TL;DR

WP fail2ban Premium lets you keep XML-RPC blocked generally and allow only the source addresses or CIDR networks you trust. This source-based policy suits a private client that needs the wider XML-RPC interface. WordPress authentication still decides what an allowed caller can do.

This works best for callers with stable, well-controlled addresses and for sites that can identify the real client IP reliably.

Turn a public endpoint into a private one

WP fail2ban lets you establish a closed baseline and name the addresses or CIDR networks that may pass it. A private publishing system, remote management service, or custom integration keeps working, while unrelated requests meet the same hard block as any other prohibited XML-RPC access.

Keep authentication and network trust separate

An address on the allowlist is allowed to contact XML-RPC. It is not automatically logged into WordPress and does not acquire any WordPress capability.

That gives you two independent checks: the request must come from an allowed source, and the caller must still authenticate successfully for the operation it wants to perform.

Do not combine a trusted-source allowlist with the pingbacks-only policy. That policy limits XML-RPC to the pingback method, so the allowed client cannot use the wider interface for which you trusted it.

Keep the trusted boundary narrow

The value of the allowlist depends on the addresses representing callers you genuinely control or trust. A broad shared network gives the same access opportunity to every system using it.

Prefer the smallest stable address range that fits the integration. If a caller moves unpredictably between consumer or shared addresses, an IP allowlist may not be the right policy for it.

Use the address WordPress actually receives

A reverse proxy or CDN changes where the connection appears to come from. WP fail2ban must be configured to recover the real client address before an XML-RPC allowlist can distinguish the trusted caller from the proxy.

Get that boundary right first; otherwise the policy may admit or block the proxy rather than the client behind it.

More about getting the real client IP behind a proxy.

More about XML-RPC policy.