{"id":86,"date":"2026-08-26T08:06:20","date_gmt":"2026-08-26T08:06:20","guid":{"rendered":"https:\/\/usestackpulse.com\/securiser-nginx-force-brute\/"},"modified":"2026-08-30T19:11:09","modified_gmt":"2026-08-30T19:11:09","slug":"securiser-nginx-force-brute","status":"publish","type":"page","link":"https:\/\/usestackpulse.com\/en\/securiser-nginx-force-brute\/","title":{"rendered":"Secure Nginx against brute force attacks"},"content":{"rendered":"<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\" style=\"padding-top:32px;padding-right:24px;padding-bottom:8px;padding-left:24px\">\n<p class=\"usp-eyebrow wp-block-paragraph\">Home \/ Hosting &amp; Cloud \/ Secure Nginx<\/p>\n\n\n\n<p class=\"usp-badge wp-block-paragraph\">Hosting &amp; Server<\/p>\n\n\n\n<h1 class=\"wp-block-heading usp-h1\">Secure Nginx against brute force attacks<\/h1>\n\n\n\n<p class=\"usp-meta wp-block-paragraph\">by the team UseStackPulse Updated on August 26, 2026 7 min reading<\/p>\n\n\n\n<p class=\"usp-lede wp-block-paragraph\">Automated login attempts on \/wp-login.php can saturate your server. Two layers of protection are enough to block 95% of these attacks.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group usp-ad-slot is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-right:24px;margin-bottom:24px;margin-left:24px\">\n<p class=\"usp-ad-label wp-block-paragraph\">Advertising \/ AD Leaderboard 728\u00d790<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group is-layout-flow wp-container-core-group-is-layout-ecfbd4fd wp-block-group-is-layout-flow\" style=\"margin-right:24px;margin-bottom:24px;margin-left:24px\">\n<h2 class=\"wp-block-heading usp-h2\">Limit connection attempts with Nginx<\/h2>\n\n\n\n<p class=\"usp-card-excerpt wp-block-paragraph\">Nginx's native Rate Limiting alone is enough to stop the majority of bots even before they reach PHP.<\/p>\n\n\n\n<pre class=\"wp-block-code usp-code\"><code>limit_req_zone $binary_remote_addr zone=login:10m rate=1r\/s;\n\nserver {\n    location = \/wp-login.php {\n        limit_req zone=login burst=3 nodelay;\n        include fastcgi_params;\n        fastcgi_pass unix:\/run\/php\/php-fpm.sock;\n    }\n}<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading usp-h3\">Add Fail2Ban in addition<\/h3>\n\n\n\n<pre class=\"wp-block-code usp-code\"><code>sudo apt install fail2ban\nsudo nano \/etc\/fail2ban\/jail.local\n\n[nginx-wp-login]\nenabled = true\nfilter = nginx-wp-login\nport = http,https\nlogpath = \/var\/log\/nginx\/access.log\nmaxretry = 5\nbantime = 3600<\/code><\/pre>\n\n\n\n<p class=\"usp-tip wp-block-paragraph\">Tip: Combine this with a WordPress side login attempt throttling plugin for dual protection at the application level.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group usp-ad-slot is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-right:24px;margin-bottom:24px;margin-left:24px\">\n<p class=\"usp-ad-label wp-block-paragraph\">Advertising \/ AD In-article 336\u00d7280<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group is-layout-flow wp-container-core-group-is-layout-b241125f wp-block-group-is-layout-flow\" style=\"margin-right:24px;margin-bottom:40px;margin-left:24px\">\n<h2 class=\"wp-block-heading usp-h2\">frequently asked questions<\/h2>\n\n\n\n<details class=\"wp-block-details usp-faq is-layout-flow wp-block-details-is-layout-flow\"><summary>Can Rate Limiting block real users?<\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:13px\">With a burst of 3 and a 1 request\/second rate, a normal user will never be impacted.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details usp-faq is-layout-flow wp-block-details-is-layout-flow\"><summary>Does Fail2Ban work on all hosts?<\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:13px\">only on a dedicated VPS or server with root access; The shared do not generally allow it.<\/p>\n<\/details>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Accueil \/ H\u00e9bergement &amp; Cloud \/ S\u00e9curiser Nginx H\u00c9BERGEMENT &amp; SERVEUR S\u00e9curiser Nginx contre les attaques par force brute Par [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"disabled","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_zipai_imported":false,"_zipai_import_id":"","footnotes":""},"class_list":["post-86","page","type-page","status-publish","hentry"],"spectra_blocks_featured_image_url":null,"spectra_blocks_author_info":{"display_name":"usestackpulse","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/f2c693076eefeb6a1ac9f8299c6623627456d026be6ffbbb32fd62bd98781cc5?s=96&d=mm&r=g","author_link":"https:\/\/usestackpulse.com\/en\/author\/usestackpulse\/","description":""},"_links":{"self":[{"href":"https:\/\/usestackpulse.com\/en\/wp-json\/wp\/v2\/pages\/86","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/usestackpulse.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/usestackpulse.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/usestackpulse.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/usestackpulse.com\/en\/wp-json\/wp\/v2\/comments?post=86"}],"version-history":[{"count":0,"href":"https:\/\/usestackpulse.com\/en\/wp-json\/wp\/v2\/pages\/86\/revisions"}],"wp:attachment":[{"href":"https:\/\/usestackpulse.com\/en\/wp-json\/wp\/v2\/media?parent=86"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}