromise: it lets development continue on modern PHP without abandoning existing WP fail2ban users who have not yet been able to move away from PHP 7.4.

What’s the difference between Free and Premium?

The Free edition covers the everyday WordPress abuse most sites need fail2ban to act on.

Premium goes further with the full Blocklist, the Web Application Firewall, persistent event history, geo‑blocking, maintained security data, and additional controls.

Compare all Free and Premium features

Is WP fail2ban a firewall?

It depends which kind of firewall you mean.

WP fail2ban is not a network firewall. It tells fail2ban when WordPress sees abusive behaviour, and fail2ban can then add bans to the server’s stateful network firewall. That firewall stops traffic before it reaches WordPress.

Premium also includes a Web Application Firewall (WAF). A WAF works at a different layer: it examines what a request is trying to make WordPress do and can block malicious application-level behaviour, including SQL injection.

The two complement each other. The network firewall blocks hostile sources; the WAF protects WordPress from malicious requests that reach WordPress.

How is WP fail2ban different from ModSecurity and other WAFs?

They work at different layers, and they can work together.

ModSecurity and similar web-server WAFs inspect HTTP requests and responses and apply rules before or around the application. That makes them good at rejecting traffic based on what the request itself looks like.

WP fail2ban runs inside WordPress, so it can see what the request actually means to WordPress: whether a login failed, whether a username exists, whether a comment was rejected as spam, what WordPress operation was attempted, and so on. It turns that application-level knowledge into events that fail2ban can act on at the network firewall.

Premium’s WAF uses the same advantage. For SQL injection, for example, it can inspect the SQL WordPress is actually about to execute rather than trying to infer solely from the incoming request whether it contains an attack.

They are complementary, not alternatives: a web-server WAF can reject malicious-looking requests before WordPress sees them; WP fail2ban can act after WordPress has interpreted them and knows what they actually mean.

Can I use WP fail2ban behind Cloudflare or another reverse proxy?

Yes, but WP fail2ban needs to know which proxies it can trust.

A reverse proxy means the connection to WordPress comes from the proxy rather than directly from the visitor. WP fail2ban uses X-Forwarded-For to recover the real client IP, but only when the connecting address belongs to a proxy you have explicitly trusted. That prevents an attacker simply supplying their own forwarding header.

WP fail2ban deliberately uses only X-Forwarded-For for client IP resolution. Keeping a single trusted path through that part of the code reduces the chances of subtle bugs or inconsistent behaviour, and X-Forwarded-For is the standard header that reverse proxies are expected to support.

Free lets you configure trusted proxy networks yourself. Premium can keep Cloudflare’s published IP ranges up to date automatically, so Cloudflare’s edge nodes remain recognised as trusted proxies as its network changes.

The CF-Connecting-IP header is not used to determine the client address. WP fail2ban only uses it as a signal that a site appears to be behind Cloudflare, so it can recommend the appropriate QuickStart configuration.

Read more about how WP fail2ban handles client IP addresses

Does WP fail2ban send my security data anywhere?

Not as part of normal operation.

WP fail2ban’s normal job is local: WordPress generates the event, WP fail2ban records it, and fail2ban acts on it on your server.

The Free edition includes Freemius, but sharing usage information with Freemius is optional: you can skip the opt-in and continue using and updating WP fail2ban. Premium uses Freemius for purchasing, licensing, and updates, so that connection is part of using the paid product. Freemius publishes what information it collects and why.

Freemius data practices

The Blocklist is a separate add-on and necessarily has its own data exchange; its README explains that separately.

SPAM

By Above All Media (aboveallmedia) on August 21, 2025

The plugin spams dashboard with the banner that cannot be dismissed and keeps reappearing.

Credit Card Fraudsters

By aiwetir on April 28, 2025

They never refunded me after my cancellation request, they charged me another month. They don’t respond to my support emails.

The free plugin works so poorly, you may as well just learn to install Fail2ban from other online tutorials and you’ll have much better success anyways

SPAM

By Gennady Kurushin (hullukettu) on August 3, 2024

The plugin spams dashboard with the banner that cannot be dismissed and keeps reappearing.

very annoying

By brt on July 26, 2024

if you manage to set it up correctly, it does what you expect, but …

creates an annoying warning in site-health if the blocklist addon is not installed, which is not free, and it hides the fact that it is not free, until you have subscribed to freemius, in my opinion this is really bad.

the contained site-health-script checks for /usr/bin/systemctl which is by default not within allowed paths for PHP on systems using open_basedir restrictions, so it creates PHP warnings everytime the script is accessed.

the code looks quite bloated for such simple functionality.

the plugin needs to be configured by adding constants to your wp-config.php file, normal GUI-configuration deactivated until you go premium.

Prevenire e meglio che curare

By Mac Boris Perc (percboris) on May 27, 2024

Prevention is better than cure.

seamless

By stixtsr on August 10, 2023

seamless integration with gridpane. all you have to do is enable and read the gridpane docs. thanks !

Great Plugin

By narratorben on December 5, 2022

Great plugin, works well and far faster than PHP based blocking solutions. many thanks

For me works 110% combined

By Boris (borisperc) on June 8, 2024

iptables+Maltrail+Fail2Ban+AbuseIP/DB+BinaryDefence/DB+kaspersky+Bitdefender

https://piramide.zapto.org/iplist-pcsnet.txt
https://piramide.zapto.org/iplist.txt
https://perc.ddns.net/iplist.txt
https://perc.ddns.net/iplist-pcsnet.txt
https://perc.ddns.net/ip.txt
https://perc.ddns.net/cms.txt

WE SAY HERE: PREVENIRE E MEGLIO CHE CURRARE,

PREVENTION IS BETTER THAN CURE!

"Hey! How do you like WP fail2ban so far?" Wheeeee!!

By daveb444 on June 17, 2022

Jesus. I’ve done everything I can to rid myself of this ad on every page of ever site I sue this plugin on. I’ve added CSS code, searched for PHP solutions, etc. No luck. Every page. Every site. Every visit. “Hey! How do you like WP fail2ban so far? Test all our awesome premium features with a 14-day free trial. No credit card required!” F— me. I will literally never buy this plugin for any reason whatsoever for that alone. They could sell the pro version for fifty cents -and I’d say no on principle. Fix this sh-t.

Cant view IP's or any information

By obbzy on June 7, 2022

Just causes critical errors..

5.5.0-LTS

  • Add support for closing keep-alive connections on blocked and failed requests (was Premium only).
  • Fix Site Health reporting compatible filters as old. [Back-port from 6.3.0]
  • Fix blocked-user list matching to be case-insensitive for array lists. [Back-port from 6.3.0]
  • Fix password reset logged as success too early. [Back-port from 6.3.0]
  • Fix pingback errors not using WP_FAIL2BAN_PINGBACK_LOG. [Back-port from 6.3.0]
  • Update Freemius library.

5.4.2-LTS

  • Update Freemius library.

5.4.1-LTS

  • Fix compatibility for WordPress 6.8.
  • Fix incorrect dependency requiring PHP>=8.1. [Premium only]
  • Add license for Packagist.

5.4.0-LTS

  • Add support for Composer. [Canonical only]
  • Add support for AspirePress Update. [Canonical only]
  • Add support for GitHub Updater. [Canonical only]
  • Improve i18n.
  • Fix harmless warning in Site Health filters check (h/t Rodolphe).
  • Update Freemius library.

5.3.4

  • Improve Site Health filter messages (h/t @yardstudio).
  • Update Freemius library.

5.3.3

  • Fix activation bug when $wp_scripts is uninitialised. [Premium only]
  • Fix world map dashboard widget. [Premium only]
  • Update Freemius library.

5.3.2

  • Drop Site Health checks for free add‑ons.

5.3.1

  • Fix regression in plugin message registration.

5.3.0

  • Add WP_FAIL2BAN_SYSLOG_TAG_HOST to simplify fail2ban configuration with journald.
  • Fix database upgrade when jQuery not loaded. [Premium only]
  • Update Freemius library.

5.2.2

  • Fix regression in Site Health when exec is disabled (h/t @ahardy42).
  • PHP 8.3: Fix harmless warning on About tab.
  • WAF: Add support for themes that update image size options (h/t Jerker Wredenmark). [Premium only]
  • Update Freemius library.

5.2.1

  • Fix bug in WAF when not logged in (h/t Rudi Diedrich). [Premium only]
  • Site Health: Add support for open_basedir (h/t Jaroslav Huba).
  • Update Freemius library.

5.2.0

  • WAF: Add new filter file for WAF events. [Premium only]
  • WAF: Add feature: prevent unauthorised user deletion. [Premium only].
  • Fix untrusted proxy message.
  • Work-around for WooCommerce bug causing double logging of password reset requests (h/t @anuja).
  • Site Health: Improve notifications.

5.1.1

  • Update Freemius library.

5.1.0

  • Web Application Firewall. [Premium only]
  • Add PTR record lookup to event report. [Premium only]
  • Improve report performance. [Premium only]
  • Site Health: Check fail2ban is running.
  • Site Health: Obsolete Filters – Detect DigitalOcean Droplet and link to documentation.
  • Fix harmless warning (h/t @Yavor).
  • Fix warning caused by bug in Google Sitekit (h/t @DaWolfey).
  • Update Freemius library.

5.0.1

  • Tweak Site Health notifications.
  • Update Freemius library.

5.0.0 “Delphi”

  • IPv6 support.
  • Akismet support. [Premium only]
  • Auto-update Cloudflare IPs. [Premium only]
  • Event hooks. [Premium only]
  • Performance improvements:
    • Improve reports. [Premium only]
    • Cache IP lists. [Premium only]
    • Cache Plugin API message registration. [Premium only]
  • Site Health: Check installed filters against previous versions.
  • Moved “Authentication attempt for unknown user” to wordpress-soft.conf.
  • Moved “extra” Comment messages to wordpress-soft.conf.
  • Show date/time in local timezone (h/t @geniusmedia). [Premium only]
  • Deprecate WP_FAIL2BAN_LOG_COMMENTS_EXTRA and WP_FAIL2BAN_COMMENT_EXTRA_LOG; use WP_FAIL2BAN_LOG_COMMENT_ATTEMPTS and WP_FAIL2BAN_COMMENT_ATTEMPT_LOG instead.
  • Update Freemius library.

Please read the notes before upgrading.

4.4.0.9

  • Preparation for v5: prevent auto-updating across major release.
  • Update Freemius library.

4.4.0.8

  • Back-port fix for mu-plugins activation.
  • Update Freemius library.

4.4.0.7

  • Back-port fix for type error in menu-fixer when viewing Event Log (h/t @geniusmedia). [Premium only]
  • Back-port fixes for event summaries. [Premium only]
  • Update Freemius library.

4.4.0.6

  • Fix initialisation error in event log. [Premium only]
  • Fix type error in event log when no events available. [Premium only]
  • Update Freemius library.

4.4.0.5

  • Fix type error on Remote IPs tab with no MaxMind database configured (h/t @Tobias‑Conrad). [Premium only]
  • Update Freemius library.

4.4.0.4

  • Fix warning with array of blocked users (h/t @Znuff).
  • Fix reports. [Premium only]

4.4.0.3

  • Fix type error (h/t @brianshim).

4.4.0.2

4.3.2.2

  • Add cron event to update trusted Cloudflare IP ranges weekly. [Premium only]
  • Add cron event to update trusted Jetpack IP ranges weekly. [Premium only]
  • Add cron event to update MaxMind database weekly. [Premium only]
  • Workaround for missing syslog constants in Windows (h/t @dmarkowicz).
  • Clarify upgrade message on Last 5 Messages widget. [Free only]
  • Merge About and Status tabs. [Premium only]
  • Update Freemius library.

4.3.2.1

  • Add support for WP fail2ban Blocklist.
  • Add new Standard Configurations.
  • Improve Help links.
  • Fix logging checkboxes [Premium only].
  • Fix incorrect constant for disabling last messages (h/t @kermina).
  • Fix false positive with blocking user enumeration when a Contributor tries to list posts by another user.
  • Fix index issue with ancient versions of MySQL.
  • Fix harmless warning with a defined but empty WP_FAIL2BAN_PROXIES (h/t @stevegrunwell).
  • Back-port new Block event class.
  • Update Freemius library.
  • Change to GPLv3 with additional terms as per Section 7.

4.3.2.0

  • Add support for blocking by Country. [Premium only]
  • Add XML‑RPC blocking; allow trusted IPs and Jetpack (h/t @mhweb). [Premium only]

4.3.0.9

  • Fix incorrect constant for disabling last messages (h/t @kermina).
  • Fix false positive with blocking user enumeration when a Contributor tries to list posts by another user.
  • Fix index issue with ancient versions of MySQL. [Premium only]
  • Fix harmless warning with a defined but empty WP_FAIL2BAN_PROXIES (h/t @stevegrunwell).
  • Back-port new Block event class.
  • Update Freemius library.

4.3.0.8

  • Workaround issue with user enumeration blocking being triggered by Gutenberg pre‑loading Author list. (h/t @brrrrrrrt) [WordPress only]

4.3.0.7

  • Finish refactoring to allow inclusion of constants in wp‑config.php (h/t @iCounsellor).
  • Fix MaxMind database update. [Premium only]

4.3.0.6

  • Fix Forbidden error on Posts page for roles below Editor when user enumeration blocking enabled. [WordPress only]

4.3.0.5

  • Fix empty username detection for multisite.
  • Fix harmless warning when activating new multisite install.
  • Fix esoteric edge-case where wp‑load.php is loaded via a script run from the CLI in a directory with a functions.php file.

4.3.0.4 “Columbo”

4.2.8

  • Add link to new support forum.
  • Fix user enumeration conflict with Gutenberg (h/t @dinghy).
  • Fix notices wrt admin menu (h/t @marioivangf).
  • Fix harmless XDebug notice (h/t @dinghy).
  • Update Freemius library.

4.2.7.1

  • Fix error when blocking user enumeration via oembed (h/t @wordpressfab).

4.2.7

  • Fix error when blocking user enumeration via REST.
  • Fix buttons on Settings tabs.

4.2.6

  • Add support for Remote Tools add-on.
  • Add support for the new ClassicPress security page.
  • Improved user enumeration blocking.

4.2.5.1

  • Fix premium activation issue with PHP < 7.0.

4.2.5

  • Properly fix PHP 5.3 support; tested on CentOS 6. Does not support any UI or Premium features.
  • Fix potential issue with WP_FAIL2BAN_BLOCK_USER_ENUMERATION if calling REST API or XML‑RPC from admin area.

4.2.4

  • Add filter for login failed message.
  • Fix logging spam comments from admin area.
  • Fix Settings link from Plugins page.
  • Update Freemius library

4.2.3

  • Workaround for some versions of PHP 7.x that would cause define()s to be ignored.
  • Add config note to settings tabs.
  • Fix documentation links.

4.2.2

  • Fix 5.3 compatibility.

4.2.1

  • Completed support for WP_FAIL2BAN_COMMENT_EXTRA_LOG.
  • Add support for 3rd-party plugins; see Developers.
  • Change logging for known-user with incorrect password; previously logged as unknown user and matched by hard filters (due to limitations in older versions of WordPress), now logged as known user and matched by soft.
  • Bug-fix for email-as-username – now logged correctly and matched by soft, not hard, filters.
  • Bug-fix for regression in code to prevent Free/Premium conflict.

4.2.0

  • Not released.

4.1.0

  • Add separate logging for REST authentication.
  • Fix conflict with earlier versions preinstalled in mu‑plugins. See Is WPf2b Already Installed?.

4.0.5

  • Add WP_FAIL2BAN_COMMENT_EXTRA_LOG.
  • Add WP_FAIL2BAN_PINGBACK_ERROR_LOG (future functionality).
  • Change WP_FAIL2BAN_LOG_SPAM to use LOG_NOTICE.
  • Change WP_FAIL2BAN_SPAM_LOG to LOG_AUTH.
  • Change WP_FAIL2BAN_LOG_COMMENTS_EXTRA events to use LOG_NOTICE by default.
  • Fix conflict with 3.x in mu-plugins.

4.0.2

  • Fix PHP 5.3 compatibility.
  • Bug-fix for WP_FAIL2BAN_LOG_COMMENTS_EXTRA.
  • Bug-fix for WP_FAIL2BAN_REMOTE_ADDR summary.

4.0.1

  • Add extra features via Freemius. This is entirely optional. WPf2b works as before, including new features listed here.
  • Add settings summary page (Settings -> WP fail2ban).
  • Add WP_FAIL2BAN_PASSWORD_REQUEST_LOG.
  • Add WP_FAIL2BAN_SPAM_LOG.
  • Add WP_FAIL2BAN_LOG_COMMENTS_EXTRA – enable logging for attempted comments on posts which are:
    • not found,
    • closed for commenting,
    • in the trash,
    • drafts,
    • password protected
  • Block user enumeration via REST API.

4.0.0

  • Not released.

3.6.0

3.5.3

3.5.1

3.5.0

3.0.3

3.0.2

  • Prevent double logging in WP 4.5.x for XML‑RPC authentication failure

3.0.1

3.0.0

2.3.2

2.3.0

2.2.1

2.2.0

2.1.1

  • Minor bug-fix.

2.1.0

2.0.1

2.0.0

1.2.1

  • Update FAQ.

1.2

  • Fix harmless warning.

1.1

  • Minor cosmetic updates.

1.0

  • Initial release.