TL;DR

WP fail2ban Blocklist supplies a current signal from attacks observed across participating WordPress sites. Public abuse lists can add longer-term reputation built from independent reports.

If you use both, keep Blocklist in its own fail2ban jail with the recommended 24-hour ban, and load the public list directly into a separate firewall table. Only report activity your site has observed directly; receiving an address from Blocklist is not evidence that it attacked your site.

Combine current activity with longer-term reputation

Blocklist helps you respond quickly to addresses involved in current WordPress attacks. A compromised system may be cleaned or an address may change hands, so the service does not need to turn every recent observation into a lasting judgement.

A reputable public abuse list works over a longer period. Independent reports allow persistent offenders to accumulate a reputation that may justify a longer response.

You can use the two sources together without asking them to mean the same thing: Blocklist for the current wave, and public reputation for addresses that keep attracting independent evidence.

Give Blocklist its own temporary jail

Blocklist should have its own fail2ban jail with a 24-hour ban. A public abuse list is normally loaded directly into a separate firewall table, so fail2ban is not involved in enforcing it.

That separation lets the Blocklist jail expire current warnings on its own schedule while the firewall table follows the public list's update and removal policy.

The temporary Blocklist ban stops the current source immediately. If the address remains active after the ban expires, WordPress can see fresh abuse and your site can contribute a new observation to the network. If it has stopped, the old signal can expire with it.

Keeping a Blocklist address behind the firewall for much longer prevents WordPress from seeing whether it is still active. Use longer-lived firewall entries when the evidence describes longer-term reputation.

Report only what your site observes

When Blocklist gives your site an address, it is passing on another participant's observation. If your firewall blocks that address before it reaches WordPress, it has not attacked your site.

Do not submit the received address to a public abuse list as though you observed it yourself. Repeating one Blocklist observation through many receiving sites would make copied evidence look like independent reports and weaken the public list.

If the address later attacks your site after the temporary ban expires, you then have a local event on which to base any report.

Keep the two sources independent

Blocklist and public abuse lists are useful together because they bring you different evidence. One provides fast, WordPress-specific warnings from current activity; the other preserves broader reputation under its own reporting rules.

Separate enforcement paths let you choose an appropriate response to each without confusing a warning received from the network with an attack your site witnessed.

More about how Blocklist works.