by invisnet 4.2 (71 reviews)

WP fail2ban – Advanced Security

Name: WP fail2ban – Advanced Security
Rating: 4.2 (71 reviews)
Author: invisnet

WP fail2ban uses fail2ban to protect your WordPress site.

WP fail2ban ranks #627 among WordPress.org plugins with 60,000+ active installations, is #33 of 1,659 in the Authentication category, a 4.2/5 rating from 71 reviews, and was last updated Oct 20, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v5.5.0 Current Version v5.5.0

Updated 1 week ago Last Update on 20 Oct, 2026

Refreshed 18 hours ago Last Refreshed on

#33 of 1,659 in Authentication Top 1% by installs Downloads -72.6% this week Actively maintained

View on WordPress.org

Rank

#627

— No change

Active Installs

60K+

— No change

KW Avg Position

22.8

— No change

Downloads

2.1M

+149 today

Support Resolved

— No change

Rating

84%

Review 4.2 out of 5

4.2 (71 reviews)

Next Milestone 70K

Total Progress 85.7%

60K+ 70K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 1,429 more installs to reach 70K+

Rank Changes

Current #627

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.2

71 reviews

Overall 84%

51 (72%)

4 (6%)

2 (3%)

4 (6%)

10 (14%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

Resolution Rate

Security History

Source: WPVulnerability

8 known vulnerabilities on record · 1 in the last 24 months · checked 1 week ago

Apr 30, 2026

WP fail2ban – Advanced Security [wp-fail2ban] < 5.4.0 (closed)

CVE-2024-13362 · Fixed in v5.4.0
Oct 16, 2024

WP fail2ban – Advanced Security [wp-fail2ban] < 4.4.0.2

CVE-2022-4974 · Fixed in v4.4.0.2
Jul 18, 2023

WP fail2ban – Advanced Security [wp-fail2ban] < 5.1.1 (closed)

CVE-2023-33999 · Fixed in v5.1.1
Mar 4, 2022

WP fail2ban – Advanced Security [wp-fail2ban] < 4.4.0.2 (closed)

CVE-2022-4974 · Fixed in v4.4.0.2
Feb 28, 2022

WP fail2ban – Advanced Security [wp-fail2ban] < 4.4.0.3 (closed)

Fixed in v4.4.0.3
Feb 28, 2022

WP fail2ban – Advanced Security [wp-fail2ban] < 4.4.0.3 (closed)

Fixed in v4.4.0.3
Feb 25, 2019

WP fail2ban – Advanced Security [wp-fail2ban] < 4.0.5 (closed)

Fixed in v4.0.5
WP fail2ban – Advanced Security [wp-fail2ban] < 4.0.5 (closed)

Fixed in v4.0.5

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 5.5.0
Last Updated: Oct 20, 2026
Requires WP: 4.2+
Tested Up To: 7.1.4
PHP Version: 7.4 or higher
Author: invisnet

Support & Rating

Rating: ★ ★ ★ ★ ☆ 4.2
Reviews: 71
Support Threads: 1
Resolved: 0%

Keywords

Brute Force fail2ban login security syslog

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site administrators who want to protect their login and comment forms from automated attacks. It connects WordPress activity to fail2ban so that malicious IPs, such as those attempting brute-force logins, user enumeration, or spam, can be logged and banned.

Logs failed login attempts
Blocks user enumeration
Blocks username-based logins
Blocks specified usernames
Logs empty username login attempts
Logs spam comment IPs
Rate-limits pingback abuse
Cloudflare and proxy server support

Frequently Asked Questions

Common questions about WP fail2ban – Advanced Security

No. fail2ban is the service that watches logs and bans abusive IP addresses at the firewall. WP fail2ban is the bridge between WordPress and fail2ban: it tells fail2ban what is happening inside WordPress in a form it can act on. The name dates from 2011, when “WP + something” was commonly understood to mean an integration between WordPress and that thing.

It shouldn’t. The Premium notices are provided by Freemius and use WordPress’s normal admin request handling to remember when you dismiss them. If another plugin mishandles that request before WP fail2ban or Freemius sees it, the dismissal is never saved and the notice can appear again. Because plugins are usually loaded alphabetically, this can be caused by almost any plugin loaded before WP fail2ban. There is very little WP fail2ban can do to work around another plugin breaking the request.

If you can configure fail2ban and the firewall, yes. That normally includes VPSs, dedicated servers, and other hosting where you have control of the operating system. WP fail2ban supplies the WordPress side of the integration; fail2ban and the firewall run on the server. On managed hosting, it depends on what your provider allows. If you cannot install or configure fail2ban yourself, ask your host whether they support it or can add the WP fail2ban filters for you.

The WP fail2ban Blocklist uses attacks seen by participating WP fail2ban sites to identify hostile IP addresses. That means your firewall can block an address before it attacks your site, rather than waiting for your site to see enough activity for fail2ban to act. The Blocklist is built from WP fail2ban’s own data, not third-party threat feeds. The Free edition receives a reduced list; Premium receives the full current intelligence available for your site. Learn more about the WP fail2ban Blocklist add-on →

The WordPress.org edition remains on 5.x so it can continue to support PHP 7.4. There are still a lot of WP fail2ban sites running PHP 7.4, even though PHP itself stopped supporting it nearly four years ago. Premium is based on 6.x and requires PHP 8 or later. It has moved on significantly from 5.x as WP fail2ban continues to develop. WordPress.org does not provide parallel release channels for different major versions, so 5.x and 6.x cannot both be offered for different PHP versions. Keeping the WordPress.org edition on 5.x is therefore a compromise: it lets development continue on modern PHP without abandoning existing WP fail2ban users who have not yet been able to move away from PHP 7.4.

The Free edition covers the everyday WordPress abuse most sites need fail2ban to act on. Premium goes further with the full Blocklist, the Web Application Firewall, persistent event history, geo‑blocking, maintained security data, and additional controls. Compare all Free and Premium features →

It depends which kind of firewall you mean. WP fail2ban is not a network firewall. It tells fail2ban when WordPress sees abusive behaviour, and fail2ban can then add bans to the server’s stateful network firewall. That firewall stops traffic before it reaches WordPress. Premium also includes a Web Application Firewall (WAF). A WAF works at a different layer: it examines what a request is trying to make WordPress do and can block malicious application-level behaviour, including SQL injection. The two complement each other. The network firewall blocks hostile sources; the WAF protects WordPress from malicious requests that reach WordPress.

They work at different layers, and they can work together. ModSecurity and similar web-server WAFs inspect HTTP requests and responses and apply rules before or around the application. That makes them good at rejecting traffic based on what the request itself looks like. WP fail2ban runs inside WordPress, so it can see what the request actually means to WordPress: whether a login failed, whether a username exists, whether a comment was rejected as spam, what WordPress operation was attempted, and so on. It turns that application-level knowledge into events that fail2ban can act on at the network firewall. Premium’s WAF uses the same advantage. For SQL injection, for example, it can inspect the SQL WordPress is actually about to execute rather than trying to infer solely from the incoming request whether it contains an attack. They are complementary, not alternatives: a web-server WAF can reject malicious-looking requests before WordPress sees them; WP fail2ban can act after WordPress has interpreted them and knows what they actually mean.

Yes, but WP fail2ban needs to know which proxies it can trust. A reverse proxy means the connection to WordPress comes from the proxy rather than directly from the visitor. WP fail2ban uses X-Forwarded-For to recover the real client IP, but only when the connecting address belongs to a proxy you have explicitly trusted. That prevents an attacker simply supplying their own forwarding header. WP fail2ban deliberately uses only X-Forwarded-For for client IP resolution. Keeping a single trusted path through that part of the code reduces the chances of subtle bugs or inconsistent behaviour, and X-Forwarded-For is the standard header that reverse proxies are expected to support. Free lets you configure trusted proxy networks yourself. Premium can keep Cloudflare's published IP ranges up to date automatically, so Cloudflare's edge nodes remain recognised as trusted proxies as its network changes. The CF-Connecting-IP header is not used to determine the client address. WP fail2ban only uses it as a signal that a site appears to be behind Cloudflare, so it can recommend the appropriate QuickStart configuration. Read more about how WP fail2ban handles client IP addresses →

Not as part of normal operation. WP fail2ban’s normal job is local: WordPress generates the event, WP fail2ban records it, and fail2ban acts on it on your server. The Free edition includes Freemius, but sharing usage information with Freemius is optional: you can skip the opt-in and continue using and updating WP fail2ban. Premium uses Freemius for purchasing, licensing, and updates, so that connection is part of using the paid product. Freemius publishes what information it collects and why. Freemius data practices The Blocklist is a separate add-on and necessarily has its own data exchange; its README explains that separately.