Fail2WP
WordPress security plugin. Requires WordPress 6.2+ and PHP 7.4+.
Solid choice
Fail2WP is a solid plugin choice in 2026, with a few things worth checking first. It runs on 100+ sites, is rated 5/5 and was last updated 2 days ago, and scores 75/100 on our health check.
- Actively developed — last update 2 days ago
- Tested with the latest WordPress (7.1)
- Small user base (100+ active installs)
- Very few reviews so far
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Fail2WP stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| admin | >100 |
| authentication | >100 |
| fail2ban | #8 |
| firewall | >100 |
| security | >100 |
Version adoption
Share of active sites per release.
Rating breakdown
★★★★★★★★★★ 5 from 2 reviews
About Fail2WP
From the official readme · v1.4.0Description
- Adds security controls to WordPress.
- Fail2ban integration is optional.
Security features:
- Disabling login with username (require e-mail address)
- Allow/Deny login from IP address, hostname (including wildcard support)
- Preventing user enumeration (?author=nnn)
- Less detailed error messages on login failures
- Minimum username length
- Blocking specific usernames from being used to register new users
- Requiring e-mail address matching for new user registrations
- Warning about new user role setting
- Blocking of portions or all of WordPress REST API
- Disabling of RSS and Atom feeds
- Removal of “Generator” information from HTML and feeds
- Detection of Cloudflare IP addresses for logging of actual IP addresses
- Blocking/Allowing logins from IP addresses, IP ranges, and/or hostnames
- Partially or fully disable XMLRPC access
-
Monitoring administrator accounts for unexpected role/account changes
-
Fail2ban can dynamically block IP addresses after suspicious activity.
Other notes:
- Requires WordPress 6.2+ and PHP 7.4+.
- PHP compatibility checks: 7.4, 8.1, 8.2, 8.3, and 8.4.
- Uses
mb_PHP functions when available. - May write to the PHP error log when logging is enabled.
- Contains no JavaScript or tracking code.
- Optional IP blocking stores IP addresses and security-event timestamps. Administrator monitoring stores administrator IDs and login names.
Reverse proxy configuration:
- Available since 1.4.0.
- Setting: FAIL2WP_TRUSTED_PROXIES in wp-config.php, before wp-settings.php loads.
-
Value: array of proxy IPv4/IPv6 addresses or CIDRs.
define( ‘FAIL2WP_TRUSTED_PROXIES’, [ ‘192.0.2.10’, ‘2001:db8:1234::/48’ ] );
-
Replace the examples with your actual proxy addresses.
- List directly connected proxy peers, identified by REMOTE_ADDR.
- Hostnames and wildcards: unsupported for this constant.
- Undefined or empty array: X-Real-IP ignored.
- Accepted header: one valid IP from a listed proxy.
- Missing or invalid header: peer address used.
- Proxy requirement: overwrite client-supplied X-Real-IP.
- Multiple proxy hops: final proxy supplies the verified visitor IP.
- X-Forwarded-For and address chains: unsupported.
- Proxy trust does not bypass login restrictions or IP bans.
- Scope: entire WordPress installation; excluded from settings exports.
- Server already supplies a verified REMOTE_ADDR: usually no constant needed.
- Cloudflare: enabled setting, matching source range, valid CF-Connecting-IP; takes precedence.
- Upgrade: configure trusted proxies before updating an existing X-Real-IP deployment.
- Verify client addresses and login access on staging.
- Login/bypass hostname wildcards: separate feature; forward-confirmed reverse DNS required.
Credits
The Fail2WP Plugin was written by Joaquim Homrighausen while converting caffeine into code.
Fail2WP is sponsored by WebbPlatsen i Sverige AB, Sweden.
Copyright 2020-2026 Joaquim Homrighausen; all rights reserved.
Commercial support and customizations for this plugin is available from WebbPlatsen i Sverige AB in Sweden.
If you find this plugin useful, the author is happy to receive a donation, good review, or just a kind word.
If there is something you feel to be missing from this plugin, or if you have found a problem with the code or a feature, please do not hesitate to reach out to support@webbplatsen.se.
This plugin can also be downloaded from code.webbplatsen.net and GitHub
More detailed documentation is available at code.webbplatsen.net/documentation/fail2wp/
Kudos to Thomas Lutz.
Installation
- Upload the
fail2wpfolder to/wp-content/plugins/. - Activate Fail2WP from the Plugins menu.
- Configure the basic settings.
- For Fail2ban integration, follow
FAIL2BAN.txtorFAIL2BAN.md.
Frequently asked questions
Is the plugin locale aware
Uses WordPress localization functions. Default language: English. Swedish translation by the author.
Are there any incompatibilities
No known incompatibilities.
Changelog
Requires WordPress 6.2+. Before upgrading: set FAIL2WP_TRUSTED_PROXIES or supply a verified REMOTE_ADDR. Proxies must overwrite client-supplied X-Real-IP. Hostname wildcards require forward-confirmed reverse DNS.
1.4.0
- Fixed client-IP spoofing through X-Real-IP.
- Added FAIL2WP_TRUSTED_PROXIES for proxy IPs and CIDRs.
- Enforced Login IP rules before login processing.
- Extended REST blocks to child routes, trailing slashes, and case variants.
- Preserved REST discovery for authenticated and bypassed clients.
- Required forward-confirmed reverse DNS for hostname wildcards.
- Fixed hostname results on the first DNS lookup.
- Removed control characters from security log records.
- Restricted imports to registered settings; validated imported values.
- Escaped ignored import names.
- Fixed Cloudflare enablement and DNS-cache exports.
- Connected Login IP deny events to local ban accounting.
- Updated compatibility metadata for WordPress 7.1.
- Added security and WordPress regression checks.
- Documented fail2ban 1.0.x use with Fail2WP 1.3.0.
- Added explicit validation for checkbox values and role selections.
- Retained previous settings on invalid input; added validation notices.
- Preserved JSON settings during repeated sanitization.
- Removed duplicate translation calls from role renderers.
- Raised the minimum WordPress version to 6.2.
- Prepared IP-blocking table names with identifier placeholders.
- Rejected malformed settings exports before import.
- Escaped disabled-feed text and links; validated XML-RPC charset output.
- Removed a duplicate import nonce field.
1.3.0
- Added optional built-in IP blocking with configurable event threshold, observation window, and ban duration
- Added exact-IP sitewide 403 enforcement, cache-suppression headers, local block-page rendering, and Cloudflare client-IP handling
- Added active-ban management and exact-IP bypass entries in wp-admin
- Added import/export support for IP-blocking configuration and validated active-ban snapshots
- Added manual exact-IP ban creation and expanded trusted bypass entries to support IPs, CIDR ranges, hostnames, and hostname wildcards
- Added administrator baseline monitoring, immediate hook checks, hourly reconciliation, and syslog alerts
- Added a missing-object-cache notice; uncached ban checks use the database
1.2.6
- Fixed false REST block logs when REST blocking was disabled
- Fixed false REST namespace blocks with user-enumeration handling active
- Made blocked REST logs respect the “Log blocked requests” setting
- Verified with WordPress 6.9
- Updated internal version metadata
1.2.5
- Added Cloudflare IPv4/IPv6 range refresh in wp-admin; changes require Save Changes
- Muted disabled Cloudflare range controls; editing and refresh remain available
- Changed disabled feed requests to return
404instead of redirecting to the home page - Extended user enumeration blocking/logging to cover unauthenticated REST users endpoints
- Fixed the REST
usersroute block so it also covers individual user endpoints - Fixed REST route blocking so route-only rules are activated correctly
- Fixed REST handling so logged in and authenticated requests bypass REST blocking
- Fixed override IP handling for security/fail2ban alert messages
- Fixed IPv6 CIDR validation for login allow and deny lists
- Removed PHP 8.2 and PHP 8.3 dynamic property deprecations
- Fixed PHP 8.4 syslog signature deprecation while keeping PHP 7.4 compatibility
- Refreshed the bundled
php-cidr-matchlibrary from current upstream - Updated translation assets, including the Cloudflare refresh flow and Swedish admin strings
- Updated internal version metadata
1.2.4
- Verified with WordPress 6.8 and WordPress 6.9
- Removed PHP 7.2 compatibility (PHP 7.4 or above is now required)
1.2.3
- Verified with WordPress 6.7
- Verified with Plugin Check (PCP)
- Fixed issue when requiring REST API authentication and IPv4/IPv6 bypass was configured
- Fixed issue with uninitialized variable in XML-RPC handling
- Fixed a json_decode() warning without changing behavior
- Corrected some Swedish translations
- Corrected some checks for
uninstall.phpand made it more WP-CLI compatible
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Fail2WP alternatives
All admin plugins →
FAQ
Fail2WP: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 21, 2026
Is Fail2WP free?
Yes. Fail2WP is free to download and use from the official WordPress.org plugin directory.
Is Fail2WP safe to use in 2026?
Fail2WP is a solid plugin choice in 2026, with a few things worth checking first. It runs on 100+ sites, is rated 5/5 and was last updated 2 days ago, and scores 75/100 on our health check.
How many websites use Fail2WP?
Fail2WP is active on 100+ WordPress websites and has been downloaded 4,691 times since it launched in February 2021. It was downloaded 343 times in the last 30 days.
Does Fail2WP work with WordPress 7.1?
Yes. The developer has tested Fail2WP up to WordPress 7.1.3, the latest release. It requires WordPress 6.2 or newer.
What PHP version does Fail2WP need?
Fail2WP requires PHP 7.4 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Fail2WP last updated?
The latest version, 1.4.0, was released on October 19, 2026 (2 days ago).
Who makes Fail2WP?
Fail2WP is developed and maintained by joho68.
What are the best alternatives to Fail2WP?
The most popular alternatives to Fail2WP are Loginizer (1M+ installs), Redux Framework (900K+ installs) and Admin Menu Editor (300K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
