Secure Nginx against brute force attacks

Limit connection attempts with Nginx

Nginx's native Rate Limiting alone is enough to stop the majority of bots even before they reach PHP.

limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;

server {
    location = /wp-login.php {
        limit_req zone=login burst=3 nodelay;
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php-fpm.sock;
    }
}

Add Fail2Ban in addition

sudo apt install fail2ban
sudo nano /etc/fail2ban/jail.local

[nginx-wp-login]
enabled = true
filter = nginx-wp-login
port = http,https
logpath = /var/log/nginx/access.log
maxretry = 5
bantime = 3600

Tip: Combine this with a WordPress side login attempt throttling plugin for dual protection at the application level.