Is there a way to set up fail to ban to block on IP that hits wp-login too many times?

I have tried adding this jail.local:


enabled = true
action   = iptables[name=wplogin, port=http, protocol=tcp]
           sendmail-whois[name=wplogin, dest=root, sender=fail2ban@example.com]
filter  = apache-wp-login
logpath = /var/log/apache2/other_vhosts_access.log
maxretry = 5

And then adding a definition in /etc/fail2ban/filter.d/apache-wp-login.conf:


# Option:  failregex
# Notes.:  Regexp to catch Apache dictionary attacks on Wordpress wp-login
# Values:  TEXT
failregex = [\w\.\-]+ [\w\.\-]+ .*] "POST /wp-login.php

Still getting wp-login attempts way over the maxentry limit... could this be because I'm using combined log format, instead of common?


I modified my WordPress theme functions.php file to add the following:

add_action('wp_login_failed', 'log_wp_login_fail'); // hook failed login function log_wp_login_fail($username) { error_log("WP login failed for username: $username"); }

Failed login are now written in my error logs.

My apache-wp-config.conf looks like this: [Definition] failregex = [[]client <HOST>[]] WP login failed.* ignoreregex =

And my jail.local contains the following: [apache-wp-login] enabled = true filter = apache-wp-login action = iptables-multiport[name=apache-wp-login, port="http,https"] sendmail-whois[name=apache-wp-login, dest=root, sender=fail2ban@example.com] logpath = /home/*/logs/*error.log bantime = 720 maxretry = 6

More info at this site

  • awesome, I will give this method a shot, and let you know how it works out :) – Alex Douglas Jul 22 '14 at 19:00
  • my log directory structure is /var/log/error.log. Using your method, would I use logpath = /var/*/log/*error.log? – Alex Douglas Jul 23 '14 at 7:03
  • If you have only one error log then just use logpath = /var/log/error.log – qux Jul 23 '14 at 17:05
  • Well, this method seems to be working for me :) I'm now getting emails from fail2ban informing me when an IP address is blocked. Thank you! – Alex Douglas Jul 23 '14 at 23:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.