How can I store IP addresses which try to brute-force the login section or to login too frequent too fast?

I need to store all IPs, then use them in another application, sort of like a learning routine.


Here's a scenario (pseudo-code):

function my_wp_login_failed($username) {
add_action('wp_login_failed', 'my_wp_login_failed');

How can I do this for all attack vectors?


I need IP addresses trying to access the site more than X times get blocked for at least Y time. The initial phase will simply store these IP addresses.


I have found this plugin - https://plugins.trac.wordpress.org/browser/wp-fail2ban/trunk/wp-fail2ban.php - which might do the job. I will need to rewrite it in order to pass the IP information to a database or a flat file.

  • 1
    That may not be a good idea. Imagine if there's a DDoS attack. Your Database will be overwhelmed.
    – Fayaz
    Jul 30, 2018 at 15:20
  • I know, but this is an experimental app. The code would eventually pass all IPs to a third-party app.
    – Ciprian
    Jul 30, 2018 at 15:21
  • @Fayaz and he can clear that db table after some time, I guess... Jul 30, 2018 at 15:34
  • @KrzysiekDróżdż yes, this is a proof of concept. All data gets written to a log file on the server. It might not be the final behaviour, but I need it like this for now.
    – Ciprian
    Jul 30, 2018 at 15:39

1 Answer 1


You can use wp_login_failed action for that purpose... It's called at the end of wp_authenticate, if user credentials were incorrect.

function my_log_brute_force( $username ) {
    $ip_address = $_SERVER['REMOTE_ADDR'];
    // store that info somewhere
    file_put_contents( 'bf-log.txt', date('c') . "\t{$ip_address}\t{$username}\n", FILE_APPEND );
add_action( 'wp_login_failed', 'my_log_brute_force' );

Also this article may be helpful: Getting real IP address in PHP

  • I have added a sample code, similar to yours. What about other attack vectors? The comment form? The registration form? The forgot password form? Can I do the same using a similar action? I want to have all bases covered.
    – Ciprian
    Jul 30, 2018 at 15:48
  • 1
    What kind of attacks? Brute-force attacks trying to guess password? You don't have to secure other forms - WordPress always uses the same function to check credentials, so wp_login_failed will get called... Jul 30, 2018 at 15:49
  • I am trying to detect frequent/fast attacks from the same IP. Let's say an IP address is trying to post 100 comments per second. How can I capture that IP address? Or an IP trying to create an account?
    – Ciprian
    Jul 30, 2018 at 15:50
  • You have to check for all of such attacks and add them to the log. You can also try to monitor all requests - real users don't generate to many requests per second... Jul 30, 2018 at 15:52
  • I know, that's why I was asking. I have updated my question with: "I need IP addresses trying to access the site more than X times get blocked for at least Y time. The initial phase will simply store these IP addresses." Your answer only covers one scenario.
    – Ciprian
    Jul 30, 2018 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.