Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to configure a publicly accessible WordPress site that I manage to blacklist IPs after 3 failed login attempts, or further enforce security in some manner.

Can somebody please provide me with the best way to go about doing this?

Thanks in advance!

The site is running on CentOS in a LAMP stack.

share|improve this question
up vote 3 down vote accepted

For the Wordpress Site, here are a couple of plugins which I have been using. They are all accessible through the Plugin Installer in Wordpress

Login Lock Enforces strong password policies, monitors login attempts, blocks IP address for too many failed login attempts.

Stealth Login Create custom URL's for logging in, logging out and registering for your WordPress blog.

ThreeWP Activity Monitor Plugin to track user activity. Network aware.

Another good system, is CloudFlare or something similar. So far I am liking CloudFlare because they host your DNS. It makes it easier to manage your websites. I am unsure on traffic and speed statistics. My website does not have a lot of traffic so it has not concerned me. So far, my experience has been ok. There is a CloudFlare plugin for Wordpress which allows you to see the actual IP Addresses which attempt to log into your website. You need the plugin otherwise, all the attacks look like they are coming from Cloudflare's IP Addresses.

CloudFlare CloudFlare integrates your blog with the CloudFlare platform.

share|improve this answer is my personal favorite. You program it to watch log files and run scripts based on activity.

Most specifically you'd have Fail2Ban watch a WP Authentication log for failed attempts, and probably just ban those IPs for a few minutes at the firewall level. I run this on all my public facing server/services.

On mine it's 10 bad logins => 10 minute firewall block (for most services). This effectively rate limits password bruteforce attacks to 1 password per minute (unless your password is "asdf" they'll never get in), but 10 is high enough that my less technical users don't get locked out very easily.

You can write some pretty complicated rules if you really want to dive into it, getting Apache to return specific error messages to offending IPs or all sorts of other fun (my personal favorite is sending abuse reports to the IP Block owner). But it's pretty easy to get started with.

share|improve this answer

How it works:

  1. An attacker attempts to login and fails.
  2. Simple Login Lockdown record that failed login.
  3. After a certain number of failed attemps (defaults to five), further attemps to access the wp-login.php page are blocked for a time (defaults to one hour)."
share|improve this answer

if you are running it over Apache you could try the modules:

Alternatively, you can do it with Modsecurity. Here is a nice article about it:

and with Nginx:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.