joho68

WebbPlatsen

This WordPress plugin provides security functionality and integration with fail2ban.
It does not require fail2ban to function.
Basic security functionality includes:
<ul>
<li>Disabling login with username (require e-mail address)</li>
<li>Allow/Deny login from IP address, hostname (including wildcard support)</li>
<li>Preventing user enumeration (?author=nnn)</li>
<li>Less detailed error messages on login failures</li>
<li>Minimum username length</li>
<li>Blocking specific usernames from being used to register new users</li>
<li>Requiring e-mail address matching for new user registrations</li>
<li>Warning about new user role setting</li>
<li>Blocking of portions or all of WordPress REST API</li>
<li>Disabling of RSS and Atom feeds</li>
<li>Removal of “Generator” information from HTML and feeds</li>
<li>Detection of Cloudflare IP addresses for logging of actual IP addresses</li>
<li>Blocking/Allowing logins from IP addresses, IP ranges, and/or hostnames</li>
<li>Partially or fully disable XMLRPC access</li>
</ul>
The plugin also plays nicely with Fail2ban, which is an advanced way of blocking IP addresses dynamically upon suspicious behavior.
Other notes:
<ul>
<li>This plugin may work with earlier versions of WordPress</li>
<li>This plugin has been tested with WordPress 5.5+ and 6.x at the time of this writing</li>
<li>This plugin has been tested with PHP 7.4, 8.1, 8.2, and 8.3 at the time of this writing</li>
<li>Local syntax/runtime compatibility checks have also been run on PHP 8.4</li>
<li>This plugin optionally makes use of <code>mb_</code> PHP functions</li>
<li>This plugin may create entries in your PHP error log (if active)</li>
<li>This plugin contains no Javascript</li>
<li>This plugin contains no tracking code and does not store any information about users</li>
</ul>
<h3>Credits</h3>
The Fail2WP Plugin was written by Joaquim Homrighausen while converting caffeine into code.
Fail2WP is sponsored by <a href="https://webbplatsen.se" rel="nofollow ugc">WebbPlatsen i Sverige AB</a>, Sweden.
Copyright 2020-2026 Joaquim Homrighausen; all rights reserved.
Commercial support and customizations for this plugin is available from WebbPlatsen i Sverige AB in Sweden.
If you find this plugin useful, the author is happy to receive a donation, good review, or just a kind word.
If there is something you feel to be missing from this plugin, or if you have found a problem with the code or a feature, please do not hesitate to reach out to support@webbplatsen.se.
This plugin can also be downloaded from <a href="https://code.webbplatsen.net/wordpress/fail2wp/" rel="nofollow ugc">code.webbplatsen.net</a> and <a href="https://github.com/joho1968/fail2wp" rel="nofollow ugc">GitHub</a>
More detailed documentation is available at <a href="https://code.webbplatsen.net/documentation/fail2wp/" rel="nofollow ugc">code.webbplatsen.net/documentation/fail2wp/</a>
Kudos to <a href="https://github.com/tholu" rel="nofollow ugc">Thomas Lutz</a>.

Fail2WP

Security plugin for WordPress with support for fail2ban. Tested with WordPress 5.5+ and PHP 7.4-8.4

Todd - WireFlare

<a href="https://wireflare.com/wordpress-login-security-fail2ban/" title="WordPress Login Security with Fail2Ban" rel="nofollow ugc">WireFlare</a> WordPress Fail2Ban Plugin creates a syslog facility to log invalid login attempts in a custom file for use with Fail2Ban.
PLEASE READ 
This plugin has no options and will not work without having server side root access.
You must follow our guide for setting up the server to make this plugin do it’s job. The guide can be found here: <a href="https://wireflare.com/wordpress-login-security-fail2ban/" title="WordPress Login Security with Fail2Ban by WireFlare" rel="nofollow ugc">WordPress Login Security with Fail2Ban</a>
What this plugin does: 
This plugin constructs a syslog facility called local1. It then hooks into the WP login failed action. Any invalid login attempts are logged with the ip address, username used and website that it’s coming from. These invalid attempts are parsed by Fail2Ban to provide a proactive method to block intrusion attempts.
This plugin is different from other plugins in that we don’t save to the syslog. A custom log is created. This reduces the CPU load on the server and keeps a log dedicated to invalid WordPress login attempts. These log entries can be used to block repeat offenders as well as place temporary blocks on anyone attempting to break your website. The log file can also be used across many different websites and transferred between servers.
Visit us at <a href="https://wireflare.com" rel="nofollow ugc">WireFlare</a>

WordPress Fail2Ban

Plugin creates a syslog facility to log invalid login attempts in a custom file for use with Fail2Ban

Fail2WP vs WordPress Fail2Ban