# Fail2Ban jail: WordPress probe / brute-force scanning.
#
# Install as: /etc/fail2ban/jail.d/apache-vhost-wp-probe.local
#
# Why jail.d/*.local and not jail.d/*.conf: on a panel-managed host (e.g.
# ISPConfig3), the panel owns /etc/fail2ban/jail.local and rewrites it on
# update.  Files in jail.d/ are left alone, and the .local suffix is read
# last, so nothing in that file's [DEFAULT] can silently override the
# values set here.  On a hand-managed host with no such panel, jail.d/*.local
# still works the same way and costs nothing.

[apache-vhost-wp-probe]
enabled  = true

# MUST equal the filter's filename without .conf, i.e.
# /etc/fail2ban/filter.d/apache-vhost-wp-probe.conf
filter   = apache-vhost-wp-probe

logpath  = /var/log/apache2/other_vhosts_access.log

# This host is SysV, not systemd - never let this become "systemd".
backend  = auto

port     = http,https
protocol = tcp

# The sample traffic was 4-12 hits per IP within a couple of seconds, so 5
# in 10 minutes bans a scanner almost immediately while tolerating a human
# who fat-fingers a login a few times.
maxretry = 5
findtime = 10m
bantime  = 1d

# Repeat offenders get progressively longer bans, capped at a week.
# Requires fail2ban >= 0.11 - delete these three lines on 0.9/0.10.
bantime.increment = true
bantime.factor    = 2
bantime.maxtime   = 1w

# Add your own office/VPN addresses here if you want to be exempt outright.
# Not strictly needed: the filter only counts 4xx/5xx responses, so a
# successful admin login (200/302) never registers as a failure.
#ignoreip = 127.0.0.1/8 ::1

# banaction is deliberately not set, so this jail uses whatever
# jail.local's [DEFAULT] already configures on this host - panel-managed
# or not - and stays consistent with the existing firewall (iptables/
# nftables/ufw).