WordPress-aware WAF » Prevent unauthorised user deletion
TL;DR
WP fail2ban Premium checks permission when WordPress is about to delete a user account. In blocking mode, it stops anonymous and other unauthorised requests at the operation itself, regardless of which plugin or route exposed it, then writes the attempt to the dedicated WAF filter for fail2ban.
Start in logging-only mode to confirm that legitimate administration, plugins, and custom account-management workflows arrive with the expected permission before you enforce it.
Stop anonymous requests from deleting users
A plugin vulnerability can expose account deletion without checking that an administrator made the request. By the time WordPress is asked to remove the user, the original request may not look unusual to a conventional firewall.
WP fail2ban checks permission at the deletion itself. The anonymous user cannot delete an account, so the WAF stops the operation and records what happened. An authorised administrator can continue to manage users normally.
Protect the operation, not one route
WP fail2ban applies the check wherever the protected deletion operation is reached. The route, plugin, and vulnerability can change; an unauthorised request still cannot delete a user.
The same check also stops a logged-in user without the necessary permission.
See what enforcement would change
Logging-only mode shows you the deletion attempts WP fail2ban would stop while allowing the existing workflow to continue. You can confirm that legitimate user management arrives with the expected permission before you enable blocking. Because the operation is allowed, the preview decision does not go to the dedicated WAF filter.
Most sites delete users through ordinary administration, but a plugin or custom account-management workflow may assume WordPress will accept the deletion without checking permission there.
The check itself is straightforward. Logging first protects you from an unexpected compatibility problem, not from uncertainty about what the control is meant to do.
Stop the attempt beyond WordPress
When the WAF blocks a deletion, it writes the attempt to the dedicated WAF filter. Where you can configure fail2ban, a jail can block the source at the host firewall.
The account remains in place, and further requests from the same source can be stopped before WordPress processes them.
