WP fail2ban uses fail2ban to protect your WordPress site.
| Last updated | October 20, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 4.2 or newer |
| Needs PHP | 7.4 or newer |
| First published | October 19, 2012 |
| Support, last two months | 0 of 1 threads resolved (0%) |
4.2 / 5 from 71 reviews
| 5 stars | 51 |
|---|---|
| 4 stars | 4 |
| 3 stars | 2 |
| 2 stars | 4 |
| 1 star | 10 |
Got a firewall? Use it.
WP fail2ban gives fail2ban the information it needs to block attackers at the firewall. fail2ban is a server-side service that bans abusive IP addresses; WP fail2ban tells it about brute-force attacks, user enumeration, comment abuse, spam, and more.
Once an address is banned, the firewall stops its requests before they reach your site.
Free protection from the usual suspects
The Free edition covers the attacks WordPress sites see every day:
Need more protection? See what Premium adds →
How WP fail2ban works
WP fail2ban records security events in a form fail2ban can recognise. fail2ban watches those events and applies the rules you configure on the server. When an address crosses a threshold, it can be banned by the host firewall, so later requests are stopped before they reach WordPress.
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
No. fail2ban is the service that watches logs and bans abusive IP addresses at the firewall. WP fail2ban is the bridge between WordPress and fail2ban: it tells fail2ban what is happening inside WordPress in a form it can act on.
The name dates from 2011, when “WP + something” was commonly understood to mean an integration between WordPress and that thing.
It shouldn’t.
The Premium notices are provided by Freemius and use WordPress’s normal admin request handling to remember when you dismiss them. If another plugin mishandles that request before WP fail2ban or Freemius sees it, the dismissal is never saved and the notice can appear again.
If you can configure fail2ban and the firewall, yes.
That normally includes VPSs, dedicated servers, and other hosting where you have control of the operating system. WP fail2ban supplies the WordPress side of the integration; fail2ban and the firewall run on the server.
The WP fail2ban Blocklist uses attacks seen by participating WP fail2ban sites to identify hostile IP addresses.
That means your firewall can block an address before it attacks your site, rather than waiting for your site to see enough activity for fail2ban to act.
The WordPress.org edition remains on 5.x so it can continue to support PHP 7.4. There are still a lot of WP fail2ban sites running PHP 7.4, even though PHP itself stopped supporting it nearly four years ago.
Premium is based on 6.x and requires PHP 8 or later. It has moved on significantly from 5.x as WP fail2ban continues to develop.
The Free edition covers the everyday WordPress abuse most sites need fail2ban to act on.
Premium goes further with the full Blocklist, the Web Application Firewall, persistent event history, geo‑blocking, maintained security data, and additional controls.
Compare all Free and Premium features →
#401 by installs
Hide My WP Ghost is a WordPress security plugin that hides WP paths and protects your site with Path Security, Firewall, Brute Force Protection, 2FA
#975 by installs
XO Security is a plugin to enhance login related security.
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
#46 by installs
Loginizer is a WordPress security plugin which helps you fight against bruteforce attacks.
#51 by installs
Secure your WordPress site from brute-force attacks, threats, malware, and bots. Free to use and easy to set up.
#199 by installs
Limit rate of login attempts, including by way of cookies, for each IP. Fully customizable.
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin.