atmosphear

Send an “HTTP/1.1 403 Forbidden” header on a failed login instead of “HTTP/1.1 200 OK”, which is the WordPress default header on failed login. This is a tremendously simple plugin that does only that and absolutely nothing else.
The purpose of this plugin is to provide a way to allow external tools like fail2ban to get a message of a failed login e.g. to prevent a brute-force attack on a firewall level.
For the public domain.
Uses PHP5.3 anonymous functions and will not work on earlier versions of PHP

HTTP/1.1 403 Forbidden header on a failed login

Send an "HTTP/1.1 403 Forbidden" header on a failed login instead of the default "HTTP/1.1 200 OK"

WebbPlatsen

joho68

This WordPress plugin provides security functionality and integration with fail2ban.
It does not require fail2ban to function.
Basic security functionality includes:
<ul>
<li>Disabling login with username (require e-mail address)</li>
<li>Allow/Deny login from IP address, hostname (including wildcard support)</li>
<li>Preventing user enumeration (?author=nnn)</li>
<li>Less detailed error messages on login failures</li>
<li>Minimum username length</li>
<li>Blocking specific usernames from being used to register new users</li>
<li>Requiring e-mail address matching for new user registrations</li>
<li>Warning about new user role setting</li>
<li>Blocking of portions or all of WordPress REST API</li>
<li>Disabling of RSS and Atom feeds</li>
<li>Removal of “Generator” information from HTML and feeds</li>
<li>Detection of Cloudflare IP addresses for logging of actual IP addresses</li>
<li>Blocking/Allowing logins from IP addresses, IP ranges, and/or hostnames</li>
<li>Partially or fully disable XMLRPC access</li>
</ul>
The plugin also plays nicely with Fail2ban, which is an advanced way of blocking IP addresses dynamically upon suspicious behavior.
Other notes:
<ul>
<li>This plugin may work with earlier versions of WordPress</li>
<li>This plugin has been tested with WordPress 5.5+ and 6.x at the time of this writing</li>
<li>This plugin has been tested with PHP 7.4, and 8.1.x at the time of this writing</li>
<li>This plugin optionally makes use of <code>mb_</code> PHP functions</li>
<li>This plugin may create entries in your PHP error log (if active)</li>
<li>This plugin contains no Javascript</li>
<li>This plugin contains no tracking code and does not store any information about users</li>
</ul>
<h3>Credits</h3>
The Fail2WP Plugin was written by Joaquim Homrighausen while converting caffeine into code.
Fail2WP is sponsored by <a href="https://webbplatsen.se" rel="nofollow ugc">WebbPlatsen i Sverige AB</a>, Sweden.
Commercial support and customizations for this plugin is available from WebbPlatsen i Sverige AB in Sweden.
If you find this plugin useful, the author is happy to receive a donation, good review, or just a kind word.
If there is something you feel to be missing from this plugin, or if you have found a problem with the code or a feature, please do not hesitate to reach out to support@webbplatsen.se.
This plugin can also be downloaded from <a href="https://code.webbplatsen.net/wordpress/fail2wp/" rel="nofollow ugc">code.webbplatsen.net</a> and <a href="https://github.com/joho1968/fail2wp" rel="nofollow ugc">GitHub</a>
More detailed documentation is available at <a href="https://code.webbplatsen.net/documentation/fail2wp/" rel="nofollow ugc">code.webbplatsen.net/documentation/fail2wp/</a>
Kudos to <a href="https://github.com/tholu" rel="nofollow ugc">Thomas Lutz</a>.

Fail2WP

Security plugin for WordPress with support for fail2ban. Tested with WordPress 5.5+ and PHP 7.4/8.1.x.

HTTP/1.1 403 Forbidden header on a failed login vs Fail2WP