Adds security controls to WordPress.
Fail2ban integration is optional.

Security features:

Disabling login with username (require e-mail address)
Allow/Deny login from IP address, hostname (including wildcard support)
Preventing user enumeration (?author=nnn)
Less detailed error messages on login failures
Minimum username length
Blocking specific usernames from being used to register new users
Requiring e-mail address matching for new user registrations
Warning about new user role setting
Blocking of portions or all of WordPress REST API
Disabling of RSS and Atom feeds
Removal of “Generator” information from HTML and feeds
Detection of Cloudflare IP addresses for logging of actual IP addresses
Blocking/Allowing logins from IP addresses, IP ranges, and/or hostnames
Partially or fully disable XMLRPC access
Monitoring administrator accounts for unexpected role/account changes
Fail2ban can dynamically block IP addresses after suspicious activity.

Other notes:

Requires WordPress 6.2+ and PHP 7.4+.
PHP compatibility checks: 7.4, 8.1, 8.2, 8.3, and 8.4.
Uses mb_ PHP functions when available.
May write to the PHP error log when logging is enabled.
Contains no JavaScript or tracking code.
Optional IP blocking stores IP addresses and security-event timestamps. Administrator monitoring stores administrator IDs and login names.

Reverse proxy configuration:

Available since 1.4.0.
Setting: FAIL2WP_TRUSTED_PROXIES in wp-config.php, before wp-settings.php loads.
Value: array of proxy IPv4/IPv6 addresses or CIDRs.

define( ‘FAIL2WP_TRUSTED_PROXIES’, [ ‘192.0.2.10’, ‘2001:db8:1234::/48’ ] );
Replace the examples with your actual proxy addresses.
List directly connected proxy peers, identified by REMOTE_ADDR.
Hostnames and wildcards: unsupported for this constant.
Undefined or empty array: X-Real-IP ignored.
Accepted header: one valid IP from a listed proxy.
Missing or invalid header: peer address used.
Proxy requirement: overwrite client-supplied X-Real-IP.
Multiple proxy hops: final proxy supplies the verified visitor IP.
X-Forwarded-For and address chains: unsupported.
Proxy trust does not bypass login restrictions or IP bans.
Scope: entire WordPress installation; excluded from settings exports.
Server already supplies a verified REMOTE_ADDR: usually no constant needed.
Cloudflare: enabled setting, matching source range, valid CF-Connecting-IP; takes precedence.
Upgrade: configure trusted proxies before updating an existing X-Real-IP deployment.
Verify client addresses and login access on staging.
Login/bypass hostname wildcards: separate feature; forward-confirmed reverse DNS required.

Credits

The Fail2WP Plugin was written by Joaquim Homrighausen while converting caffeine into code.

Fail2WP is sponsored by WebbPlatsen i Sverige AB, Sweden.

Commercial support and customizations for this plugin is available from WebbPlatsen i Sverige AB in Sweden.

If you find this plugin useful, the author is happy to receive a donation, good review, or just a kind word.

If there is something you feel to be missing from this plugin, or if you have found a problem with the code or a feature, please do not hesitate to reach out to [email protected].

This plugin can also be downloaded from code.webbplatsen.net and GitHub

More detailed documentation is available at code.webbplatsen.net/documentation/fail2wp/

Kudos to Thomas Lutz.