Got a firewall? Use it.

fail2ban already handles SSH. Let it handle WordPress too.

Get WP fail2ban Free Explore Premium Documentation

WP fail2ban is different

An attack does not become less expensive because WordPress says “blocked”. If the request reaches PHP, opens a database connection, increments a counter and renders a response, the attacker is still making your site work.

WP fail2ban gets the work out of PHP. WPf2b recognises WordPress-specific behaviour reliably — failed logins, blocked usernames, XML-RPC abuse, user enumeration, comment spam, suspicious password resets. WPf2b turns those events into structured syslog messages. fail2ban reads them and applies the ban at the firewall.

A firewall ban is a real ban. No PHP loop. No database counter. No "blocked" page that still costs the server work. The attacker is stopped by the part of the system meant to do that job, before WordPress is involved again.

Most WordPress security plugins fight inside PHP. They inspect every request, keep counters in the database, and try to enforce bans from PHP. It is a layer too high for the job.

WPf2b is also unusually quiet to live with. Because the heavy lifting happens outside WordPress, WPf2b has a small, well-defined surface area. Configuration constants added years ago still work. Upgrades rarely require revisiting a working setup. Install it, connect the filters, and let the operating system do the part it was built to do.

WPf2b has worked this way since 2011. The architecture hasn’t changed because the problem hasn’t.

Get WP fail2ban Free

Free protection from the usual suspects

The Free version of WP fail2ban covers the attacks you’d expect, sends useful signals to fail2ban, and closes off several common routes before they get far.

Authentication & login

Failed logins, unknown users, blocked usernames and suspicious password resets all become useful fail2ban signals — across normal WordPress login, REST and XML-RPC.

User-enumeration defence

Don’t hand bots the usernames they need for the next step. WPf2b closes the common enumeration routes through author URLs, REST, sitemaps and oEmbed.

Comments, pingbacks & trackbacks

Bots rarely check whether they’re allowed to post first. WPf2b catches attempts against places comments shouldn’t be possible, along with abusive pingback and trackback behaviour.

XML-RPC

One HTTP request can hide a whole batch of login attempts. WPf2b detects XML-RPC multicall authentication failures and turns them into something fail2ban can act on.

Spam

Spam discovered later still points back to the original source. WPf2b uses the IP stored with the comment, so marking an old comment as spam can still identify the right offender.

Proxy-aware IP handling

Behind a reverse proxy, blocking the wrong address is worse than useless. WPf2b only trusts forwarded client addresses from proxies you configure, and rejects untrusted X-Forwarded-For headers.

Premium protection from the unusual suspects

Some protection needs more than a better filter. Premium adds advance intelligence, active protection inside WordPress, maintained security data, and persistent reporting.

Block bots before they attack

The WPf2b Blocklist learns from attacks seen across participating sites. The free version shares a reduced set; Premium includes the full Blocklist, giving your site hostile IP addresses it hasn’t encountered yet so the firewall can block them before WordPress ever sees them.

Block the injection, not the signature

WPf2b checks the SQL WordPress is actually about to run. There are no attack signatures. Whether it’s a zero-day or a well-known exploit, the WAF blocks the injection itself.

Investigate after they attack

Premium keeps a structured history of security events, so you can follow an attack after the fact instead of relying on whatever is still in the system log. Trace activity by IP, country, username, event type and more to see what happened and how it unfolded.

Maintain your protection

Some protection depends on data that changes outside WordPress. Premium keeps geolocation data and trusted Cloudflare and Jetpack network ranges up to date automatically, so those protections don’t quietly go stale.

See plans and pricing Compare Free vs Premium

WP fail2ban will work with your hosting (probably)

Preinstalled

You may already have it without realising — DigitalOcean WordPress Droplets ship with WPf2b already installed. Check the WordPress plugins screen first; if it is active there, check whether the fail2ban filters are up-to-date.

Full self-managed

If you run your own VPS, dedicated server, or home-lab WordPress box, WPf2b will definitely work. Install fail2ban with your package manager if it is not already there, copy the WPf2b filters into place, and enable the jails.

cPanel and similar shared hosting

It depends on the host. Many reputable shared hosts already run fail2ban and expose enough of the logging path for WPf2b to work. Ask support whether WordPress syslog messages can be used by fail2ban on your account.

Fully managed WordPress hosting

Hosts such as WP Engine, Kinsta, and Pantheon manage the whole stack for you, security included. WPf2b needs access these hosts don't typically give you, so the free version won’t deliver much. Premium is a different matter: the WAF runs inside WordPress, catching SQL injection and guarding sensitive operations in ways general hosting security usually doesn't. On managed hosting, that's worth paying for.

Premium, when you need it

You run your own site

Free already gives you solid WordPress-aware protection through fail2ban, and the free Blocklist adds network intelligence. Premium makes sense when you want the full Blocklist, active protection inside WordPress, and a persistent history of what happened.

You manage sites for clients

Security maintenance scales badly when every site needs its own collection of exceptions, data updates and workarounds. Premium takes care of things like trusted network ranges and geolocation data automatically, while adding protections you’d otherwise have to build and maintain yourself.

You need an audit trail for compliance

Syslog is excellent at feeding fail2ban, but it isn’t designed to be a security report. Premium keeps the WordPress side of the story in a structured database, so you can show what happened, when it happened, and where it came from.

You want to support the work

Some people buy Premium for exactly that reason. WP fail2ban has been free since 2011, and buying Premium helps fund the work that keeps both the free and paid versions maintained and moving forward.

FAQ

Often, yes. It depends on whether your host runs fail2ban and allows WordPress syslog events to reach it. If you are not sure, ask support whether a WordPress plugin can send syslog messages that their fail2ban setup can read.

Usually very little. The core WPf2b path logs an event once, then fail2ban stops future requests from that attacker at the firewall before they reach PHP again.

Premium protections that run inside WordPress necessarily do more work. In particular, SQLi protection checks the SQL before it is executed; the more extensive Core SQL checking is optional because it has a greater performance cost.

On a self-managed server, yes, unless it is already installed. On shared hosting, the host normally controls fail2ban. WPf2b supplies the WordPress-side events and the filter patterns; fail2ban itself is the server component that applies bans.

You don’t need shell or root access to install WPf2b, but firewall bans depend on the host. They control the firewall and the fail2ban service, so you’ll need to ask whether they support WPf2b filters.

If they don’t, the free version can still log events but won’t be able to cause firewall bans. Premium can still provide protection inside WordPress through the WAF, including SQL injection protection.

Yes. WPf2b supports MU use, and Site Health includes checks to help catch common deployment mistakes. It is a good fit for managed fleets where the security baseline should not depend on each site administrator leaving a normal plugin active.

Yes. The free plugin works with WordPress multisite. Premium supports multisite too, with the additional protections available across the network and network-level event history so you can investigate individual sites or see what is happening across the installation.

WPf2b does a different job — turning WordPress events into system-level signals for fail2ban — so it usually sits alongside other security plugins without conflict. The exception: if another plugin stops a request before WordPress reaches the relevant hook, WPf2b will not see that particular event.

Very rarely, by design. WPf2b’s WordPress configuration has stayed unusually stable over years of releases. Premium automatically keeps external data such as geolocation data and trusted Cloudflare and Jetpack network ranges up to date.

You may occasionally need to update the fail2ban filter files when new event types are added, but a working configuration should not need regular attention.

Free gives you the core WP fail2ban protection, plus a reduced version of the Blocklist. Premium goes beyond the filter: it includes the full Blocklist, active protection inside WordPress including the signatureless SQLi WAF, maintained security data, and a persistent event history for investigation and reporting.

The free plugin is GPL-licensed, like WordPress itself. Premium is a paid commercial version.

Yes. WPf2b has been maintained since 2011 and is still being actively developed. Its architecture has remained fundamentally the same because the problem it solves has remained fundamentally the same.

Put your firewall to work

WP fail2ban Free

The core WordPress-aware protection, plus the free Blocklist.

WP fail2ban Premium

Full Blocklist, signatureless WAF, maintained protection and persistent reporting.

Get WP fail2ban Free See plans and pricing