Skip to content

Instantly share code, notes, and snippets.

@gbot

gbot/wp-xmlrpc-jail.local

Last active July 26, 2023 17:07
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 4 You must be signed in to fork a gist
  • Save gbot/a6dd846335ccac782897 to your computer and use it in GitHub Desktop.
Save gbot/a6dd846335ccac782897 to your computer and use it in GitHub Desktop.
Download ZIP
Fail2Ban WordPress XMLRPC Jail and Filter. Notes: log path is set for Plesk v12.x. Change this to appropriate path for your set up. Only works if WordPress is installed in webroot, edit the Filter failregex if installed in sub-directory.
Raw
wp-xmlrpc-jail.local
[wp-xmlrpc]
enabled = true
filter = wp-xmlrpc
action = iptables-multiport[name=wp-xmlrpc, port="http,https"]
logpath = /var/www/vhosts/system/*/logs/*access*log
/var/log/httpd/*access_log
bantime = 86400
maxretry = 0
Raw
wp-xmlrpc.local
# Fail2Ban filter for WordPress XML-RPC
[Definition]
failregex = ^<HOST>.*] "POST /xmlrpc\.php.*
ignoreregex = ^<HOST>.*] "POST /xmlrpc\.php\?for=jetpack.*
@apircalabu
Copy link

apircalabu commented May 5, 2020 •
edited

This regex matches the entries for sub-directory installs too:
[Definition]
failregex = ^<HOST>.*] "POST (|.*)/xmlrpc\.php.*
ignoreregex = ^<HOST>.*] "POST (|.*)/xmlrpc\.php\?for=jetpack.*

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment