Fail2WP

Fail2WP is a security plugin that adds Fail2ban integration and a suite of login hardening features to protect your site from brute-force attacks and abuse. It works out of the box with minimal setup.

• Fail2ban Integration: Automatically ban IPs showing suspicious behavior by feeding logs to Fail2ban, blocking repeated attackers at the server level.
• Login & Registration Controls: Disable login by username, require email, enforce minimum username length, and block specific usernames from registration. Also warns about new user role settings.
• User Enumeration Prevention: Block attackers from discovering valid usernames through ?author= queries.
• API & Feed Restrictions: Partially or fully disable XMLRPC, block portions of the REST API, and turn off RSS/Atom feeds to reduce attack surface.
• IP Management: Allow or block logins from specific IP addresses, ranges, or hostnames. Supports Cloudflare IP detection for accurate logging.

Additional hardening includes less detailed error messages on login failure and removal of generator information from HTML and feeds.