In this guide · 7 sections
Short answer
Fail2ban reads log files such as SSH and web server logs and adds a firewall block for any IP that fails too many logins: by default 5 failures in 10 minutes earns a 10-minute ban. Raise the ban time, whitelist your office IP and add SSH keys and MFA: Fail2ban slows attacks, it does not fix weak passwords.
What Fail2ban does and what it watches
The project's README on GitHub describes it simply: Fail2ban scans log files like /var/log/auth.log and bans IP addresses with too many failed login attempts by updating firewall rules to reject new connections from them for a set time. The latest release listed on GitHub as of October 2026 is 1.1.1, published on 15 August 2026, and most Linux distributions package it.
Each protected service is a "jail": a filter (a pattern that recognises a failed login in a log) plus an action (usually a firewall ban). The shipped configuration includes jails for common services, all off until you enable them:
- sshd: failed SSH logins, the first one almost everyone turns on
- apache-auth, nginx-http-auth: failed HTTP basic authentication on Apache or Nginx
- nginx-limit-req, nginx-botsearch: clients hitting Nginx rate limits or probing for common admin paths
- postfix and dovecot style jails: failed mail server logins
- recidive: watches Fail2ban's own log and bans repeat offenders for longer
WordPress logins are not covered out of the box, because WordPress does not write failed logins to a server log by default. A security plugin that logs failures, or a web application firewall in front of the site, fills that gap; see our WordPress login security guide.
The default ban rules and safer settings
The defaults in Fail2ban's jail.conf are conservative. Here is what they mean and common adjustments for a small business server:
| Setting | Default | What it does | Common choice |
|---|---|---|---|
| maxretry | 5 | Failures allowed before a ban | 3 to 5 for SSH |
| findtime | 10m | Window in which failures are counted | 10m to 1h |
| bantime | 10m | How long the IP is blocked | 1h or more |
| bantime.increment | Off | Doubles the ban each time the same IP returns (1, 2, 4, 8...) | On, with a maximum |
| recidive jail | 1 week ban, 1 day window | Long ban for IPs banned repeatedly | Enable on public servers |
How to set up Fail2ban for SSH safely
On a Debian or Ubuntu VPS, a safe first set-up takes about fifteen minutes. Keep a second session open the whole time so you can undo a mistake.
Install from your distribution's packages
For example apt install fail2ban. The package also installs a systemd service that starts Fail2ban at boot.
Create jail.local with your defaults
Under [DEFAULT], set bantime, findtime and maxretry, and add ignoreip with 127.0.0.1/8, ::1 and your office's fixed IP if you have one.
Enable the sshd jail
Add an [sshd] section with enabled = true. On newer systems that log to the journal, check the backend setting suits your distribution.
Restart and check status
Restart the service, then run fail2ban-client status sshd to confirm the jail is running and see the current ban list.
Test from another IP
From a phone hotspot, fail a few logins on purpose and confirm the ban appears. Unban with fail2ban-client set sshd unbanip followed by the address.
Add the recidive jail
Once the main jail works, enable recidive so addresses banned again and again get a long block.
Then deal with the real fix: switch SSH to key-only login and turn off password and root login. Our VPS security hardening checklist covers that and the firewall.
False positives: banning your own staff or customers
Fail2ban bans by IP address, which causes predictable problems in an office or a shop:
Before you tighten the rules
The proxy point is the one that hurts most. If a site sits behind Cloudflare and the web server logs Cloudflare's addresses, Fail2ban will ban Cloudflare and take the site offline for everyone. Configure your web server to log the real visitor IP before enabling web jails.
Alternatives: CrowdSec and cloud firewall rate limits
Fail2ban is not the only option. Two alternatives come up most often for small business servers:
Fail2ban
Simple, localFree, open source
- Reads local logs, bans in the local firewall
- Huge set of ready filters
- No outside service needed
- Each server learns on its own
Best for: A single VPS with SSH and a few services.
CrowdSec
Shared blocklistFree open-source engine
- Analyses logs and HTTP requests with behaviour scenarios
- Blocks via firewall, web server or proxy components
- Optional community blocklist of known attackers
- More moving parts to run
Best for: Servers that want known-bad IPs blocked before they try.
Cloudflare rate limiting
At the edge1 rule on the free plan
- Stops floods before they reach your server
- Only covers web traffic through Cloudflare
- Free plan counts per IP over 10 seconds
- Does nothing for SSH
Best for: Login and form pages of a website behind Cloudflare.
CrowdSec's documentation describes the community blocklist: when you share the attacks you detect, the engine downloads a curated list of validated attackers. Cloudflare's rate limiting rules page lists one rule on the Free plan, two on Pro and five on Business, with longer counting periods on paid plans. Many servers use Fail2ban or CrowdSec for SSH plus an edge rule for the website login.
Do it yourself or get help?
If you are comfortable on the Linux command line and have a second way into the server (a provider console), you can set this up yourself in an afternoon using the steps above. The risk is locking yourself or your customers out, so test from a different IP before you rely on it, and follow the CIS Benchmarks published by the Center for Internet Security for wider OS hardening.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Our Software & Server Protection Setup (S$590) covers one VPS, web app or website: brute-force protection with CrowdSec or Fail2ban, SSH key-only login with root login off, a firewall with only the ports you need, automatic security updates, daily malware scans, Cloudflare rate limits on logins and forms, and a morning summary email from the server.
Frequently asked questions
Fail2ban watches server log files for repeated failed logins, for example on SSH, web server authentication or mail services, and temporarily blocks the offending IP addresses in the firewall. It slows down password-guessing attacks and cuts log noise. Its own documentation says it cannot remove the risk of weak passwords, so use keys or MFA too.
The jail.conf shipped with Fail2ban sets maxretry to 5, findtime to 10 minutes and bantime to 10 minutes, so an IP that fails five times within ten minutes is blocked for ten minutes. Most administrators raise the ban time, enable incremental bans and turn on the recidive jail for repeat offenders.
Run fail2ban-client set followed by the jail name, unbanip and the address, for example for the sshd jail. To stop it happening again, add trusted addresses such as your office's fixed IP to the ignoreip setting in jail.local and restart Fail2ban. Always keep a provider console login as a backup way in.
Not by default. WordPress does not write failed logins to the web server log in a form Fail2ban can read, so you need a plugin that logs failures for a custom filter, or protection in front of the site such as a web application firewall or a Cloudflare rate limiting rule on the login page.
It depends on the set-up. CrowdSec analyses logs and HTTP requests with behaviour-based scenarios and can use a shared community blocklist of known attackers, which Fail2ban does not have. Fail2ban is simpler, with fewer components to run. Both are free to start; either is far better than nothing on an internet-facing server.