Fail2WP

This WordPress plugin provides security functionality and integration with fail2ban.

It does not require fail2ban to function.

Basic security functionality includes:

• Disabling login with username (require e-mail address)
• Allow/Deny login from IP address, hostname (including wildcard support)
• Preventing user enumeration (?author=nnn)
• Less detailed error messages on login failures
• Minimum username length
• Blocking specific usernames from being used to register new users
• Requiring e-mail address matching for new user registrations
• Warning about new user role setting
• Blocking of portions or all of WordPress REST API
• Disabling of RSS and Atom feeds
• Removal of “Generator” information from HTML and feeds
• Detection of Cloudflare IP addresses for logging of actual IP addresses
• Blocking/Allowing logins from IP addresses, IP ranges, and/or hostnames
• Partially or fully disable XMLRPC access
• Monitoring administrator accounts for unexpected role/account changes

The plugin also plays nicely with Fail2ban, which is an advanced way of blocking IP addresses dynamically upon suspicious behavior.

Other notes:

• This plugin may work with earlier versions of WordPress
• This plugin has been tested with WordPress 5.5-7.0.x at the time of this writing
• This plugin has been tested with PHP 7.4, 8.1, 8.2, and 8.3 at the time of this writing
• Local syntax/runtime compatibility checks have also been run on PHP 8.4
• This plugin optionally makes use of mb_ PHP functions