TL;DR

WordPress, a moderator, or an anti-spam plugin decides whether a comment is spam. WP fail2ban Free turns that judgement into a hard event for fail2ban, tied to the source that submitted the content. The same policy applies to comments, pingbacks, and trackbacks.

Premium also captures obvious spam that Akismet discards before storage and keeps the decisions in a persistent event history. Companion add-ons bring the same approach to Contact Form 7 and Gravity Forms.

Turn a spam decision into a hard event

WP fail2ban lets WordPress, a moderator, or an anti-spam plugin supply the spam decision, then turns it into a strong security signal. It does not add another scoring model or try to infer spam from request patterns.

A configured fail2ban jail can act on that hard event at the host firewall. Spam detection stays with the system that has seen the content and made the decision.

Keep the event tied to the original source

Spam is not always identified during the original request. A moderator may classify a comment later, from a different connection. WP fail2ban writes the hard event when that decision is made, even if it happens long after the submission.

The event remains tied to the IP address that submitted the content, not the person who later marked it as spam. fail2ban can then act on the source of the submission without confusing moderation with the attack.

Capture Akismet decisions that would otherwise disappear

When Akismet stores a comment as spam, WP fail2ban Free handles it through the normal spam event. Akismet can also discard obvious spam without leaving a stored comment for WP fail2ban to find later.

Premium captures that decision as it happens, turns it into a hard event, and preserves it in the event history. Akismet still decides what is spam; WP fail2ban makes sure the source does not become invisible merely because the content was discarded early.

Apply the decision across comments and forms

Comments, pingbacks, and trackbacks can all be accepted by WordPress and later classified as spam. WP fail2ban applies the same moderation decision to each of them.

Accepting pingbacks is a separate policy choice. Once WordPress accepts one, its spam status can be enforced like any other comment.

The companion add-ons for Contact Form 7 and Gravity Forms follow the same division of responsibility. The form or its anti-spam tools identify the submission as spam, and WP fail2ban turns that judgement into an event the firewall can enforce.

Your spam policy can therefore reach beyond the WordPress comments system without asking WP fail2ban to become a content classifier.

More about allowing pingbacks responsibly.

Use the spam state deliberately

Marking a comment as spam is stronger than deleting it. With WP fail2ban active, that moderation choice can have firewall consequences for the original source.

That is useful when spam means unsolicited or abusive automated content. It is less useful if moderators use the status as a general filing category for comments they merely do not want.

WP fail2ban can act confidently when the site's moderation decision means what it says.