TL;DR

WP fail2ban Free records attempts to comment where WordPress knows no comment can be accepted as soft events. A configured fail2ban jail can allow an isolated mistake and rate-limit a source that repeats it.

Free is configured through wp-config.php. Premium lets you configure the control through WordPress admin and keeps the reason each target was rejected in the event history.

Turn an invalid target into a soft event

WordPress knows when a post is missing, closed to comments, trashed, a draft, or password-protected, and when a reply targets an unapproved comment. WP fail2ban records that reason without inspecting the text or looking for bot signatures.

The event remains soft because one invalid target does not prove that the person or program submitting it is hostile.

Let repetition supply the confidence

An invalid target is suspicious, but not conclusive. A legitimate visitor can submit an old page after the site has changed underneath it.

Bots that spray comments across URLs behave differently. They keep finding posts and conversations that cannot accept what they send, producing a pattern the soft filter can recognise.

You choose the threshold. fail2ban can allow the isolated mistake and stop the source that keeps repeating it.

See what bots are probing

Premium keeps a persistent event history, including why WordPress rejected each target.

That detail helps you distinguish broad comment spraying from repeated attempts against a particular part of the site.

Leave accepted comments and spam decisions alone

This control does not decide whether an accepted comment is spam, and it does not interfere with comments that WordPress can accept normally. Those are different outcomes with different meanings.

More about comments, pingbacks, and trackbacks.

More about blocking spam comments, pingbacks, and trackbacks.