{"id":52234,"date":"2020-01-23T11:25:07","date_gmt":"2020-01-23T16:25:07","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/?p=52234"},"modified":"2021-08-16T15:43:03","modified_gmt":"2021-08-16T19:43:03","slug":"prevent-brute-force-wordpress-logins-with-wp-fail2ban","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/","title":{"rendered":"Prevent Brute-Force WordPress Logins with WP fail2ban"},"content":{"rendered":"

WP <\/a>fail2ban<\/a> is a freemium WordPress security plugin with features for logging, brute-force attack prevention, and spam protection. In the free version you must edit the wp-config.php file with any configurations. Then, it\u2019ll view within your WordPress dashboard.<\/p>\n\n\n\n

If you prefer a full-featured security plugin, we recommend Cerber Security, Antispam & Malware Scan<\/a> and BBQ: Block Bad Queries<\/a>.<\/p>\n\n\n\n

There\u2019s a lot of data in your wp-config.php<\/a> file already. However, you only need to add two lines to block user enumeration (requests for author username queries). Below we cover how to block user login attempts with WP fail2ban using your wp-config.php file (free version)<\/a> and the WordPress dashboard (paid version)<\/a>.<\/p>\n\n\n\n

Install the WP fail2ban plugin<\/a> before continuing.<\/p>\n\n\n\n

WP-config.php<\/h2>\n\n\n\n
  1. Log into SSH<\/a>, cPanel or FTP<\/a><\/li>
  2. Navigate to your WordPress root directory<\/a><\/li>
  3. Edit your wp-config.php file<\/li>
  4. Under your database lines (e.g. define( 'DB_COLLATE', '' );<\/code>, add this to block users who try to login with specific usernames:
    define('WP_FAIL2BAN_BLOCKED_USERS', ['^admin$', '^root$']);<\/code>
    This blocks any user login attempts including \u201cadmin\u201d or \u201croot\u201d

    This is case-insensitive and you can use regular expression (regex) if you\u2019re using PHP 7 or higher<\/a>.<\/p><\/li>

  5. Add this to block enumeration: attempts:define('WP_FAIL2BAN_BLOCK_USER_ENUMERATION', true);<\/code><\/li>
  6. Save your changes<\/li><\/ol>\n\n\n\n

    Paid Version<\/h2>\n\n\n\n

    Users with the paid subscription can block user enumeration attempts and login attempts within the WordPress dashboard:<\/p>\n\n\n\n

    1. Log into your WordPress dashboard<\/a><\/li>
    2. On the left, select WP fail2ban<\/strong>, then Settings<\/strong><\/li>
    3. Click the Users<\/strong> tab<\/li>
    4. Check the User Enumeration<\/strong> box and add Usernames<\/strong> to block<\/li><\/ol>\n\n\n\n
      \"\"<\/figure>\n\n\n\n

      Get more comfortable with the file with our in-depth look at <\/a>wp<\/a>.<\/a>config<\/a>.<\/a>php<\/a>.<\/p>\n\n\n\n

      Enhance your WordPress performance with our NGINX-powered WordPress Hosting<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

      WP fail2ban is a freemium WordPress security plugin with features for logging, brute-force attack prevention, and spam protection. In the free version you must edit the wp-config.php file with any configurations. Then, it’ll view within your WordPress dashboard. If you prefer a full-featured security plugin, we recommend Cerber Security, Antispam & Malware Scan and BBQ: Read More ><\/a><\/p>\n","protected":false},"author":57014,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[56],"tags":[],"class_list":["post-52234","post","type-post","status-publish","format-standard","hentry","category-wordpress"],"acf":[],"yoast_head":"\nPrevent Brute-Force WordPress Logins with WP fail2ban | InMotion Hosting<\/title>\n<meta name=\"description\" content=\"Learn how to prevent brute-force attacks and user enumeration with the WP fail2ban WordPress security plugin.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Prevent Brute-Force WordPress Logins with WP fail2ban | InMotion Hosting\" \/>\n<meta property=\"og:description\" content=\"Learn how to prevent brute-force attacks and user enumeration with the WP fail2ban WordPress security plugin.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/\" \/>\n<meta property=\"og:site_name\" content=\"InMotion Hosting Support Center\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/inmotionhosting\/\" \/>\n<meta property=\"article:published_time\" content=\"2020-01-23T16:25:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-16T19:43:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2020\/01\/fail2ban-wp-users.png\" \/>\n<meta name=\"author\" content=\"InMotion Hosting Contributor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/InMotionHosting\" \/>\n<meta name=\"twitter:site\" content=\"@InMotionHosting\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"InMotion Hosting Contributor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/\"},\"author\":{\"name\":\"InMotion Hosting Contributor\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\"},\"headline\":\"Prevent Brute-Force WordPress Logins with WP fail2ban\",\"datePublished\":\"2020-01-23T16:25:07+00:00\",\"dateModified\":\"2021-08-16T19:43:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/\"},\"wordCount\":275,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2020\/01\/fail2ban-wp-users.png\",\"articleSection\":[\"WordPress Tutorials\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/\",\"name\":\"Prevent Brute-Force WordPress Logins with WP fail2ban | InMotion Hosting\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2020\/01\/fail2ban-wp-users.png\",\"datePublished\":\"2020-01-23T16:25:07+00:00\",\"dateModified\":\"2021-08-16T19:43:03+00:00\",\"description\":\"Learn how to prevent brute-force attacks and user enumeration with the WP fail2ban WordPress security plugin.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#primaryimage\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2020\/01\/fail2ban-wp-users.png\",\"contentUrl\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2020\/01\/fail2ban-wp-users.png\",\"width\":750,\"height\":334},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.inmotionhosting.com\/support\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Prevent Brute-Force WordPress Logins with WP fail2ban\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"name\":\"InMotion Hosting Support Center\",\"description\":\"Web Hosting Support & Tutorials\",\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\",\"name\":\"InMotion Hosting\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"contentUrl\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"width\":696,\"height\":696,\"caption\":\"InMotion Hosting\"},\"image\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/inmotionhosting\/\",\"https:\/\/x.com\/InMotionHosting\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\",\"name\":\"InMotion Hosting Contributor\",\"description\":\"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/inmotion-hosting\/\",\"https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting\"],\"url\":\"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Prevent Brute-Force WordPress Logins with WP fail2ban | InMotion Hosting","description":"Learn how to prevent brute-force attacks and user enumeration with the WP fail2ban WordPress security plugin.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/","og_locale":"en_US","og_type":"article","og_title":"Prevent Brute-Force WordPress Logins with WP fail2ban | InMotion Hosting","og_description":"Learn how to prevent brute-force attacks and user enumeration with the WP fail2ban WordPress security plugin.","og_url":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/","og_site_name":"InMotion Hosting Support Center","article_publisher":"https:\/\/www.facebook.com\/inmotionhosting\/","article_published_time":"2020-01-23T16:25:07+00:00","article_modified_time":"2021-08-16T19:43:03+00:00","og_image":[{"url":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2020\/01\/fail2ban-wp-users.png","type":"","width":"","height":""}],"author":"InMotion Hosting Contributor","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/InMotionHosting","twitter_site":"@InMotionHosting","twitter_misc":{"Written by":"InMotion Hosting Contributor","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#article","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/"},"author":{"name":"InMotion Hosting Contributor","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644"},"headline":"Prevent Brute-Force WordPress Logins with WP fail2ban","datePublished":"2020-01-23T16:25:07+00:00","dateModified":"2021-08-16T19:43:03+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/"},"wordCount":275,"commentCount":0,"publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"image":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2020\/01\/fail2ban-wp-users.png","articleSection":["WordPress Tutorials"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/","url":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/","name":"Prevent Brute-Force WordPress Logins with WP fail2ban | InMotion Hosting","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#primaryimage"},"image":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2020\/01\/fail2ban-wp-users.png","datePublished":"2020-01-23T16:25:07+00:00","dateModified":"2021-08-16T19:43:03+00:00","description":"Learn how to prevent brute-force attacks and user enumeration with the WP fail2ban WordPress security plugin.","breadcrumb":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#primaryimage","url":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2020\/01\/fail2ban-wp-users.png","contentUrl":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2020\/01\/fail2ban-wp-users.png","width":750,"height":334},{"@type":"BreadcrumbList","@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/prevent-brute-force-wordpress-logins-with-wp-fail2ban\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inmotionhosting.com\/support\/"},{"@type":"ListItem","position":2,"name":"Prevent Brute-Force WordPress Logins with WP fail2ban"}]},{"@type":"WebSite","@id":"https:\/\/www.inmotionhosting.com\/support\/#website","url":"https:\/\/www.inmotionhosting.com\/support\/","name":"InMotion Hosting Support Center","description":"Web Hosting Support & Tutorials","publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.inmotionhosting.com\/support\/#organization","name":"InMotion Hosting","url":"https:\/\/www.inmotionhosting.com\/support\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/","url":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","contentUrl":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","width":696,"height":696,"caption":"InMotion Hosting"},"image":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/inmotionhosting\/","https:\/\/x.com\/InMotionHosting"]},{"@type":"Person","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644","name":"InMotion Hosting Contributor","description":"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!","sameAs":["https:\/\/www.linkedin.com\/company\/inmotion-hosting\/","https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting"],"url":"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"primary_category":null,"_links":{"self":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/52234","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/users\/57014"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/comments?post=52234"}],"version-history":[{"count":11,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/52234\/revisions"}],"predecessor-version":[{"id":83045,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/52234\/revisions\/83045"}],"wp:attachment":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/media?parent=52234"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/categories?post=52234"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/tags?post=52234"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}