Got a firewall? Use it.

fail2ban already handles SSH. Let it handle WordPress too.

Get WP fail2ban Free Explore Premium Documentation

WP fail2ban is different

An attack does not become less expensive because WordPress says “blocked”. If the request reaches PHP, opens a database connection, increments a counter and renders a response, the attacker is still making your site work.

WP fail2ban gets the work out of PHP. WPf2b recognises WordPress-specific behaviour reliably — failed logins, blocked usernames, XML-RPC abuse, user enumeration, comment spam, suspicious password resets. WPf2b turns those events into structured syslog messages. fail2ban reads them and applies the ban at the firewall.

A firewall ban is a real ban. No PHP loop. No database counter. No "blocked" page that still costs the server work. The attacker is stopped by the part of the system meant to do that job, before WordPress is involved again.

Most WordPress security plugins fight inside PHP. They inspect every request, keep counters in the database, and try to enforce bans from PHP. It is a layer too high for the job.

WPf2b is also unusually quiet to live with. Because the heavy lifting happens outside WordPress, WPf2b has a small, well-defined surface area. Configuration constants added years ago still work. Upgrades rarely require revisiting a working setup. Install it, connect the filters, and let the operating system do the part it was built to do.

WPf2b has worked this way since 2011. The architecture hasn’t changed because the problem hasn’t.

Get WP fail2ban Free

WP fail2ban will work with your hosting (probably)

Preinstalled

You may already have it without realising — DigitalOcean WordPress Droplets ship with WPf2b already installed. Check the WordPress plugins screen first; if it is active there, check whether the fail2ban filters are up-to-date.

Full self-managed

If you run your own VPS, dedicated server, or home-lab WordPress box, WPf2b will definitely work. Install fail2ban with your package manager if it is not already there, copy the WPf2b filters into place, and enable the jails.

cPanel and similar shared hosting

It depends on the host. Many reputable shared hosts already run fail2ban and expose enough of the logging path for WPf2b to work. Ask support whether WordPress syslog messages can be used by fail2ban on your account.

Fully managed WordPress hosting

Hosts such as WP Engine, Kinsta, and Pantheon manage the whole stack for you, security included. WPf2b needs access these hosts don't typically give you, so the free version won’t deliver much. Premium is a different matter: the WAF runs inside WordPress, catching SQL injection and guarding sensitive operations in ways general hosting security usually doesn't. On managed hosting, that's worth paying for.

Free protection from the usual suspects

The Free version of WP fail2ban covers the attacks you’d expect, sends useful signals to fail2ban, and closes off several common routes before they get far.

Authentication & login

Failed logins, unknown users, blocked usernames and suspicious password resets all become useful fail2ban signals — across normal WordPress login, REST and XML-RPC.

User-enumeration defence

Don’t hand bots the usernames they need for the next step. WPf2b closes the common enumeration routes through author URLs, REST, sitemaps and oEmbed.

Comments, pingbacks & trackbacks

Bots rarely check whether they’re allowed to post first. WPf2b catches attempts against places comments shouldn’t be possible, along with abusive pingback and trackback behaviour.

XML-RPC

One HTTP request can hide a whole batch of login attempts. WPf2b detects XML-RPC multicall authentication failures and turns them into something fail2ban can act on.

Spam

Spam discovered later still points back to the original source. WPf2b uses the IP stored with the comment, so marking an old comment as spam can still identify the right offender.

Proxy-aware IP handling

Behind a reverse proxy, blocking the wrong address is worse than useless. WPf2b only trusts forwarded client addresses from proxies you configure, and rejects untrusted X-Forwarded-For headers.

Premium, when you need it

You run a personal or small business site

The free version gives the site the protection: WPf2b recognises abuse, fail2ban bans repeat offenders. Premium is for when you want to see what’s happening without reading syslog. The dashboard shows who has been trying, from where, and how often. It turns “I think it is working” into “there it is”.

You manage sites for clients

Premium pays back in support time. Reports let you show clients what their site is experiencing without handing them shell access or pasting log extracts into emails. For multisite networks, the silver tier gives you the same visibility across the whole network instead of one site at a time.

You need an audit trail for compliance

Events leave WordPress through syslog and flow into whatever you already use to aggregate or archive logs — journald, Graylog, Splunk, ELK, or plain log files. Premium adds in-WordPress event reporting on top of that. Since v6.3, each Premium release ships with an SBOM.

You just want to support the work

Some people buy a licence they'll never install, purely to back the work. Some even buy the Gold tier — it adds nothing much over the cheaper tiers, but a software licence is a cleaner way to support a project than a donation, and usually an easier one to put through the books.

FAQ

Almost never. By design. The in-WordPress configuration has stayed unusually stable over years of releases. You may need to update fail2ban filter files when moving between plugin versions, especially if you want new event types, but a working WordPress configuration should not need regular attention.

Free gives you the core protection: WordPress event logging for fail2ban. Premium adds visibility and extra controls: reports, dashboards, geo-blocking, XML-RPC blocking, Cloudflare and Jetpack IP handling, honeypots and the WAF.

The free plugin is GPL-licensed, like WordPress itself. Premium is a paid commercial version.

Yes. WPf2b has been maintained since 2011 and is still being developed. Security is a process, not a destination.

Small. WPf2b logs the event once, fail2ban reads the log, and future requests from the attacker are stopped at the firewall before reaching PHP again.

Often, yes. It depends on whether your host runs fail2ban and allows WordPress syslog events to reach it. If you are not sure, ask support whether a WordPress plugin can send syslog messages that their fail2ban setup can read.

On a self-managed server, yes, unless it is already installed. On shared hosting, the host normally controls fail2ban. WPf2b supplies the WordPress-side events and the filter patterns; fail2ban itself is the server component that applies bans.

You can still install the plugin, but the banning side depends on the host. They control the firewall and the fail2ban service, so you’ll need to ask support whether they can enable or already support WPf2b filters. If they cannot, the plugin can still log events, but the firewall bans will not happen on that host.

Yes. WPf2b supports MU use, and Site Health includes checks to help catch common deployment mistakes. It is a good fit for managed fleets where the security baseline should not depend on each site administrator leaving a normal plugin active.

Yes. The free plugin runs on multisite, and Premium has a multisite tier for network-level reporting. Useful when “is this site being attacked?” has turned into “what is happening across the network?”

WPf2b does a different job — turning WordPress events into system-level signals for fail2ban — so it usually sits alongside other security plugins without conflict. The exception: if another plugin stops a request before WordPress reaches the relevant hook, WPf2b will not see that particular event.