WP fail2ban -- WordPress 插件

开发者	invisnet freemius
更新时间	2024年11月11日 22:42
PHP版本:	7.4 及以上
WordPress版本:	6.4
版权:	GPLv3 or later
版权网址:	版权信息

fail2ban is one of the simplest and most effective security measures you can implement to protect your WordPress site. WP fail2ban provides the link between WordPress and fail2ban: Oct 17 20:59:54 foobar wordpress(www.example.com)[1234]: Authentication failure for admin from 192.168.0.1 Oct 17 21:00:00 foobar wordpress(www.example.com)[2345]: Accepted password for admin from 192.168.0.1 WPf2b comes with three fail2ban filters: wordpress-hard.conf, wordpress-soft.conf, and wordpress-extra.conf. These are designed to allow a split between immediate banning (hard) and the traditional more graceful approach (soft), with extra rules for custom configurations. Features

Failed Login Attempts The very first feature of WPf2b: logging failed login attempts so the IP can be banned. Just as useful today as it was then.
Block User Enumeration One of the most common precursors to a password-guessing brute force attack is user enumeration. WPf2b can block it, stopping the attack before it starts.
Block username logins Sometimes it's not possible to block user enumeration (for example, if your theme provides Author profiles). WPf2b can require users to login with their email address instead of their username.
Blocking Users Anther of the older WPf2b features: the login process can be aborted for specified usernames. Say a bot collected your site's usernames before you blocked user enumeration. Once you’ve changed all the usernames, add the old ones to the list; anything using them will trigger a "hard" fail.
Empty Username Login Attempts Some bots will try to login without a username; harmless, but annoying. These attempts are logged as a "soft" fail so the more persistent bots will be banned.
Spam WPf2b will log a spammer's IP address as a "hard" fail when their comment is marked as spam; the Premium version will also log the IP when Akismet discards "obvious" spam.
Attempted Comments Some spam bots try to comment on everything, even things that aren't there. WPf2b detects these and logs them as a "hard" fail.
Pingbacks Pingbacks are a great feature, but they can be abused to attack the rest of the WWW. Rather than disable them completely, WPf2b effectively rate-limits potential attackers by logging the IP address as a "soft" fail.
Block XML‑RPC Requests [Premium] The only reason most sites need XML‑RPC (other than Pingbacks) is for Jetpack; WPf2b Premium can block XML‑RPC while allowing Jetpack and/or Pingbacks.
Block Countries [Premium] Sometimes you just need a bigger hammer - if you’re seeing nothing but attacks from some countries, block them!
Cloudflare and Proxy Servers WPf2b will work with Cloudflare, and the Premium version will automatically update the list of Cloudflare IP addresses. You can also configure your own list of trusted proxies.
syslog Dashboard Widget Ever wondered what's being logged? The dashboard widget shows the last 5 messages; the Premium version keeps a full history to help you analyse and prevent attacks.
Site Health Check WPf2b will (try to) check that your fail2ban configuration is sane and that the filters are up to date; out-of-date filters are the primary cause of WPf2b not working as well as it can. When did you last run the Site Health tool?
mu-plugins Support WPf2b can easily be configured as a "must-use plugin" - see Configuration.
API to Extend WPf2b If your plugin can detect behaviour which should be blocked, why reinvent the wheel?
Event Hooks [Premium] Need to do something special when WPf2b detects a particular event? There's a hook for that.

Premium

Web Application Firewall (WAF)
Akismet support.
Block XML‑RPC while allowing Jetpack and/or Pingbacks.
Block Countries.
Auto-update Cloudflare IPs.
Event log.
Event hooks.

5.2.2 This is a minor release. You do not need to update your filters from 5.1.0. 5.2.1 This is a minor release. You do not need to update your filters from 5.1.0. 5.2.0 This is a minor release. You do not need to update your filters from 5.1.0. 5.1.1 This is a minor release. You do not need to update your filters from 5.1.0. 5.1.0.5 This is a feature release. To take advantage of the new features you will need up update your fail2ban filters; existing filters will continue to work as before. 5.0.1 This is a minor release. You do not need to update your filters from 5.0.0. 5.0.0 PLEASE READ THE NOTES BEFORE UPGRADING. This is a major feature release. You must update your filters. 4.4.0.9 This is a minor release. You do not need to update your filters from 4.4.0. 4.4.0.8 This is a bug-fix release. You do not need to update your filters from 4.4.0. 4.4.0.7 This is a Premium-only bug-fix release. You do not need to update your filters from 4.4.0. 4.4.0.6 This is a bug-fix release. You do not need to update your filters from 4.4.0. 4.4.0.5 This is a bug-fix release. You do not need to update your filters from 4.4.0. 4.4.0.4 This is a bug-fix release. You do not need to update your filters from 4.4.0. 4.4.0.3 This is a bug-fix release. You do not need to update your filters from 4.4.0. 4.4.0.2 This is a feature release. To take advantage of the new features, including the Blocklist Add-on, you will need up update your fail2ban filters; existing filters will continue to work as before. Blocklist Add-on users: Please disable the Blocklist plugin before upgrading WP fail2ban, then upgrade the Blocklist plugin and reactivate it. 4.3.2.2 This is a bug-fix release. You do not need to update your filters from 4.3.2.0. 4.3.2.1 This is a bug-fix release. You do not need to update your filters from 4.3.2.0. 4.3.2.0 This is a feature release. To take advantage of the new features you will need up update your fail2ban filters; existing filters will continue to work as before. Premium users: Please backup your database before upgrading. 4.3.0.7 This is a bug-fix release. You do not need to update your filters from 4.3.0. Premium users: Please update your MaxMind database. 4.3.0.6 This is a bug-fix release. You do not need to update your filters from 4.3.0. 4.3.0.5 This is a bug-fix release. You do not need to update your filters from 4.3.0. 4.3.0.4 This is a feature release. To take advantage of the new features you will need up update your fail2ban filters; existing filters will continue to work as before. Premium users: Please backup your database before upgrading. 4.2.8 This is a bug-fix release. You do not need to update your filters from 4.1.0. 4.2.7.1 This is a bug-fix release. You do not need to update your filters from 4.1.0. 4.2.7 This is a bug-fix release. You do not need to update your filters from 4.1.0. 4.2.6 This is a minor release. You do not need to update your filters from 4.1.0. 4.2.5.1 This is a premium-only patch release. If you are on PHP 7.0 or later you do not need to upgrade. 4.2.5 This is a minor release. You do not need to update your filters from 4.1.0. 4.2.4 This is a minor release. You do not need to update your filters from 4.1.0. 4.2.3 This is a bug-fix release. You do not need to update your filters from 4.1.0. 4.2.2 You do not need to update your filters from 4.1.0. 4.2.1 You do not need to update your filters from 4.1.0. 4.1.0 To take advantage of the new features you will need up update your fail2ban filters; existing filters will continue to work as before. 4.0.5 This is a security fix (Freemius SDK): all 4.x users are strongly advised to upgrade immediately. You do not need to update your filters from 4.0.1. 4.0.4 This is a bug-fix. You do not need to update your filters from 4.0.1. 4.0.3 This is a bug-fix. You do not need to update your filters from 4.0.1. 4.0.2 This is a bug-fix. You do not need to update your filters from 4.0.1. 4.0.1 To take advantage of the new features you will need up update your fail2ban filters; existing filters will continue to work as before. 3.6.0 You will need up update your fail2ban filters. 3.5.3 You will need up update your fail2ban filters. 3.5.1 Bug-fix: disable WP_FAIL2BAN_BLOCK_USER_ENUMERATION in admin area.... 3.5.0 You will need up update your fail2ban filters. 3.0.3 You will need up update your fail2ban filters. 3.0.0 BREAKING CHANGE: The fail2ban filters have been split into two files. You will need up update your fail2ban configuration. 2.3.0 Fix for WP_FAIL2BAN_PROXIES; if you’re not using it you can safely skip this release. 2.2.1 Bug-fix. 2.2.0 BREAKING CHANGE: WP_FAIL2BAN_LOG has been renamed to WP_FAIL2BAN_AUTH_LOG. Pingbacks are getting a lot of attention recently, so WPf2b can now log them. The wordpress.conf filter has been updated; you will need to update your fail2ban configuration. 2.1.0 The wordpress.conf filter has been updated; you will need to update your fail2ban configuration. 2.0.1 Bug-fix in experimental code; still an experimental release. 2.0.0 This is an experimental release. If your current version is working and you’re not interested in the new features, skip this version - wait for 2.1.0. For those that do want to test this release, note that wordpress.conf has changed - you’ll need to copy it to fail2ban/filters.d again.

5.2.2

Fix regression in Site Health when exec is disabled (h/t @ahardy42).
PHP 8.3: Fix harmless warning on About tab.
WAF: Add support for themes that update image size options (h/t Jerker Wredenmark). [Premium only]
Update Freemius library.

5.2.1

Fix bug in WAF when not logged in (h/t Rudi Diedrich). [Premium only]
Site Health: Add support for open_basedir (h/t Jaroslav Huba).
Update Freemius library.

5.2.0

WAF: Add new filter file for WAF events. [Premium only]
WAF: Add feature: prevent unauthorised user deletion. [Premium only].
Fix untrusted proxy message.
Work-around for WooCommerce bug causing double logging of password reset requests (h/t @anuja).
Site Health: Improve notifications.

5.1.1

Update Freemius library.

5.1.0

Web Application Firewall. [Premium only]
Add PTR record lookup to event report. [Premium only]
Improve report performance. [Premium only]
Site Health: Check fail2ban is running.
Site Health: Obsolete Filters - Detect DigitalOcean Droplet and link to documentation.
Fix harmless warning (h/t @Yavor).
Fix warning caused by bug in Google Sitekit (h/t @DaWolfey).
Update Freemius library.

5.0.1

Tweak Site Health notifications.
Update Freemius library.

5.0.0 "Delphi"

IPv6 support.
Akismet support. [Premium only]
Auto-update Cloudflare IPs. [Premium only]
Event hooks. [Premium only]
Performance improvements:
Improve reports. [Premium only]
Cache IP lists. [Premium only]
Cache Plugin API message registration. [Premium only]
Site Health: Check installed filters against previous versions.
Moved "Authentication attempt for unknown user" to wordpress-soft.conf.
Moved "extra" Comment messages to wordpress-soft.conf.
Show date/time in local timezone (h/t @geniusmedia). [Premium only]
Deprecate WP_FAIL2BAN_LOG_COMMENTS_EXTRA and WP_FAIL2BAN_COMMENT_EXTRA_LOG; use WP_FAIL2BAN_LOG_COMMENT_ATTEMPTS and WP_FAIL2BAN_COMMENT_ATTEMPT_LOG instead.
Update Freemius library. Please read the notes before upgrading.

4.4.0.9

Preparation for v5: prevent auto-updating across major release.
Update Freemius library.

4.4.0.8

Back-port fix for mu-plugins activation.
Update Freemius library.

4.4.0.7

Back-port fix for type error in menu-fixer when viewing Event Log (h/t @geniusmedia). [Premium only]
Back-port fixes for event summaries. [Premium only]
Update Freemius library.

4.4.0.6

Fix initialisation error in event log. [Premium only]
Fix type error in event log when no events available. [Premium only]
Update Freemius library.

4.4.0.5

Fix type error on Remote IPs tab with no MaxMind database configured (h/t @Tobias‑Conrad). [Premium only]
Update Freemius library.

4.4.0.4

Fix warning with array of blocked users (h/t @Znuff).
Fix reports. [Premium only]

4.4.0.3

Fix type error (h/t @brianshim).

4.4.0.2

Add WP_FAIL2BAN_USE_AUTHPRIV - a single place to switch to LOG_AUTHPRIV for systems without LOG_AUTH.
Add WP_FAIL2BAN_FREE_ONLY.
Add WP_FAIL2BAN_PLUGIN_LOG_OTHER and WP_FAIL2BAN_PLUGIN_OTHER_LOG.
Improve performance.
Moved cron event to update trusted Cloudflare IP ranges to the Cloudflare add-on. [Premium only]
Add support for Pingbacks while blocking XML‑RPC. [Premium only]
Update Freemius library.

4.3.2.2

Add cron event to update trusted Cloudflare IP ranges weekly. [Premium only]
Add cron event to update trusted Jetpack IP ranges weekly. [Premium only]
Add cron event to update MaxMind database weekly. [Premium only]
Workaround for missing syslog constants in Windows (h/t @dmarkowicz).
Clarify upgrade message on Last 5 Messages widget. [Free only]
Merge About and Status tabs. [Premium only]
Update Freemius library.

4.3.2.1

Add support for WP fail2ban Blocklist.
Add new Standard Configurations.
Improve Help links.
Fix logging checkboxes [Premium only].
Fix incorrect constant for disabling last messages (h/t @kermina).
Fix false positive with blocking user enumeration when a Contributor tries to list posts by another user.
Fix index issue with ancient versions of MySQL.
Fix harmless warning with a defined but empty WP_FAIL2BAN_PROXIES (h/t @stevegrunwell).
Back-port new Block event class.
Update Freemius library.
Change to GPLv3 with additional terms as per Section 7.

4.3.2.0

Add support for blocking by Country. [Premium only]
Add XML‑RPC blocking; allow trusted IPs and Jetpack (h/t @mhweb). [Premium only]

4.3.0.9

Fix incorrect constant for disabling last messages (h/t @kermina).
Fix false positive with blocking user enumeration when a Contributor tries to list posts by another user.
Fix index issue with ancient versions of MySQL. [Premium only]
Fix harmless warning with a defined but empty WP_FAIL2BAN_PROXIES (h/t @stevegrunwell).
Back-port new Block event class.
Update Freemius library.

4.3.0.8

Workaround issue with user enumeration blocking being triggered by Gutenberg pre‑loading Author list. (h/t @brrrrrrrt) [WordPress only]

4.3.0.7

Finish refactoring to allow inclusion of constants in wp‑config.php (h/t @iCounsellor).
Fix MaxMind database update. [Premium only]

4.3.0.6

Fix Forbidden error on Posts page for roles below Editor when user enumeration blocking enabled. [WordPress only]

4.3.0.5

Fix empty username detection for multisite.
Fix harmless warning when activating new multisite install.
Fix esoteric edge-case where wp‑load.php is loaded via a script run from the CLI in a directory with a functions.php file.

4.3.0.4 "Columbo"

Add new dashboard widget: last 5 syslog messages.
Add full multisite support.
Add username login blocking (force login with email).
Add separate logging for login attempts with an empty username.
Improve user enumeration blocking compatibility with the WordPress block editor (Gutenberg).
Bump the minimum PHP version to 5.6.

4.2.8

Add link to new support forum.
Fix user enumeration conflict with Gutenberg (h/t @dinghy).
Fix notices wrt admin menu (h/t @marioivangf).
Fix harmless XDebug notice (h/t @dinghy).
Update Freemius library.

4.2.7.1

Fix error when blocking user enumeration via oembed (h/t @wordpressfab).

4.2.7

Fix error when blocking user enumeration via REST.
Fix buttons on Settings tabs.

4.2.6

Add support for Remote Tools add-on.
Add support for the new ClassicPress security page.
Improved user enumeration blocking.

4.2.5.1

Fix premium activation issue with PHP < 7.0.

4.2.5

Properly fix PHP 5.3 support; tested on CentOS 6. Does not support any UI or Premium features.
Fix potential issue with WP_FAIL2BAN_BLOCK_USER_ENUMERATION if calling REST API or XML‑RPC from admin area.

4.2.4

Add filter for login failed message.
Fix logging spam comments from admin area.
Fix Settings link from Plugins page.
Update Freemius library

4.2.3

Workaround for some versions of PHP 7.x that would cause define()s to be ignored.
Add config note to settings tabs.
Fix documentation links.

4.2.2

Fix 5.3 compatibility.

4.2.1

Completed support for WP_FAIL2BAN_COMMENT_EXTRA_LOG.
Add support for 3rd-party plugins; see Developers.
Add-on for Contact Form 7 (experimental).
Add-on for Gravity Forms (experimental).
Change logging for known-user with incorrect password; previously logged as unknown user and matched by hard filters (due to limitations in older versions of WordPress), now logged as known user and matched by soft.
Bug-fix for email-as-username - now logged correctly and matched by soft, not hard, filters.
Bug-fix for regression in code to prevent Free/Premium conflict.

4.2.0

Not released.

4.1.0

Add separate logging for REST authentication.
Fix conflict with earlier versions preinstalled in mu‑plugins. See Is WPf2b Already Installed?.

4.0.5

Add WP_FAIL2BAN_COMMENT_EXTRA_LOG.
Add WP_FAIL2BAN_PINGBACK_ERROR_LOG (future functionality).
Change WP_FAIL2BAN_LOG_SPAM to use LOG_NOTICE.
Change WP_FAIL2BAN_SPAM_LOG to LOG_AUTH.
Change WP_FAIL2BAN_LOG_COMMENTS_EXTRA events to use LOG_NOTICE by default.
Fix conflict with 3.x in mu-plugins.

4.0.2

Fix PHP 5.3 compatibility.
Bug-fix for WP_FAIL2BAN_LOG_COMMENTS_EXTRA.
Bug-fix for WP_FAIL2BAN_REMOTE_ADDR summary.

4.0.1

Add extra features via Freemius. This is entirely optional. WPf2b works as before, including new features listed here.
Add settings summary page (Settings -> WP fail2ban).
Add WP_FAIL2BAN_PASSWORD_REQUEST_LOG.
Add WP_FAIL2BAN_SPAM_LOG.
Add WP_FAIL2BAN_LOG_COMMENTS_EXTRA - enable logging for attempted comments on posts which are:
not found,
closed for commenting,
in the trash,
drafts,
password protected
Block user enumeration via REST API.

4.0.0

Not released.

3.6.0

The filter files are now generated from PHPDoc in the code. There were too many times when the filters were out of sync with the code (programmer error) - this should resolve that by bringing the patterns closer to the code that emits them.
Added PHPUnit tests. Almost 100% code coverage, with the exception of WP_FAIL2BAN_PROXIES which is quite hard to test properly.
Bug-fix for wordpress-soft.conf.
Add WP_FAIL2BAN_XMLRPC_LOG.
Add WP_FAIL2BAN_REMOTE_ADDR.
WP_FAIL2BAN_PROXIES now supports an array of IPs with PHP 7.
Moved all documentation to https://docs.wp-fail2ban.com/.

3.5.3

Bug-fix for wordpress-hard.conf.

3.5.1

Bug-fix for WP_FAIL2BAN_BLOCK_USER_ENUMERATION.

3.5.0

Add WP_FAIL2BAN_OPENLOG_OPTIONS.
Add WP_FAIL2BAN_LOG_COMMENTS and WP_FAIL2BAN_COMMENT_LOG.
Add WP_FAIL2BAN_LOG_PASSWORD_REQUEST.
Add WP_FAIL2BAN_LOG_SPAM.
Add WP_FAIL2BAN_TRUNCATE_HOST.
WP_FAIL2BAN_BLOCKED_USERS now supports an array of users with PHP 7.

3.0.3

Fix regex in wordpress-hard.conf.

3.0.2

Prevent double logging in WP 4.5.x for XML‑RPC authentication failure

3.0.1

Fix regex in wordpress-hard.conf.

3.0.0

Add WP_FAIL2BAN_SYSLOG_SHORT_TAG.
Add WP_FAIL2BAN_HTTP_HOST.
Log XML‑RPC authentication failure.
Add better support for MU deployment.

2.3.2

Bug-fix WP_FAIL2BAN_BLOCKED_USERS.

2.3.0

Bug-fix in experimental WP_FAIL2BAN_PROXIES code (thanks to KyleCartmell).

2.2.1

Fix stupid mistake with WP_FAIL2BAN_BLOCKED_USERS.

2.2.0

Custom authentication log is now called WP_FAIL2BAN_AUTH_LOG.
Add logging for pingbacks; see WP_FAIL2BAN_LOG_PINGBACKS.
Custom pingback log is called WP_FAIL2BAN_PINGBACK_LOG.

2.1.1

Minor bug-fix.

2.1.0

Add support for blocking user enumeration; see WP_FAIL2BAN_BLOCK_USER_ENUMERATION.
Add support for CIDR notation in WP_FAIL2BAN_PROXIES.

2.0.1

Bug-fix in experimental WP_FAIL2BAN_PROXIES code.

2.0.0

Add experimental support for X-Forwarded-For header; see WP_FAIL2BAN_PROXIES.
Add experimental support for regex-based login blocking; see WP_FAIL2BAN_BLOCKED_USERS.

1.2.1

Update FAQ.

1.2

Fix harmless warning.

1.1

Minor cosmetic updates.

1.0

Initial release.

WP fail2ban - Advanced Security Plugin

标签

下载

详情介绍:

安装:

升级注意事项:

更新日志: