Skip to content

Instantly share code, notes, and snippets.

@Clorith

Clorith/gist:dc8485bacce8f52d9389

Created November 29, 2014 08:29
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Clorith/dc8485bacce8f52d9389 to your computer and use it in GitHub Desktop.
Save Clorith/dc8485bacce8f52d9389 to your computer and use it in GitHub Desktop.
Download ZIP
fail2ban filter.d/wordpress.conf for WordPress bruteforce protection
Raw
gistfile1.txt
# Fail2Ban configuration file
#
# Author: Marius
#
[INCLUDES]
before = common.conf
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
# Different events to match against
#
# 64.34.173.227 - - [06/Nov/2014:08:39:41 +0100] "POST /wp-login.php HTTP/1.1" 200 1922 "http://www.clorith.net/wp-login.php" "[% tools.ua.random() %]"
# 37.57.231.204 - - [19/Nov/2014:13:43:41 +0100] "POST http://www.clorith.net/wp-login.php/ HTTP/1.1" 200 5761 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9.0.2) Gecko/2008091620 Firefox/3.0.2"
failregex = ^<HOST> .+?POST.+?wp-login\.php.+?"
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment