Fail2ban jail for WordPress login brute-force protection

security wordpress fail2ban ubuntu hosting

Expands basic Fail2ban setup with WordPress-specific filters.

⚠️ Start conservative and monitor false positives.

Example jail

[wordpress-login]
enabled = true
port = http,https
filter = wordpress-login
logpath = /var/log/apache2/access.log
maxretry = 8
findtime = 600
bantime = 3600

Minimal filter example

[Definition]
failregex = <HOST> .* "POST /wp-login\.php.*" (200|302)

Note: Combined vs common log formats differ. Adjust regex as needed.

Fail2ban setup for WordPress on Ubuntu — basic setup
Essential security hardening for self-hosted WordPress on Ubuntu — full hardening