Fail2WP

• Adds security controls to WordPress.
• Fail2ban integration is optional.

Security features:

• Disabling login with username (require e-mail address)
• Allow/Deny login from IP address, hostname (including wildcard support)
• Preventing user enumeration (?author=nnn)
• Less detailed error messages on login failures
• Minimum username length
• Blocking specific usernames from being used to register new users
• Requiring e-mail address matching for new user registrations
• Warning about new user role setting
• Blocking of portions or all of WordPress REST API
• Disabling of RSS and Atom feeds
• Removal of “Generator” information from HTML and feeds
• Detection of Cloudflare IP addresses for logging of actual IP addresses
• Blocking/Allowing logins from IP addresses, IP ranges, and/or hostnames
• Partially or fully disable XMLRPC access

• Monitoring administrator accounts for unexpected role/account changes

• Fail2ban can dynamically block IP addresses after suspicious activity.

Other notes:

• Requires WordPress 6.2+ and PHP 7.4+.
• PHP compatibility checks: 7.4, 8.1, 8.2, 8.3, and 8.4.
• Uses mb_ PHP functions when available.
• May write to the PHP error log when logging is enabled.
• Contains no JavaScript or tracking code.
• Optional IP blocking stores IP addresses and security-event timestamps. Administrator monitoring stores administrator IDs and login names.

Reverse proxy configuration:

• Available since 1.4.0.
• Setting: FAIL2WP_TRUSTED_PROXIES in wp-config.php, before wp-settings.php loads.

• Value: array of proxy IPv4/IPv6 addresses or CIDRs.

  define( ‘FAIL2WP_TRUSTED_PROXIES’, [ ‘192.0.2.10’, ‘2001:db8:1234::/48’ ] );

• Replace the examples with your actual proxy addresses.

• List directly connected proxy peers, identified by REMOTE_ADDR.
• Hostnames and wildcards: unsupported for this constant.
• Undefined or empty array: X-Real-IP ignored.
• Accepted header: one valid IP from a listed proxy.
• Missing or invalid header: peer address used.
• Proxy requirement: overwrite client-supplied X-Real-IP.
• Multiple proxy hops: final proxy supplies the verified visitor IP.
• X-Forwarded-For and address chains: unsupported.
• Proxy trust does not bypass login restrictions or IP bans.
• Scope: entire WordPress installation; excluded from settings exports.
• Server already supplies a verified REMOTE_ADDR: usually no constant needed.
• Cloudflare: enabled setting, matching source range, valid CF-Connecting-IP; takes precedence.
• Upgrade: configure trusted proxies before updating an existing X-Real-IP deployment.
• Verify client addresses and login access on staging.
• Login/bypass hostname wildcards: separate feature; forward-confirmed reverse DNS required.

Credits

The Fail2WP Plugin was written by Joaquim Homrighausen while converting caffeine into code.

Fail2WP is sponsored by WebbPlatsen i Sverige AB, Sweden.

Copyright 2020-2026 Joaquim Homrighausen; all rights reserved.

Commercial support and customizations for this plugin is available from WebbPlatsen i Sverige AB in Sweden.

If you find this plugin useful, the author is happy to receive a donation, good review, or just a kind word.

If there is something you feel to be missing from this plugin, or if you have found a problem with the code or a feature, please do not hesitate to reach out to [email protected].

This plugin can also be downloaded from code.webbplatsen.net and GitHub

More detailed documentation is available at code.webbplatsen.net/documentation/fail2wp/

Kudos to Thomas Lutz.