Fail2ban Basics: Protecting Your Server from Brute-Force Attacks

If your logs are filling up with hundreds of failed login attempts, someone is almost certainly hammering your server with automated bots. Fail2ban is a small but powerful tool that reads those logs in real time and bans IP addresses that behave suspiciously. This guide explains how it works, how to configure it and why it belongs on every internet-facing server.

What Fail2ban is and how it works

Fail2ban monitors log files — for example /var/log/auth.log for SSH or your web server logs — and looks for patterns that indicate an attack, such as five wrong passwords within ten minutes. When a rule (called a jail) recognises that pattern, Fail2ban adds the IP address to the firewall and blocks it temporarily. Once the ban expires, the address is released automatically.

Three terms to know: the filter (a regular expression that spots the attack in the log), the jail (a rule that ties the filter, the log and the action together) and the action (what happens — usually adding the IP to iptables or nftables).

Basic configuration

Never edit jail.conf directly; create a jail.local instead. The key parameters are maxretry (how many misses before a ban), findtime (the window in which misses are counted) and bantime (how long the ban lasts). A sensible starting point is maxretry 5, findtime 10m, bantime 1h. For persistent attackers, enable bantime.increment so each new ban lasts longer.

• SSH jail — the first thing to enable; it dramatically cuts brute-force noise on port 22.
• WordPress — with the right plugin and filter, Fail2ban can also ban attacks on wp-login.php.
• Recidive jail — bans IPs that have been banned repeatedly, for a much longer period (days).

Fail2ban is not a magic wand

It solves one class of problem — automated brute-force attacks and scanning. It does not protect against code vulnerabilities or large-scale DDoS attacks. Treat it as one layer in a wider defence system, alongside strong passwords, two-factor login and an application-level firewall. On shared hosting Fail2ban usually runs in the background already, so you do not have to configure it yourself.

On quality WordPress hosting brute-force protection is enabled by default, and Fail2ban and the WAF work together. If you are choosing a plan, take a look at our hosting plans which already bundle these protection layers.

Frequently asked questions

Can Fail2ban lock me out of my own server? Yes, if you fail the password too many times. That is why you should always whitelist your own IP address with ignoreip.

How many resources does it use? Very few — it is a Python process reading logs, negligible for any modern server.

For deeper login protection, read our guide on protecting wp-login.php from brute-force attacks, how to set up strong passwords and password managers, and the basics of DDoS protection that Fail2ban does not cover.