The log file shows:

ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/modsecurity.d/rules/comodo_free/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||domain.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "domain.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "Zk96QMqMkJvqGzoPgUciKAAAAIY"], referer: https://domain.com/contact/

The logs reference a vulnerability in WordPress 4.7 which was patched in 4.7.1. I’m using 6.5.3 with all plugins up to date.

The cause appears to be the presence of the following in the source for every page when UpdraftCentral Dashboard is activated:

<script type="text/javascript" src="https://domain.com/wp-includes/js/dist/data.min.js?ver=e6595ba1a7cd34429f66" id="wp-data-js"></script>
<script type="text/javascript" id="wp-data-js-after">
/* <![CDATA[ */
( function() {
	var userId = 0;
	var storageKey = "WP_DATA_USER_" + userId;
	wp.data
		.use( wp.data.plugins.persistence, { storageKey: storageKey } );
} )();
/* ]]> */
</script>

When I deactivate UpdraftCentral Dashboard the issue stops and I can navigate the site without issues in the firewall.

For a long time, this has been successful with an extension of the Bad-Bot plugin from Jeff Star here (https://www.ads-software.com/plugins/blackhole-bad-bots/).

I also process data from the Wordfence plugin, for example (which is somewhat complex)

It was therefore quite logical to look for a solution for IQ-Block Country as well. Because it is very helpful to transfer an IP already recognized by a WordPress instance to the entire server in order to block further access even for other WordPress installations on the same server.

In the first step, I therefore inserted this code in line 130 of the blockcountry-logging.php file:

do_action( 'iqbc_fail2ban_logging', $iqbc_ipaddress, $iqbc_country, $iqbc_banned, $iqbc_urlRequested );

And for four weeks now, I have been able to add the accesses to the backend recognized and blocked in the plugin to Fail2ban without any errors.

It would be a great help if we could talk about the above hook and possibly 1-2 others (e.g. for a reset of the log file or rebuild of the log).

The necessary script is still beta, but I am happy to share it for my own tests. I plan to offer this to the community as an add-on in the future.

Best regards

Steps to reproduce:

1. Install Theme My Login
2. Install and set up WP_Fail2ban
3. Enter login details into the Theme My Login login page
4. Press Log In button: redirection to dashboard does not occur
5. Add /wp-admin to URL in browser’s address bar: dashboard loads, showing that user has logged in

Does this plugin run instead of using serverwide fail2ban or is it as well as to add extra rules specific to WordPress?

I have been recommended your plugin but I cannot see why I would need it if I have fail2ban running server wide.

Can you explain the difference?

https://piramide.zapto.org/iplist-pcsnet.txt
https://piramide.zapto.org/iplist.txt
https://perc.ddns.net/iplist.txt
https://perc.ddns.net/iplist-pcsnet.txt
https://perc.ddns.net/ip.txt
https://perc.ddns.net/cms.txt

WE SAY HERE: PREVENIRE E MEGLIO CHE CURRARE,

PREVENTION IS BETTER THAN CURE!

A long time ago I had thought about a “central list” from different Bad-Bot installations.

I use several PHP-based installations and had long ago made me an extension of your WP-plugin, so that a logfile is also written to the file system (as with the PHP variant), but no longer have the WEB and no backup of the script…

Since I host a few dozen WordPress sites on my own server and have now familiarized myself with Fail2Ban a bit further, I am now getting to start again.

The only thing I’m really inexperienced with is RegEx and I’m not getting anywhere…. therefore times an off-topic question about it, but at the same time also the renewed suggestion to you, possibly to support the future something?

The basic idea: BadBots writes logfiles and these are evaluated by Fail2Ban and then take effect on the entire server – either immediately or, for example, when at x-webs occur.

And of course: The idea to keep a central “blacklist” for all plugin users and offer it for import as with other tools would then be further simplified.

My action jail:

[wp-badbots]
enabled = true
filter = wp-badbots
action = logfile[name="wp-badbots"]
sendmail[name="badbots", sendername="fail2ban badbots", dest="[email protected]"]
logpath = /var/www/vhosts/*/httpdocs/*/blackhole.dat
maxretry = 1

The blackhole.dat is the log from the php-based blackhole at this moment. The log looks like this:

91.64.137.161 - GET - HTTP/1.1 - Sunday, May 3rd 2020 @ 12:35:54 - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:68.0) Gecko/20100101 Firefox/68.0
85.25.236.90 - GET - HTTP/1.1 - Sunday, May 3rd 2020 @ 18:50:37 - Mozilla/5.0 (X11; U; Linux Core i7-4980HQ; de; rv:32.0; compatible; JobboerseBot; https://www.jobboerse.com/bot.htm) Gecko/20100101 Firefox/38.0
136.243.36.68 - GET - HTTP/1.1 - Monday, May 4th 2020 @ 01:13:36 - Mozilla/5.0 (compatible; vebidoobot/1.0; +https://blog.vebidoo.de/vebidoobot/)
23.252.241.34 - GET - HTTP/1.1 - Monday, May 4th 2020 @ 16:24:58 - Dispatch/0.11.3
34.234.54.252 - GET - HTTP/1.1 - Monday, May 4th 2020 @ 17:48:16 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36 (compatible; SMTBot/1.0; +https://www.similartech.com/smtbot)
161.35.66.233 - GET - HTTP/1.1 - Monday, May 4th 2020 @ 21:46:57 - Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.517 Safari/537.36

My jail filter, but it does not work

[Definition]
failregex = ^<HOST> .* GET
ignoreregex = 

As I said, something off-toppic, but if you have mood, I am very interested in the implementation, write you then gladly by PM.

CU

Having fail2ban already configured in the server, I installed it on a bunch of WP sites.

Locking repetitive attackers, it saves some server resources peaks.

Really thanks for the plugin.

Fail2Ban causes FATAL ERROR in WP-Cron, IE. wp-cron CRASHES and stops working.

Since 03/03/2022 (AU time)

From PHP errors txt:

[05-Mar-2022 03:53:20 UTC] PHP Fatal error:  Uncaught TypeError: Argument 2 passed to org\lecklider\charles\wordpress\wp_fail2ban\feature\log_message() must be of the type string or null, array given, called in /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php on line 307 and defined in /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-content/plugins/wp-fail2ban/feature/plugins.php:233
Stack trace:
#0 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php(307): org\lecklider\charles\wordpress\wp_fail2ban\feature\log_message()
#1 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php(331): WP_Hook->apply_filters()
#2 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/plugin.php(474): WP_Hook->do_action()
#3 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-content/plugins/wp-fail2ban-addon-contact-form-7/functions.php(52): do_action()
#4 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php(309): com\wp_fail2ban\addons in /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-content/plugins/wp-fail2ban/feature/plugins.php on line 233
[05-Mar-2022 12:20:25 UTC] PHP Fatal error:  Uncaught TypeError: Argument 2 passed to org\lecklider\charles\wordpress\wp_fail2ban\feature\log_message() must be of the type string or null, array given, called in /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php on line 307 and defined in /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-content/plugins/wp-fail2ban/feature/plugins.php:233
Stack trace:
#0 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php(307): org\lecklider\charles\wordpress\wp_fail2ban\feature\log_message()
#1 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php(331): WP_Hook->apply_filters()
#2 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/plugin.php(474): WP_Hook->do_action()
#3 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-content/plugins/wp-fail2ban-addon-contact-form-7/functions.php(52): do_action()
#4 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php(309): com\wp_fail2ban\addons in /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-content/plugins/wp-fail2ban/feature/plugins.php on line 233
[05-Mar-2022 13:27:59 UTC] PHP Fatal error:  Uncaught TypeError: Argument 2 passed to org\lecklider\charles\wordpress\wp_fail2ban\feature\log_message() must be of the type string or null, array given, called in /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php on line 307 and defined in /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-content/plugins/wp-fail2ban/feature/plugins.php:233
Stack trace:
#0 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php(307): org\lecklider\charles\wordpress\wp_fail2ban\feature\log_message()
#1 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/class-wp-hook.php(331): WP_Hook->apply_filters()
#2 /usr/home/barefootwarrior/public_html/wp-il0m0goe0d/wp-includes/plugin.php(474): WP_Hook->do_action()

===== end copy —–

Fail2Ban is DEACTIVATED until we hear from you.

Thank you Mr @Lecklider

Clemens

Now, to get to my question…
How exactly do I enable additional features like blocking enumeration attempts and what not. The only thing I can find is one locked user question on here asking where we insert the filters. To which you replied “in the functions.php file”. Well, that doesn’t mean anything to me since there are multiple functions.php files. There are ones for themes, plugins, and for the main wordpress api. Where exactly do we put these additional filters and settings in order to block login and enumeration attempts. How do I even know if this plugin is working? I hate so sound like a critical a-hole, but this really is some of the poorest documentation I’ve seen in a long time. Could you please help me out in understanding this? I would like to implement security of my wordpress site using fail2ban for assistance and this seems like the way to go. But then again, I don’t even know what this thing is doing, because, well, there is nothing documenting it in the first place. Please, Teach me, and let me build a man page for this plugin so people know what the hell they are doing. Thanks for any answers.