TL;DR<\/h3>\n
The WP fail2ban plugin blocked valid SSH-to-FTP deployment hooks, mistaking them for brute force attacks. Automated deployment scripts were getting flagged and banned. After investigating, developers found the issue was in the regex pattern used to detect threats. Updating the regex fixed it and made sure real attacks are still blocked, but valid connections are safe.<\/p>\n
What is WP fail2ban?<\/h2>\n
WP fail2ban<\/strong> is a security plugin for WordPress. It works with fail2ban<\/em>, a system tool that watches your logs. When it sees something suspicious\u2014like too many failed logins\u2014it can block the IP.<\/p>\n This is great for stopping attackers who try to guess passwords or exploit known vulnerabilities. It\u2019s part of a layered defense system for websites. But as with all automated defense tools, things can go sideways.<\/p>\n Let\u2019s say you use an awesome deployment script. It connects to your server using SSH. Then it switches to FTP to upload some assets. It might even call a custom WordPress hook to finish the job.<\/p>\n In a perfect world, this goes smoothly. But what started happening was that these deployments were being auto-blocked<\/em> by the server. Yikes.<\/p>\n The fail2ban system uses regex patterns<\/strong> to scan log files. It looks for certain phrases that signal an attack. For example, 5 failed logins from the same IP? Blocked. An FTP login that doesn\u2019t quite look right? Suspicious.<\/p>\n The problem was that certain automated, legitimate FTP connections<\/em> looked like brute force attempts to the regex that WP fail2ban was using.<\/p>\n This was especially true when the FTP command was called right after an SSH connection. The logs just looked sketchy to the regex\u2014even though a human would see it\u2019s a normal deployment.<\/p>\n Several dev teams began seeing strange bans on their IP addresses. After checking their deployment logs and server logs, the pattern became clear:<\/p>\n The FTP activity, seen out of context, matched WP fail2ban\u2019s pattern for brute-force FTP login attempts. It wasn\u2019t malicious, but it looked<\/em> close enough to trigger a block.<\/p>\n Regex (short for Regular Expression) is powerful. It\u2019s used to match patterns in text. In the case of fail2ban, the regex reads log entries and looks for “bad behavior.”<\/p>\n Here’s a simplified example of a regex pattern gone rogue:<\/p>\n This matches a standard failed SSH login. But if a deployed FTP user logs in quickly and fails once (or appears to), the log might look similar. The pattern sees “failed,” “password,” and “from IP”\u2014and boom, banished!<\/p>\n The real regex that WP fail2ban used was more complex, but the idea was the same: legit behavior closely mimics malicious patterns sometimes.<\/p>\n The root fix was to update the regex so it would still catch real threats but ignore safe deployment steps.<\/p>\n Developers rewrote the regex to be more precise. It now checks for patterns that only occur in truly failed login attempts. It ignores legit system behaviors like:<\/p>\n Additionally, the new regex includes timing checks and log context. This way, it won\u2019t flag a single failed attempt if it\u2019s followed by a successful one in the same session.<\/p>\n With the updated regex, here\u2019s what happens now:<\/p>\n If a real hacker tries to fake this behavior, they’d need to mimic the exact pattern of a working deployment. That\u2019s hard\u2014and even then, fail2ban now asks, \u201cHmm, is this really an attack?\u201d<\/p>\n This issue taught us a few important things about automation and security:<\/p>\n If you\u2019re managing a WordPress site with automated deployments, here are a few steps to stay safe and efficient:<\/p>\n If you\u2019re unsure about your regex configs, now\u2019s a great time to brush up on regex\u2014or ask your devops folks to help fine-tune it.<\/p>\n Security tools are awesome. They save our sites from daily attacks. But they\u2019re not perfect. Sometimes, we need to tweak them to understand the difference between \u201cbad guy creeping in\u201d and \u201cdev trying to push to live.\u201d<\/p>\nThe Problem with Deployments<\/h2>\n
fail2ban Cries Wolf<\/h2>\n
![\"\"](\"https:\/\/thumbtube.com\/blog\/wp-content\/uploads\/2025\/10\/a-close-up-of-a-typewriter-with-the-word-wordpress-printed-on-it-broken-image-links-wordpress-database-replace.jpg\")
\nIdentifying the Misfire<\/h2>\n
\n
Diving into the Regex<\/h2>\n
Failed password.*for.*from (.*) port<\/code><\/pre>\nEnter the Fix: A Better Regex<\/h2>\n
\n
The New Behavior<\/h2>\n
\n
Lessons Learned<\/h2>\n
\n
How to Protect Your Deployments<\/h2>\n
\n
\/etc\/fail2ban\/jail.local<\/code> file and adjust bans for your deployment IP addresses.<\/li>\n![\"\"](\"https:\/\/thumbtube.com\/blog\/wp-content\/uploads\/2025\/12\/a-group-of-white-cubes-floating-in-the-air-minecraft-folder-structure-kubejs-scripts.jpg\")
\nThe Bigger Picture<\/h2>\n