Comments, pingbacks, and trackbacks
TL;DR
WP fail2ban lets you keep comments, pingbacks, and trackbacks available while giving different outcomes appropriate consequences. For ordinary comments, accepted submissions can support a separate volume limit, invalid targets become soft events, and explicit spam decisions become hard events.
WordPress already knows whether a contribution succeeded, whether the target could accept it, and whether the site has classified the result as spam. WP fail2ban turns those different judgements into events with different meanings for fail2ban.
Pingbacks and trackbacks follow the same principle, with successful and failed requests producing events appropriate to their outcomes. Whether to expose pingbacks at all is a separate XML-RPC policy decision.
WP fail2ban Free can write accepted comments to the extra filter and invalid attempts to the soft filter. It writes successful pingbacks and trackbacks to the soft filter, and their failures and spam decisions to the hard filter. Premium makes the controls easier to configure and keeps their outcomes in a persistent event history.
Put a ceiling on accepted comments
WP fail2ban can record each accepted comment through its extra filter. You can match that filter with its own fail2ban jail and rate-limit otherwise valid comments from the same source. The threshold is yours, so a busy community site and a quiet company blog do not need the same policy.
A bot can keep posting comments that pass WordPress's checks and have not yet been classified as spam. The separate jail lets you put a ceiling on that volume without changing how WordPress accepts an individual comment.
More about rate-limiting accepted comments.
Let repetition expose invalid comment bots
Bots often submit comments without checking whether the target exists or can accept one. WordPress already knows when there is nowhere valid for the comment to go.
WP fail2ban turns that knowledge into a soft event. One attempt can come from an old link or stale browser tab; repeated attempts from the same source are much stronger evidence of automation. fail2ban can rate-limit the pattern without treating the first mistake as an attack.
Act on spam decisions already made
WordPress, a moderator, or an anti-spam plugin decides whether content is spam. WP fail2ban turns that judgement into a hard event tied to the source that submitted the content. The same policy applies to comments, pingbacks, and trackbacks.
If Akismet stores a comment as spam, Free handles it through the normal spam event. Premium also captures obvious spam that Akismet discards before storage. Companion add-ons apply the same principle to Contact Form 7 and Gravity Forms: the form system identifies spam, and WP fail2ban gives the decision to the firewall.
More about blocking spam comments, pingbacks, and trackbacks.
Handle pingbacks and trackbacks by outcome
WP fail2ban records successful pingbacks and trackbacks as soft events and failures as hard events. A configured fail2ban jail can allow occasional use and act when one source repeats it. If WordPress or a moderator later classifies the result as spam, the normal spam decision applies.
Whether to expose pingbacks is a separate decision. Premium can keep the rest of XML-RPC closed while allowing the pingback method, and the rate limit reduces how readily a caller can make your site contact someone else's server.
More about allowing pingbacks responsibly.
Let WordPress interpret and the firewall enforce
WordPress knows whether it accepted a comment, why it rejected a target, whether a pingback or trackback succeeded, and whether content was classified as spam. WP fail2ban preserves that meaning in separate events, and a configured fail2ban jail applies your site's thresholds at the host firewall.
