# Wordpress - Fail2Ban - PHP **URL:** \ **Category:** Webmin\ **Created:** [April 22, 2024, 7:20am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141 "2024-04-22T07:20:27Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Virtuello](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/v/e19adc/32.png) [@Virtuello](https://forum.virtualmin.com/u/Virtuello)\ **Post date:** [April 22, 2024, 7:20am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/1 "2024-04-22T07:20:27Z")
| SYSTEM INFORMATION | | | --- | --- | | OS type and version | Debian Linux 11 | | Webmin version | 2.105 | Has anybody managed to jail f.e. false login attempts out of numerous wordpress instances on one server? Every virtual wordpress site writes its logs in its own subdirectory but the Fail2Ban architecture is made for a consolidated operation. I know there is a wordpress plugin that beams messages into the /var/log/auth.log file. But I am hoping for a more clever solution that solves the task without having to touch every virtual server. Any help will be rewarded with the gold medal of honor. Thanks! ---
**Author:** ![stefan1959](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/s/49beb7/32.png) [@stefan1959](https://forum.virtualmin.com/u/stefan1959)\ **Post date:** [April 22, 2024, 8:31am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/2 "2024-04-22T08:31:06Z")
Found this, rules look like it should run ok on virtuamin, just make sure your selecting the correct log file. > **[Fail2ban for WordPress on DigitalOcean - Sail Blog](https://blog.sailed.io/fail2ban-wordpress-digitalocean/)** > > Fail2ban is an open source security utility, which scans log files for certain patterns and bans IPs when malicious activity is encountered. This could be used to protect WordPress from bruteforce attacks, pingback attacks and more. In this tutorial... but it looks like you need to add a “plugin” to wordpress. I just use wordfence, but not sure your keen on that. ---
**Author:** ![jimr1](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/jimr1/32/14173_2.png) [@jimr1](https://forum.virtualmin.com/u/jimr1)\ **Post date:** [April 22, 2024, 8:31am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/3 "2024-04-22T08:31:12Z")
I don’t use word press but i would hope you could conigure the log to and directory/file. If that is possible get each instance to log to the same file then use fail2ban to scan that. Or you could write a script that scans /home for the existance of the log files and then process from there ---
**Author:** ![stefan1959](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/s/49beb7/32.png) [@stefan1959](https://forum.virtualmin.com/u/stefan1959)\ **Post date:** [April 22, 2024, 8:44am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/4 "2024-04-22T08:44:08Z")
Have you read this in the forum? > [@Fail2Ban not matching or banning new WordPress filter](https://forum.virtualmin.com/t/fail2ban-not-matching-or-banning-new-wordpress-filter/123209/16): > > Yes that’s mainly the reason i wish to completely ban the IPs. Besides the login page, there are still thousands of other hits to xmlrpc.php, and the same actor attempting wp-login is also brute forcing xmlrpc.php so it makes sense to ban both. The original issue still remains, tho, new filter is reporting all zeros, even with a direct log path without wildcard. ---
**Author:** ![Virtuello](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/v/e19adc/32.png) [@Virtuello](https://forum.virtualmin.com/u/Virtuello)\ **Post date:** [April 22, 2024, 8:49am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/5 "2024-04-22T08:49:30Z")
Yes, thanks & and I think the problem is recognized by the developers: > [@All Apache's fail2ban jails look useless](https://forum.virtualmin.com/t/all-apaches-fail2ban-jails-look-useless/125156/2): > > Ok here is a long winded fix in server templates change \_log to .log drop to a terminal then cd /etc/apache2/sites-available and run sed -i ‘s/\_log/.log/g’ \* this will change where apache logs to then change you fail2ban config to something like restart apache2 and check that the new log files are created if so, restart fail2ban then navigate to /etc/logrotate.d and run this sed -i ‘s/\_log/.log/g’ virtualmin.conf which will take care of the new files for log … Also this might be a path to follow … ---
**Author:** ![Virtuello](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/v/e19adc/32.png) [@Virtuello](https://forum.virtualmin.com/u/Virtuello)\ **Post date:** [April 22, 2024, 8:51am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/6 "2024-04-22T08:51:57Z")
Interesting that the author of this post warns of the plugins available within wordpress to solve the problem … ---
**Author:** ![Virtuello](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/v/e19adc/32.png) [@Virtuello](https://forum.virtualmin.com/u/Virtuello)\ **Post date:** [April 22, 2024, 8:59am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/7 "2024-04-22T08:59:16Z")
Thank you jimr1 for your suggestion. It is certainly the path of the solution. With wordfence we are again on the level of virtualmin. I hope to solve the problem once and for all for the whole server. ---
**Author:** ![Randomz](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/r/839c29/32.png) [@Randomz](https://forum.virtualmin.com/u/Randomz)\ **Post date:** [April 22, 2024, 11:03pm UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/8 "2024-04-22T23:03:47Z")
I am a bit confused. This is the Webmin area but it appears that the OP is using Virtualmin ? On my RHEL based servers whether running Virtualmin or not, all access and error logs are written to the same directory then Virtualmin uses symlinks to allow the logs to be seen in each domain. I created a filter to catch all xmlrpc entries and set logpath = /var/log/virtualmin/\*access\_log This has been working really well for me. Is Debian really so different to RHEL? ---
**Author:** ![Joe](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/joe/32/9_2.png) [@Joe](https://forum.virtualmin.com/u/Joe)\ **Post date:** [April 23, 2024, 6:16am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/9 "2024-04-23T06:16:37Z")
That’s not a Virtualmin developer. But, we are aware of the conversation about it (I wouldn’t call it a problem…it’s just a thing that is). ---
**Author:** ![Ilia](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/ilia/32/10185_2.png) [@Ilia](https://forum.virtualmin.com/u/Ilia)\ **Post date:** [April 23, 2024, 8:40am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/10 "2024-04-23T08:40:17Z")
Perhaps, I make the WordPress Kit in Virtualmin set up a jail to support WordPress failed logins? ---
**Author:** ![Virtuello](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/v/e19adc/32.png) [@Virtuello](https://forum.virtualmin.com/u/Virtuello)\ **Post date:** [April 24, 2024, 7:51am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/11 "2024-04-24T07:51:52Z")
… and there goes the medal of honor … ---
**Author:** ![marketus](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/marketus/32/7711_2.png) [@marketus](https://forum.virtualmin.com/u/marketus)\ **Post date:** [April 26, 2024, 1:27pm UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/12 "2024-04-26T13:27:03Z")
we use malware on our Wordpress sites and it handles things that I do not even knew existed. ---
**Author:** ![shoulders](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/shoulders/32/10086_2.png) [@shoulders](https://forum.virtualmin.com/u/shoulders)\ **Post date:** [April 26, 2024, 1:33pm UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/13 "2024-04-26T13:33:44Z")
You use malware on your website, are you sure? 😄 ---
**Author:** ![stefan1959](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/s/49beb7/32.png) [@stefan1959](https://forum.virtualmin.com/u/stefan1959)\ **Post date:** [April 26, 2024, 1:44pm UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/14 "2024-04-26T13:44:28Z")
Malware the short for **malicious software** , so why? ---
**Author:** ![marketus](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/marketus/32/7711_2.png) [@marketus](https://forum.virtualmin.com/u/marketus)\ **Post date:** [April 26, 2024, 1:47pm UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/15 "2024-04-26T13:47:29Z")
because it is as good as cloudflare and we dumped wordfence because it bloats your database ---
**Author:** ![stefan1959](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/s/49beb7/32.png) [@stefan1959](https://forum.virtualmin.com/u/stefan1959)\ **Post date:** [April 26, 2024, 1:59pm UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/16 "2024-04-26T13:59:38Z")
Not sure what your talking about and what it has to do with the post. ---
**Author:** ![marketus](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/marketus/32/7711_2.png) [@marketus](https://forum.virtualmin.com/u/marketus)\ **Post date:** [April 26, 2024, 2:13pm UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/17 "2024-04-26T14:13:32Z")
fail2ban is not simple to setup. most Issues are from DNA settings, spa, ptr, etc. once these are fixed you should be fine with email reputation. I use mxtoolbox as a start and it has helped me. Moving on, you need a web firewall which I now use malcare. ---
**Author:** ![jimr1](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/jimr1/32/14173_2.png) [@jimr1](https://forum.virtualmin.com/u/jimr1)\ **Post date:** [April 26, 2024, 2:37pm UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/18 "2024-04-26T14:37:38Z")
I guess you are extracting the urine ---
**Author:** ![lawk](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/l/dbc845/32.png) [@lawk](https://forum.virtualmin.com/u/lawk)\ **Post date:** [April 26, 2024, 6:59pm UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/19 "2024-04-26T18:59:46Z")
There is a plugin for it. [WP fail2ban – Advanced Security Plugin – WordPress-Plugin | WordPress.org Deutsch](https://de.wordpress.org/plugins/wp-fail2ban/) On Alma I had to add the backend = auto line [wordpress-soft] enabled = true filter = wordpress-soft backend = auto logpath = /var/log/messages maxretry = 5 findtime = 120m bantime = 120m port = http,https additionally you can setup a crowdsec bouncer if that is what you use. [WordPress | CrowdSec](https://docs.crowdsec.net/u/bouncers/wordpress/) or just use this plugin, not extra setup required: [WordPress Brute Force Protection – Stop Brute Force Attacks – WordPress plugin | WordPress.org](https://wordpress.org/plugins/guardgiant/) ---
**Author:** ![Virtuello](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/v/e19adc/32.png) [@Virtuello](https://forum.virtualmin.com/u/Virtuello)\ **Post date:** [April 30, 2024, 3:17am UTC](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141/20 "2024-04-30T03:17:24Z")
Thank you for the lively discussion. A solution at Wordpress level is not an option for me. If I have a Webmin machine with 20 Wordpress sites, then that is simply not a way forward. Webmin and Virtualmin are made exactly for such an architecture. While Virtualmin manages the individual servers, Webmin takes care of the backend. We have a real 3-tier architecture here. There simply have to be more ingenious approaches. And I know there are. [Next page](https://forum.virtualmin.com/t/wordpress-fail2ban-php/126141.md?page=2)