Standard WordPress security plugins monitor wp-login.php, but attackers targeting headless APIs frequently hammer JWT or OAuth REST authentication routes directly without triggering core login filters.
# /etc/fail2ban/filter.d/wp-rest-auth.conf
[Definition]
failregex = ^ - .* "POST /wp-json/jwt-auth/v1/token HTTP/.*" 403
ignoreregex =
# /etc/fail2ban/jail.local
[wp-rest-auth]
enabled = true
port = http,https
filter = wp-rest-auth
logpath = /var/log/nginx/access.log
maxretry = 5
findtime = 600
bantime = 86400 Enforcing IP bans at the Linux netfilter / iptables layer drops brute-force traffic before PHP-FPM workers ever spend CPU cycles parsing JSON authentication requests.