# fail2ban - block wp-login.php brute force attacks

DevFeed: [fail2ban - block wp-login.php brute force attacks](<https://devfeed.tech/articles/fail2ban-block-wp-login-php-brute-force-attacks-27628.md>)

Original publisher: [Read original article](<https://gagor.pro/2015/12/fail2ban-block-wp-login-php-brute-force-attacks/>)

Author: Tom

Published: 2015-12-31T00:00:00Z

Content type: tutorial

Language: en

Sources: [Tomasz Gągor](<https://devfeed.tech/sources/tomasz-gagor.md>)

Topics: [WordPress](<https://devfeed.tech/topics/wordpress.md>), [nginx](<https://devfeed.tech/topics/nginx.md>), [Firewall](<https://devfeed.tech/topics/firewall.md>), [Code](<https://devfeed.tech/topics/code.md>), [HTTP](<https://devfeed.tech/topics/http.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [fail2ban](<https://devfeed.tech/tags/fail2ban.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [http](<https://devfeed.tech/tags/http.md>), [linux](<https://devfeed.tech/tags/linux.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [php](<https://devfeed.tech/tags/php.md>), [windows](<https://devfeed.tech/tags/windows.md>), [wordpress](<https://devfeed.tech/tags/wordpress.md>)

## AI overview

A tutorial explaining how to use Fail2ban with nginx and a firewall to block source IPs involved in brute-force attempts against WordPress's wp-login.php endpoint.

## Source excerpt

Lately I had a lot of brute force attacks on my WordPress blog. I used basic auth to /wp-admin part in nginx configuration to block this and as a better solution I wan't to block source IPs at all on firewall. To do this, place this filter code in /etc/fail2ban/filter.d/wp-login.conf: # WordPress brute force wp-login.php filter: # # Block IPs trying to authenticate in WordPress blog # # Matches e.g. # 178.218.54.109 - - [31/Dec/2015:10:39:34 +0100] "POST /wp-login.php HTTP/1.1" 401 188 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" # [Definition] failregex = ^<HOST> .* "POST /wp-login.php ignoreregex = Then edit your /etc/fail2ban/jail.local and add: