Use the WP fail2ban plugin’s wordpress-hard and wordpress-soft filters in a local Fail2ban jail, point each jail at the log source your server actually produces, then validate matches with fail2ban-regex before enabling bans. The hard filter covers clearly malicious WordPress events, including XML-RPC authentication and system.multicall failures; the soft filter allows more retries for events that could be legitimate.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What this protects—and what it does not
WordPress’s xmlrpc.php endpoint accepts remote procedure calls. Attackers commonly abuse it for password guessing, particularly through the system.multicall method, which can combine many authentication attempts in one request. WordPress’s Advanced Administration Handbook describes xmlrpc.php as a frequent brute-force target, especially system.multicall.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fail2ban does not inspect every request at the network edge. It watches a log source, applies a filter to new lines, counts failures from each source IP during a time window, and asks an action (normally the host firewall) to block an address. That makes accurate logging and client-IP handling prerequisites. It also means a request reaches the web server and usually PHP before Fail2ban can react; a web-server or edge rate limit can reduce that application work earlier in the path.
- The WP fail2ban
wordpress-hardfilter is designed for events that are almost certainly hostile, including XML-RPC authentication and multicall failures. - The
wordpress-softfilter is for events such as failed logins where an immediate ban could catch a legitimate user. - The filters require the WP fail2ban WordPress plugin and a log source that contains the events they expect.
- A ban is an IP-reputation decision. Shared office NAT, mobile carrier NAT, VPN exits, monitoring systems, and automation can put legitimate users behind the same address.
Choose the right control before writing a jail
| Option | Best fit | Strength | Trade-off |
|---|---|---|---|
| Disable or restrict XML-RPC | The site has no integration that needs the endpoint | Removes or narrows the attack surface | Breaks clients and services that depend on XML-RPC |
wordpress-hard |
Clearly malicious WordPress events, including XML-RPC authentication or multicall failures | Can ban after one matching event | Aggressive; depends on reliable WordPress logging |
wordpress-soft |
Events that might be a mistyped password or another legitimate failure | Lower false-positive risk | Allows several failures before blocking |
| Web-server or edge throttling | You need to reduce requests before PHP processes them | Acts earlier and can reduce resource use | Directives depend on Apache, Nginx, a reverse proxy, and correct real-IP configuration |
If the site uses Jetpack, the WordPress mobile apps, or another XML-RPC-dependent integration, do not disable the endpoint without checking that integration’s requirements. Keep the endpoint and add logging, Fail2ban, and—where appropriate—server-level throttling. If nothing needs XML-RPC, disabling or restricting it is simpler than trying to make a ban system compensate for an unused endpoint.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites and log-source checks
Install the two required components
Install Fail2ban from your operating system’s supported package source, then install and activate the WP fail2ban plugin in WordPress. The plugin supplies the purpose-built filters and the WordPress-side logging integration; a jail that names those filters cannot work if the plugin is absent or inactive.
Keep the filter and jail syntax compatible with the versions installed on the server. A configuration copied from a different release can refer to fields or log formats your installation does not emit.
Determine where WordPress failures are logged
There are two common arrangements:
- systemd journal: WordPress events are written to the journal with
SYSLOG_IDENTIFIER=wordpress. In this arrangement, use Fail2ban’ssystemdbackend and a matchingjournalmatch. - Web-server or PHP files: events are written to the actual Apache, Nginx, or PHP log used by the deployment. In this arrangement, configure
logpathto that real file and select a backend compatible with file logs.
Do not assume that every WordPress installation emits the identifier used by the journal example. Verify it on the host. Likewise, do not copy a journal configuration and add a file logpath as if the two backends were interchangeable; Fail2ban treats logpath differently for the systemd backend.
Verify the address that appears in each line
Read a representative failure line and confirm that it contains the original client IP. If a reverse proxy, CDN, load balancer, or container ingress is in front of the server, configure trusted real-IP handling first. Otherwise the log may contain the proxy’s address, and Fail2ban could ban the proxy instead of the attacker. Never trust an unvalidated client-supplied header as the source address.
Create a local jail override
Put local changes in /etc/fail2ban/jail.local or in a separate file such as /etc/fail2ban/jail.d/wordpress.conf. Fail2ban’s packaged jail.conf is a reference file; editing it risks losing your changes during a package update.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Journal-based configuration
When the WordPress plugin writes events with the expected journal identifier, create /etc/fail2ban/jail.d/wordpress.conf with both filters:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →[wordpress-hard]
enabled = true
filter = wordpress-hard
backend = systemd
journalmatch = SYSLOG_IDENTIFIER=wordpress
maxretry = 1
port = http,https
[wordpress-soft]
enabled = true
filter = wordpress-soft
backend = systemd
journalmatch = SYSLOG_IDENTIFIER=wordpress
maxretry = 3
port = http,httpsThe hard jail treats one matching hard-filter event as sufficient for a ban. The soft jail permits three failures before it acts. Those values are a starting policy from the WP fail2ban documentation, not a universal measurement of attack behavior. The port setting tells the action which web-service ports to protect; it does not itself disable XML-RPC.
File-based configuration
If the events are in Apache, Nginx, or PHP files, retain the appropriate filter names but replace the journal settings with logpath pointing to the exact file or files used by your deployment and a file-compatible backend. Use the real path shown by your web server’s logging configuration; do not guess based on a distribution’s usual directory layout. If the log rotates, include every active file needed by your Fail2ban version and confirm that the service can read it.
The filter name and the log format must agree. A web-server access log that contains only a status code may not contain the WordPress authentication event expected by a WP fail2ban filter. In that case, enable the plugin’s supported logging integration or use the log source documented for your installation rather than inventing a broad expression for every request to xmlrpc.php.
Understand and tune the thresholds
| Setting | Meaning | Stock Fail2ban default | What to consider |
|---|---|---|---|
bantime |
How long the address remains banned | 10m |
Start short while observing false positives; extend only after the policy behaves correctly |
findtime |
The interval during which failures are counted | 10m |
A narrow window limits the effect of old, unrelated failures |
maxretry |
Failures required inside findtime before a ban |
5 |
The hard and soft examples override it to 1 and 3 |
Fail2ban applies the threshold per source IP. A policy of maxretry = 3 with a ten-minute findtime means three matching failures from one address during those ten minutes, not three failures across the entire site. The effective ban duration is controlled by bantime.
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
A cautious rollout is to keep the initial ban short and the failure window narrow, watch the jail and application logs, and increase the ban duration only after confirming that legitimate Jetpack, mobile, administrative, and monitoring traffic is not being caught. Tune the hard and soft jails independently if your traffic pattern warrants it. Do not set a permanently long ban merely because a single test produced a match.
Use ignoreip sparingly
Add an address to ignoreip only when you can identify it reliably and keep it current. Fail2ban warns that DNS-based identity can be unsafe when reverse and forward DNS do not agree; prefer the real IPs visible in application logs. A hostname that resolves to a new address can leave an administrator unprotected, while a stale address can exempt someone else.
Reload Fail2ban and validate the filter
Reload after changing the jail
Use your service manager to reload or restart Fail2ban after saving the local file. Then inspect the overall service and each WordPress jail:
sudo fail2ban-client status
sudo fail2ban-client status wordpress-hard
sudo fail2ban-client status wordpress-softThe per-jail status should show that the jail is enabled, the expected filter is loaded, and the monitored log source is available. An enabled jail with zero matches may be healthy—or may simply be watching the wrong source—so continue with a regex test.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Test against representative lines
For a journal deployment, export a representative slice first, then test the installed filter file:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo journalctl SYSLOG_IDENTIFIER=wordpress --no-pager > /tmp/wordpress-journal.log
sudo fail2ban-regex /tmp/wordpress-journal.log /etc/fail2ban/filter.d/wordpress-hard.confFor a file deployment, pass the actual Apache, Nginx, or PHP log file to fail2ban-regex instead. Use lines from the current server, including both a known matching failure and ordinary successful traffic. Review the match count and the unmatched lines; a filter that matches nothing cannot ban, while one that matches every request can ban legitimate visitors.
Test the soft filter separately against the same kind of evidence:
sudo fail2ban-regex /tmp/wordpress-journal.log /etc/fail2ban/filter.d/wordpress-soft.confThese commands validate the regular expression, not the complete firewall path. Confirm that the action used by the jail is installed and that your firewall accepts the resulting rules according to your host’s normal administration procedure.
Perform a controlled ban and recovery test
Do not generate a password-guessing burst against a production site. Use a representative fixture for regex testing, and if you must verify the action, use an address you control and schedule the test so you cannot lock yourself out. Fail2ban’s client can inspect jail state and manually ban or unban an address; after a controlled test, remove the ban and verify that the address is no longer listed:
sudo fail2ban-client set wordpress-hard banip 203.0.113.10
sudo fail2ban-client status wordpress-hard
sudo fail2ban-client set wordpress-hard unbanip 203.0.113.10The address in this example is from the documentation-only range and is not a substitute for a real controlled test. Never use an address that belongs to your only administrative connection.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Diagnose common failures
The jail fails to start
- Check that the filter file named by
filter =exists and that the WP fail2ban plugin is installed for the WordPress events you expect. - Check spelling and section names in the local jail file. Keep one definition of each jail in the active configuration so an older override is not silently winning.
- Confirm that the selected backend matches the source. A systemd backend with a file-only deployment, or a file backend pointed at a journal, will not see the intended events.
The jail is running but records no failures
- Inspect the journal identifier or the exact log file and compare it with
journalmatchorlogpath. - Confirm that the service account running Fail2ban can read the log.
- Run
fail2ban-regexagainst current lines from that source. If the lines do not match, do not lowermaxretryto compensate; fix the logging or filter selection. - Check whether a reverse proxy is writing its own access log while WordPress failures are recorded elsewhere.
The wrong address is banned
This almost always indicates incorrect real-IP handling or a shared address. Correct the trusted proxy configuration and confirm the address in newly written application lines before clearing and retesting the jail. If several people legitimately share one public address, a hard one-strike policy can block all of them; use the soft jail, a narrower server rule, or an explicit trusted-address policy where appropriate.
A legitimate client is blocked
Use fail2ban-client to unban the address, then identify the matching event and decide whether it belongs in the soft policy, an ignoreip exception, or neither. Do not add broad network ranges merely to hide a false positive. Investigate Jetpack, mobile, monitoring, and other XML-RPC users individually, because their source addresses and retry patterns can change.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The jail bans but XML-RPC still consumes resources
Fail2ban reacts after logged failures. It is not a substitute for disabling an unused endpoint or adding a web-server or edge throttle that acts before PHP. If XML-RPC is required, combine those controls only after confirming that the real client IP survives every proxy hop.
Decide whether to leave xmlrpc.php enabled
WordPress’s server-level guidance covers restricting or disabling the endpoint. Apply that approach when no required integration calls XML-RPC. When an integration does require it, leave the endpoint available, make sure the plugin logs the relevant authentication and multicall failures, and use the hard and soft jails with thresholds appropriate to the site’s normal clients.
Fail2ban protects against repeated logged behavior; it does not remove the application feature, validate a user’s intent, or guarantee protection from requests that never reach a matching log line. The strongest setup is therefore layered: remove XML-RPC when it is unnecessary, otherwise keep accurate logs, preserve the original client address, validate the filters, and add an earlier rate control when the server needs relief from request volume.
Operational checklist
- Fail2ban is installed from the operating system’s supported source.
- WP fail2ban is installed and active in the target WordPress site.
- The chosen log source actually contains WordPress authentication or XML-RPC failures.
- The journal uses
SYSLOG_IDENTIFIER=wordpressbefore you select the journal example. - Proxy and real-IP handling preserve the original client address.
- Local changes are in
jail.localorjail.d, not the packagedjail.conf. - Both hard and soft filters have been tested with current representative lines.
bantime,findtime, andmaxretryreflect the site’s legitimate clients and risk tolerance.- A controlled ban and unban test has confirmed the action path without risking administrator access.
- You have decided explicitly whether XML-RPC is required by any integration.
Bottom line
The dependable pattern is simple but strict: install WP fail2ban, identify the real WordPress log source, define the hard and soft jails in a local override, validate each filter with current lines, and only then tune bans. Disable or restrict xmlrpc.php when nothing needs it; otherwise preserve the endpoint and protect it with accurate logging, Fail2ban, and—when necessary—earlier web-server controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
