Protecting WordPress with Fail2ban on Ubuntu requires three pieces to agree: WordPress must write recognizable security events, a Fail2ban filter must parse those events, and a jail must connect the filter to the real log source and a ban action. Use the wordpress-hard filter for events your policy treats as immediately hostile, wordpress-soft for ordinary failed logins, and configure the backend for either the actual syslog file or systemd journal. Keep every site-specific change in .local files or jail.d; never edit packaged Fail2ban configuration or the standard WordPress filters in place.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What Fail2ban protects—and what it does not
Fail2ban is a log-driven control. It watches a source such as a text log or the systemd journal, applies a filter that recognizes a failure and extracts an IP address, then runs an action when a jail’s retry policy is exceeded. A jail is the connection between the filter, log source, retry limits and ban action.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For WordPress, this means Fail2ban can react to repeated authentication abuse, blocked-user events and other events emitted by the WP fail2ban integration. It does not repair vulnerable plugins, replace updates, provide multifactor authentication or stop an attack before WordPress records an event. Treat it as a host-level response layer alongside normal WordPress and web-server hardening.
Understand Ubuntu’s Fail2ban configuration model
Ubuntu’s jail.conf(5) model separates configuration into four related file types:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Global configuration: defaults such as ban timing and the address family.
- Filters: regular expressions and event rules that identify failures and extract an address.
- Actions: the mechanism that applies and removes a firewall or other ban.
- Jails: service-specific combinations of a filter, log source, action and thresholds.
Packaged .conf files are defaults supplied by Fail2ban or a distribution package. Leave them untouched. Put local policy in /etc/fail2ban/jail.local or separate files under /etc/fail2ban/jail.d/. This preserves your changes across package upgrades and makes it clear which settings are intentional.
Upstream jails are disabled by default. Enabling every available jail is not safer: a jail pointed at a nonexistent file, the wrong format or an unrelated service can fail to start or generate false positives. Enable only services and logs that actually exist on this host.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPrerequisites and a safe installation sequence
Confirm the deployment
- An Ubuntu server running the WordPress site.
- Administrative access with
sudo. - The WP fail2ban integration installed and configured to emit the events its filters expect.
- A way to identify whether those events arrive in a syslog file or systemd journald.
- A web server, usually Apache or Nginx, with its access and error log locations known.
Before enabling a jail, deliberately create a harmless test event or inspect recent production entries and confirm the exact text, timestamp format and source. A filter cannot ban an address from a log it never receives.
Install and start the service
- Install Fail2ban from Ubuntu’s package repositories:
sudo apt update sudo apt install fail2ban - Start it now and enable it at boot:
sudo systemctl enable --now fail2ban - Check the daemon before adding WordPress policy:
sudo fail2ban-client status sudo systemctl status fail2ban
Do not proceed to a production ban policy until the service starts cleanly. Syntax errors, missing filters and invalid backends are easier to correct before an address is blocked.
Install the WordPress-aware filters
Generic SSH or web-server filters do not understand WordPress event semantics. WP fail2ban supplies two standard filters: wordpress-hard and wordpress-soft. Copy those standard filter files into the host’s Fail2ban filter directory, normally /etc/fail2ban/filter.d/, so the jail can load them by name.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Keep the standard files as your baseline. If your site needs a variation, copy the filter to a separately named custom file and maintain that copy yourself. Do not modify the standard wordpress-hard.conf or wordpress-soft.conf files. WP fail2ban does not update custom filters automatically, so every custom copy must be reviewed when the integration or its event format changes.
Choose hard and soft policy deliberately
The two filters represent different risk assumptions rather than two interchangeable names.
| Filter | Typical event class | Documented starting threshold | When it fits |
|---|---|---|---|
wordpress-hard |
Events considered clearly hostile, such as blocked users or pingbacks with errors | maxretry = 1 |
Immediate ban is acceptable because one matching event is enough to identify abuse under the site’s policy |
wordpress-soft |
Ordinary failed logins | maxretry = 3 |
Allow several mistakes before banning a legitimate user or administrator |
These values are documented starting points, not universal settings. WP fail2ban explicitly recommends using both filters, while also warning that there is no one-size-fits-all configuration: an event that is soft on one site may be hard on another. Consider shared office addresses, editors who travel, automated publishing systems and the consequences of locking out an administrator before lowering a threshold.
File-based syslog configuration
The documented syslog example uses /var/log/auth.log. That path is an example, not a guarantee that WordPress events are present there. First verify where the WP fail2ban integration writes its records; then replace logpath with that real file.
Create a local jail file, for example /etc/fail2ban/jail.d/wordpress.local, with both filters:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
[wordpress-hard]
enabled = true
filter = wordpress-hard
logpath = /var/log/auth.log
maxretry = 1
port = http,https
[wordpress-soft]
enabled = true
filter = wordpress-soft
logpath = /var/log/auth.log
maxretry = 3
port = http,httpsChange both logpath values to the same verified WordPress log, or to the appropriate files if your logging setup separates events. The port setting covers HTTP and HTTPS traffic; it does not itself enable either protocol or alter your web server.
After saving the file, reload or restart Fail2ban and inspect each jail:
sudo systemctl restart fail2ban
sudo fail2ban-client status wordpress-hard
sudo fail2ban-client status wordpress-softThe status output should show the jail as active, its current failure count and any banned addresses. If the jail is missing, Fail2ban did not load the file or the section name differs from the command you used.
Configure WordPress events in systemd journald
Use the systemd backend when WordPress events are stored in journald rather than a readable syslog file. WP fail2ban documents two WordPress settings for a reliable identifier:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutedefine('WP_FAIL2BAN_SYSLOG_SHORT_TAG', false);
define('WP_FAIL2BAN_SYSLOG_TAG_HOST', false);Place these definitions in the WordPress configuration where the WP fail2ban integration reads them, then verify that new entries carry SYSLOG_IDENTIFIER=wordpress. The corresponding jails use backend = systemd and a journal match instead of logpath:
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
[wordpress-hard]
enabled = true
filter = wordpress-hard
backend = systemd
journalmatch = SYSLOG_IDENTIFIER=wordpress
maxretry = 1
port = http,https
[wordpress-soft]
enabled = true
filter = wordpress-soft
backend = systemd
journalmatch = SYSLOG_IDENTIFIER=wordpress
maxretry = 3
port = http,httpsDo not combine a journal-only jail with a guessed file path. Likewise, a file backend cannot see entries that exist only in journald. Confirm the source with the host’s journal and logging configuration before deciding which version to enable.
Apply separate web-server jails where they add coverage
WordPress authentication events and web-server abuse are related but distinct. A WordPress filter sees application events; an Apache or Nginx jail sees requests recorded by that web server. Enable both only when each log exists and the format matches the selected filter.
| Server | Upstream jail examples | Log types used | Selection rule |
|---|---|---|---|
| Apache | apache-auth, apache-badbots, apache-noscript, apache-overflows, apache-botsearch |
Apache error or access logs, depending on the jail | Enable only a jail whose module, pattern and actual log path exist |
| Nginx | nginx-http-auth, nginx-limit-req, nginx-botsearch, nginx-bad-request, nginx-forbidden |
Nginx error or access logs, depending on the jail | Match the jail to the deployed Nginx configuration and its log format |
Common Ubuntu installations place Apache logs under /var/log/apache2/ and Nginx logs under /var/log/nginx/, but virtual hosts, containers and custom logging often change those locations. Verify the path and whether the selected jail expects an access log or an error log. A valid-looking jail pointed at the wrong file will silently provide no protection or fail during startup.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Validate filters before relying on bans
Check that the source contains matching events
For a file backend, inspect the configured file with the normal system log tools and confirm recent WordPress entries are present. For journald, query entries whose identifier is wordpress. The important test is not merely that the file or journal exists, but that it contains the exact events the filter is designed to parse.
Test the filter against a real line
Fail2ban includes a filter-testing utility. Run it against the actual filter and source, for example:
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
sudo fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/wordpress-hard.conf
sudo fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/wordpress-soft.confSubstitute the verified file and filter paths used on your host. For a journal-only setup, test representative exported log lines or use the filter’s documented journal workflow; do not pretend a nonexistent text file represents journald.
A successful match proves only that the filter recognizes the line. It does not prove that the jail is watching the right backend or that the action can change your firewall. Confirm both with fail2ban-client status and a controlled test from an address you can safely unban.
Recommended Free Tools
Reload, observe and tune without locking yourself out
- Validate configuration and restart Fail2ban:
sudo systemctl restart fail2ban - List active jails and inspect each WordPress jail:
sudo fail2ban-client status sudo fail2ban-client status wordpress-hard sudo fail2ban-client status wordpress-soft - Watch for failure counts, bans and unexpected addresses during normal administration.
- If a trusted address is banned, remove it from the affected jail with:
sudo fail2ban-client set wordpress-soft unbanip 203.0.113.10Replace the example address with the real address shown in the status output.
- Adjust
maxretry, ban duration and the event classification in your local policy only after reviewing false positives and missed attacks.
Do not respond to a false positive by disabling every jail. Identify whether the problem is an overly aggressive filter, the wrong log source, a proxy address being logged instead of the client address, or a threshold that does not fit the site’s users.
Troubleshoot the failure modes that matter
The jail is not listed
- Confirm the file is under
/etc/fail2ban/jail.d/or injail.localand ends with a supported configuration extension. - Check that the section name is unique and that
enabled = trueis inside the intended section. - Read the Fail2ban service status and logs for a syntax error, missing filter or invalid option.
The jail is active but never records failures
- The
logpathmay be an example path rather than the file WordPress actually uses. - WordPress may be writing to journald while the jail uses a file backend, or the reverse.
- Journald entries may lack
SYSLOG_IDENTIFIER=wordpressbecause the WP fail2ban tag settings were not applied. - The event text may not match the installed filter version; compare a real line with the filter and update maintained custom copies.
Legitimate users are banned
- Raise the soft filter’s retry allowance rather than weakening hard events automatically.
- Review whether multiple users share one public IP, such as an office or campus network.
- Check that a reverse proxy or load balancer is not causing many users to appear as one address.
- Keep immediate bans limited to events your site can defend as clearly abusive.
Web-server jails create noise
Disable the specific Apache or Nginx jail whose pattern does not fit your traffic, rather than changing WordPress thresholds to compensate. Recheck whether it is reading an access log or error log and whether the enabled web-server module actually generates the event.
Maintenance is part of the protection
Filters are security code. WP fail2ban states that copied custom filters are not updated automatically, so record which standard version each custom file came from and review it after WordPress, WP fail2ban or Fail2ban upgrades. Keep local overrides separate from package files, retest representative hard and soft events after changes, and remove obsolete rules that either miss current attacks or classify normal administration as abuse.
Review bans and false positives as part of routine server maintenance. A jail that was correct for a small private site may be too aggressive after adding editors, a content-delivery proxy or an automated deployment system. Conversely, a growing attack surface may justify shorter thresholds for events your site can confidently identify as hostile.
Free tools Windows power users keep installed
One-click scans. No signup required.
A practical rollout checklist
- Identify whether WordPress events arrive in syslog files or journald.
- Verify the real file path or the
SYSLOG_IDENTIFIER=wordpressjournal match. - Copy the standard WP fail2ban filters into the host filter directory; keep custom variants separate.
- Create local jails for both
wordpress-hardandwordpress-soft. - Use the documented starting thresholds of one hard failure and three soft failures, then tune for the site’s risk and users.
- Enable only Apache or Nginx jails whose logs, modules and formats are present.
- Restart Fail2ban, inspect each jail’s status and test matching with real log entries.
- Monitor bans, unban trusted addresses when necessary and document every local override.
- Recheck copied filters after upgrades because they do not receive automatic updates.
The result is a maintainable WordPress control: application-aware filters distinguish severe events from ordinary mistakes, the backend reads the source that truly exists, and local jails can evolve without being overwritten by package updates.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
