Descripción

WP Fail2Ban Redux records various WordPress events to your server’s system log for integration with Fail2Ban.

This plugin is (mostly) a drop-in replacement for WP fail2ban by Charles Lecklider.

While WP fail2ban is a great plugin, there are a number of improvements that could be made. In order to facilitate these improvements, a major refactoring of the codebase was necessary.

The core functionality between WP Fail2Ban Redux and WP fail2ban remains the same. WP Fail2Ban Redux is considered to be mostly a drop-in replacement, because all constants have been replaced with filters, and will, possibly, require some upgrade work. Don’t work it’s as simple as implementing the constants.

The following events are recorded by default:

Intentos de identificación XML-RPC fallidos.
Intentos de identificación correctos.
Intentos de identificación fallidos — diferenciados por la existencia de un usuario.
Errores de pingback.

The following events can be enabled via filter:

Solicitudes de pingback.
Blocked user enumeration attempts.
Authentication attempts for blocked usernames.
Spammed comments.

Extra documentation is available on the WP Fail2Ban Redux GitHub Wiki.

Instalación

Upload the plugin to your plugins directory.
Activate the plugin through the ‘Plugins’ menu in WordPress.
Copy the config/filters/wordpress-hard.conf and config/filters/wordpress-soft.conf files to your Fail2Ban filters directory (generally /etc/fail2ban/filters.d).
Copy the config/jail/wordpress.conf file to your Fail2Ban jail directory (generally /etc/fail2ban/jail.d), or append it’s contents to your jail.local file. Make sure you read the notes in this file to aid successful setup.
Recarga o reinicia Fail2Ban.

FAQ

¿Cómo actualizo desde WP fail2ban?

If you haven’t set any of the WP fail2ban constants, you don’t need to do anything. If you have set some of the constants, view the upgrade instructions.

Will the `wordpress-hard.conf` and `wordpress-soft.conf` filters still work?

Yes! All of the improvements made in WP Fail2Ban Redux were done in a way that would allow existing functionality to work without changes to your filters. However, the demo filters included with the plugin do contain some recommended changes. There are also new features not found in WP fail2ban that will require changes to your filters to be effective. These changes are linked, by filter, below:
wordpress-hard.conf
wordpress-soft.conf

Be ye forewarned: Future changes to WP fail2ban may break backwards compatibility with WP Fail2Ban Redux filters. No attempts will be made to fix this. So, even though it’s not required, it is probably a good idea to update the filters anyway.

Can I use this as a must-use plugin in the `mu-plugins` folder?

As of version 0.5.0, yes! Download the plugin, and unzip. Inside the plugin folder will be another folder named wp-fail2ban-redux and wp-fail2ban-redux.php. Upload this folder and file to the mu-plugins directory of your site.

How do you I use this plugin if my site is behind a proxy, like Cloudflare?

You need to add some code to your wp-config.php file. See the below links for guidance.

https://core.trac.wordpress.org/ticket/9235#comment:39
https://stackoverflow.com/questions/14985518/cloudflare-and-logging-visitor-ip-addresses-via-in-php/14985633#14985633
https://support.cloudflare.com/hc/en-us/articles/200170916#12345680

Reseñas

thedaysse 28 de Abril de 2025

I really like the way it doesn’t prompt me to upgrade to a version with paid features.

brt 26 de Julio de 2024

no premium/freemium blocklist scam, just does what its supposed to do. supereasy to install, no configuration within wordpress needed! just install the plugin and setup fail2ban using the provided config files (filters, jail) love it. thanks!

ABCdatos 5 de Agosto de 2022

Easy, effective, no unnecessary control panel, no premium parts, no boring messages, it just do the work! Having fail2ban already configured in the server, I installed it on a bunch of WP sites. Locking repetitive attackers, it saves some server resources peaks. Really thanks for the plugin.

teeboy4real 6 de Julio de 2021

This plugin is underrated and is a must have for wordpress security.

thnilsen 9 de Marzo de 2021

Could not be simpler to use this plugin. The original plugin that this one replaces was just awful to set up with the free version. This on is just to install and activate, then make sure you have the apache-auth filter active in your Fail2Ban configuration. Thanks!!

galactica333 28 de Mayo de 2020

I use this plugin on my wordpress installations and all failed logins are reliably logged to the auth.log of the server. Even though the plugin has not yet been tested with WordPress 5.4.1, it is working good for me.

Leer los 15 comentarios

Colaboradores & Desarrolladores

“WP Fail2Ban Redux” es software de código abierto. Las siguientes personas han contribuido a este plugin.

Brandon Allen

“WP Fail2Ban Redux” ha sido traducido en 3 idiomas. Gracias a los traductores por sus contribuciones.

Traduce “WP Fail2Ban Redux” a tu idioma.

¿Interesado en el desarrollo?

Revisa el código, echa un vistazo al repositorio SVN, o suscríbete al registro de desarrollo por RSS .

Historial de cambios

0.9.2

Release date: 2025-05-27
Bumps “Tested up to” version to 6.8
Bumps minimum required PHP version to 7.4
Bumps minimum required WP version to 5.8
Add a new regex rule for XMLRPC authentication failure to both filters (soft and hard)
Update dependency package versions

0.9.1

Release date: 2023-10-17
Bumps “Tested up to” version to 6.4
Bumps minimum required PHP version to 7.0
Bumps minimum required WP version to 5.5
Update dependency package versions
Sin cambios a las jaulas ni filtros en la versión.

0.8.3

Release date: 2023-10-17
Bumps “Tested up to” version to 5.9
Sin cambios a las jaulas ni filtros en la versión.

0.8.2

Fecha de lanzamiento: 08/08/2021
Bumps “Tested up to” version to 5.8
Sin cambios a las jaulas ni filtros en la versión.

0.8.1

Fecha de lanzamiento: 01/06/2021
Actually bumps “Tested up to” version to 5.7

0.8.0

Fecha de lanzamiento: 31/05/2021
Bumps “Tested up to” version to 5.7
Fix issue where logging out of WordPress could cause a blocked user log to be recorded

0.7.0

Fecha de lanzamiento: 05/01/2021
Bumps “Tested up to” version to 5.6
Move Composer dependencies to require-dev to reduce the number of packages installed when WP Fail2Ban Redux is installed via composer. See https://github.com/thebrandonallen/wp-fail2ban-redux/pull/17

0.6.0

Fecha de lanzamiento: 07/06/2020
Sube la versión mínima requerida de WordPress a 4.9.
Bumps “Tested up to” version to 5.4.1

0.5.1

Fecha de lanzamiento: 05/09/2019
This release requires and update to the wordpress-hard.conf file, in order to fix an issue with matches failing for XML-RPC multicall authentication failures. See https://github.com/thebrandonallen/wp-fail2ban-redux/pull/13/commits/2e3a3867749be7839edfae5707b62921c36ecd85
Fix issue where XML-RPC multicall authentication failures weren’t correctly matched by Fail2Ban with the wordpress-hard.conf filter.

0.5.0

Fecha de lanzamiento: 27/10/2018
Add better support for use as a must-use plugin in the mu-plugins directory.

0.4.0

Fecha de lanzamiento: 15/01/2018
Subida la versión mínima requerida de WordPress a 4.5.
Subida la versión mínima requerida de PHP a 5.3. Este es un aumento suave, es decir, no ha cambiado nada que rompa la compatibilidad con PHP 5.2. En todo caso, esto podría cambiar fácilmente en el futuro y PHP 5.2 no se está comprobando activamente.
Renamed the wp_fail2ban_redux_openlog_indent filter to wp_fail2ban_redux_openlog_ident, because… it was misspelled.

0.3.1

Fecha de lanzamiento: 18/05/2017
Sube la versión mínima requerida de WordPress a 4.4.
Performance improvements when not blocking user enumeration.
Use wp_die to exit, to allow for greater customization of exit messages.
Exit messages are now escaped using esc_html.
Refactored plugin loading.
You can now create your own, custom, logging class, in case you don’t want to use the standard syslog() output.

0.3.0

Superseded by 0.3.1

0.2.1

Fecha de lanzamiento: 15/02/2017
Fix a stupid syntax error in the comment spam filter 🙁 Thanks to @ichtarzan for reporting!

0.2.0

Release date: 2016-09-27
Fixed PHP notices where WP_Fail2Ban_Redux::comment_spam expects two parameters. Decided it was probably a good idea to oblige.
User enumeration blocking now checks for both the author and author_name parameters. The author_name parameter could be used to validate the existence of a particular username, so blocking on this parameter as well will further reduce the attack surface.
Fixes an issue where user enumeration blocking was overzealous and would prevent actions in the admin area. Props pjv. #2
WP_Fail2Ban_Redux::redirect_canonical is now deprecated. If you were doing anything with this function, or the hook that initialized it, you should look at WP_Fail2Ban_Redux::user_enumeration instead.
Added a note to wordpress.conf about the logpath parameter, and common auth log locations. There is no need to changed existing configurations. This is merely to aid setup for future users.

0.1.1

Fecha de lanzamiento: 23/07/2016
In PHP < 7.0, exit isn’t allowed as a method name. WP_Fail2Ban_Redux_Log::exit is now WP_Fail2Ban_Redux_Log::_exit.

0.1.0

Fecha de lanzamiento: 13/07/2016
Versión inicial.

working fine

nice and clean, works great!

If you already have fail2ban, this is a must

Awesome plugin

Perfect!

Works perfect!