Fail2WP

• Adds security controls to WordPress.

• Fail2ban integration is optional.

Security features:

• Disabling login with username (require e-mail address)

• Allow/Deny login from IP address, hostname (including wildcard support)

• Preventing user enumeration (?author=nnn)

• Less detailed error messages on login failures

• Minimum username length

• Blocking specific usernames from being used to register new users

• Requiring e-mail address matching for new user registrations

• Warning about new user role setting

• Blocking of portions or all of WordPress REST API

• Disabling of RSS and Atom feeds

• Removal of “Generator” information from HTML and feeds

• Detection of Cloudflare IP addresses for logging of actual IP addresses

• Blocking/Allowing logins from IP addresses, IP ranges, and/or hostnames

• Partially or fully disable XMLRPC access

-

Monitoring administrator accounts for unexpected role/account changes

-

Fail2ban can dynamically block IP addresses after suspicious activity.

Other notes:

• Requires WordPress 6.2+ and PHP 7.4+.

• PHP compatibility checks: 7.4, 8.1, 8.2, 8.3, and 8.4.

• Uses mb_ PHP functions when available.

• May write to the PHP error log when logging is enabled.

• Contains no JavaScript or tracking code.

• Optional IP blocking stores IP addresses and security-event timestamps. Administrator monitoring stores administrator IDs and login names.

Reverse proxy configuration:

• Available since 1.4.0.

• Setting: FAIL2WP_TRUSTED_PROXIES in wp-config.php, before wp-settings.php loads.

-

Value: array of proxy IPv4/IPv6 addresses or CIDRs.

10’, ‘2001:db8:1234::/48’ ] );

-

Replace the examples with your actual proxy addresses.

• List directly connected proxy peers, identified by REMOTE_ADDR.

• Hostnames and wildcards: unsupported for this constant.

• Undefined or empty array: X-Real-IP ignored.

• Accepted header: one valid IP from a listed proxy.

• Missing or invalid header: peer address used.

• Proxy requirement: overwrite client-supplied X-Real-IP.

• Multiple proxy hops: final proxy supplies the verified visitor IP.

• X-Forwarded-For and address chains: unsupported.

• Proxy trust does not bypass login restrictions or IP bans.

• Scope: entire WordPress installation; excluded from settings exports.

• Server already supplies a verified REMOTE_ADDR: usually no constant needed.

• Cloudflare: enabled setting, matching source range, valid CF-Connecting-IP; takes precedence.

• Upgrade: configure trusted proxies before updating an existing X-Real-IP deployment.

• Verify client addresses and login access on staging.

• Login/bypass hostname wildcards: separate feature; forward-confirmed reverse DNS required.

Credits

The Fail2WP Plugin was written by Joaquim Homrighausen while converting caffeine into code.

Fail2WP is sponsored by WebbPlatsen i Sverige AB, Sweden.

Copyright 2020-2026 Joaquim Homrighausen; all rights reserved.

Commercial support and customizations for this plugin is available from WebbPlatsen i Sverige AB in Sweden.

If you find this plugin useful, the author is happy to receive a donation, good review, or just a kind word.

se.

net and GitHub

net/documentation/fail2wp/

Kudos to Thomas Lutz.