WP fail2ban Premium records activity inside WordPress so server-side fail2ban can respond using the filters and jails configured on your host. The add-on does not execute the host firewall. Your hosting must allow fail2ban and firewall configuration, typically on a VPS, dedicated server or similar setup. On managed hosting, support depends on what the provider permits. Premium requires PHP 8 or later.

How WordPress events reach the firewall

The supplied filters are wordpress-hard.conf, wordpress-soft.conf and wordpress-extra.conf. Hard filters cover events that can normally lead to an immediate ban; soft filters suit activity such as failed logins, where several attempts may be reasonable. Extra rules can support custom configurations.

WP fail2ban can log failed logins, block specified usernames during login and block user enumeration. Where user enumeration cannot be blocked, you can require login by email address instead of username. Empty username attempts are logged as soft failures. Attempts to comment on content that does not exist and spam comments can produce hard failures. Pingbacks are logged as soft failures, which can help rate-limit activity without disabling pingbacks completely.

Premium controls and event review

• SQL injection checks: The Web Application Firewall checks the SQL WordPress is about to run and can block the injection itself.
• Blocklist: The separate Blocklist add-on uses hostile IP addresses reported by participating websites. Premium receives the full current intelligence available for your site.
• XML-RPC and country controls: Block XML-RPC requests while allowing Jetpack and/or pingbacks, and block traffic from selected countries.
• Proxy and geolocation data: Premium can update geolocation data and trusted Cloudflare and Jetpack network ranges automatically. You can also configure a separate trusted proxy list.
• Event history and Akismet: Review a full event history in the syslog dashboard widget. When Akismet discards obvious spam, the add-on can log the IP address as well as comments marked as spam.
• Event hooks: Run a custom action when WP fail2ban detects a particular event.

Setup and checks

Install the plugin in WordPress and configure it alongside fail2ban on the server. Copy the filter files into the fail2ban filter directory, configure jails for the filters you use, and set trusted proxies if needed. The log source depends on the operating system and whether it uses traditional syslog files or the systemd journal. Test the setup before relying on it. The Site Health Check reviews the fail2ban configuration and whether filters are current; use the event history to inspect activity over time.