Fail2ban Setup Checklist for WordPress VPS
Fail2ban helps reduce brute force attempts by banning IPs that trigger repeated failed login patterns. It is useful for SSH protection and can also support web server protection when configured carefully.
Use cases
- Many failed SSH login attempts.
- Repeated attacks against wp-login.php.
- Suspicious repeated requests from the same IP.
- Basic VPS hardening for public servers.
Checklist
- Install Fail2ban.
- Check service status.
- Enable SSH jail first.
- Set reasonable bantime and findtime values.
- Test SSH access in a second terminal.
- Review banned IPs.
- Do not create aggressive web rules without testing.
- Check logs after enabling.
- Document custom jail settings.
- Unban your own IP if accidentally blocked.
Final check
Fail2ban is useful when it reduces abusive traffic without blocking legitimate access. Start with SSH protection before adding more advanced web jails.
When to Use This Checklist
Use this checklist when your VPS receives repeated failed SSH logins or basic brute force attempts.
Required Tools
SSH access, Ubuntu VPS, Fail2ban, auth log, VPS provider console, UFW
Before You Start
Keep one active SSH session open while testing Fail2ban to avoid locking yourself out.
Structured Checklist Steps
- Install Fail2ban.
- Check service status.
- Enable SSH jail.
- Set bantime.
- Set findtime.
- Set maxretry.
- Restart Fail2ban.
- Check jail status.
- Review logs.
- Document settings.
Verification Steps
- Fail2ban service is active.
- SSH jail is enabled.
- Banned IP list can be viewed.
- Your own SSH access still works.
Rollback Plan
If your own IP is banned, use provider console or another trusted IP to unban it and relax the jail settings.
Common Mistakes
- Creating overly aggressive rules.
- Not testing SSH after enabling.
- Forgetting how to unban IPs.
- Copying random web jails without understanding logs.
- Assuming Fail2ban replaces firewall rules.
Related Commands
sudo apt install fail2ban -y
sudo systemctl status fail2ban
sudo fail2ban-client status
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip YOUR_IP
sudo tail -n 100 /var/log/fail2ban.log