What is Fail2ban? How it works and how to unban an IP address

Fail2ban is free, open-source intrusion prevention software for Linux servers. It watches log files for failed logins and, once an IP address fails too often within a set time, adds a firewall rule that bans that address for a while. If your website, control panel or email suddenly stops loading on one network but works fine on mobile data, a Fail2ban ban on your IP address is the most likely cause. This guide explains how Fail2ban works, how to check its status, and how to get an IP address unbanned.

What is Fail2ban?

Fail2ban (also written Fail2Ban or fail 2 ban) is a background service, written in Python and released under the GPL. In the words of the official project page, it scans log files such as /var/log/auth.log and bans IP addresses conducting too many failed login attempts.

That protection matters because bots try passwords around the clock on login pages for websites, mail servers, SSH and control panels. This is a brute-force attack, and Fail2ban stops it by locking the attacker out long before a guess succeeds. On one of our servers alone, more than 32,000 IP addresses were banned in early November 2026 for trying to guess WordPress passwords.

A few terms you will see in every Fail2ban setup:

How Fail2ban works

1. A service, for example SSH, the web server or the FTP server, writes every failed login and the client's IP address to a log file.
2. Fail2ban follows that log and matches failed attempts with a filter.
3. When one IP address exceeds maxretry within findtime, Fail2ban adds a firewall rule (iptables or nftables) and that address can no longer connect to the service.
4. When the bantime has passed, Fail2ban removes the rule again, unless an administrator lifts the ban sooner.

Fail2ban only sees IP addresses. Everyone who shares a public IP address, such as colleagues in the same office or guests on the same Wi-Fi, is banned together.

How to check Fail2ban status

On a server you manage yourself, you use fail2ban-client as root or with sudo:

sudo fail2ban-client status                          # list the active jails
sudo fail2ban-client status sshd                     # counters and banned IPs for one jail
sudo fail2ban-client banned 203.0.113.10             # which jails have banned this address?

The status of a jail shows the failures currently being counted (Currently failed), the number of addresses banned right now (Currently banned), the totals since Fail2ban started, and the Banned IP list.

How to unban an IP address in Fail2ban

sudo fail2ban-client set sshd unbanip 203.0.113.10   # unban in one jail
sudo fail2ban-client unban 203.0.113.10              # unban in every jail

Fix the cause first, such as an app with an old saved password, or the address will be banned again within minutes.

To make sure an address is never banned, add it to ignoreip. Never edit /etc/fail2ban/jail.conf itself, because an update can overwrite it. Put your own settings in /etc/fail2ban/jail.local or in a .local file in /etc/fail2ban/jail.d/:

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
ignoreip = 127.0.0.1/8 ::1 203.0.113.10

[sshd]
enabled = true

Apply the changes with sudo fail2ban-client reload. The defaults in jail.conf are 5 failures within 10 minutes and a 10-minute ban.

On a Plesk server you will also find Fail2ban under Tools & Settings, IP Address Banning (Fail2Ban). On the Banned IP Addresses tab you select an address and click Unban; on the Trusted IP Addresses tab you click Add Trusted IP for an address that should never be banned. See the Plesk documentation for details.

Fail2ban at LJPc hosting

At LJPc hosting, Fail2ban on our web servers guards logins for WordPress, Plesk, FTP and SSH, among others; on our mail servers at ljpc.email it guards email and webmail logins. Which services are covered and how many attempts you get differs per server. These are the usual settings:

• A ban after failed WordPress logins applies to every website on that server, so your other sites will not load from your IP address either.
• A ban on the mail server covers email and webmail at the same time.
• On a web server, waiting will not help: have the ban lifted as described below.
• Our mail servers give a phone or laptop with an outdated password plenty of room, and act firmly on what gives an attacker away: trying many different addresses.

Is my IP address banned? How to tell

• Your website, Plesk or FTP shows This site can't be reached with ERR_CONNECTION_REFUSED, or Unable to connect, or the page keeps loading.
• Other websites work fine.
• Colleagues on the same network have the same problem, while someone at home or on another network does not.
• For email: your mail app cannot connect to ljpc.email and webmail will not load.

1. Turn off Wi-Fi on your phone and open your website over mobile data.
2. If it works on mobile data but not on Wi-Fi, the IP address of your Wi-Fi network is almost certainly banned.
3. Turn Wi-Fi back on and search for what is my IP address. Search engines and dedicated websites show the public IP address of your network. Look it up from the banned network, not over mobile data, because that is the address we need.

Getting your IP address unbanned at LJPc

With the IP check in the customer portal

If the IP check is enabled for your account, you can lift a ban on your own servers yourself:

1. Sign in to the customer portal. The portal runs on a separate server, so it works even when your website will not load for you. See signing in to the customer portal.
2. On the dashboard, find the IP check block.
3. Enter the IP address and click Check. Every server is checked separately, so this can take a moment.
4. Where a package shows Blocked, click Unban.
5. When the message This IP address has free access to all of your servers appears, you are done.

The IP check covers the web servers your packages are on, not the mail servers. If you do not see the IP check block, or the ban is on your email, we will take care of it for you.

Through our support team

Create a support ticket in the customer portal, send us a WhatsApp message or call +31 85 130 6429 (see our contact page). Include the IP address, what does not work (website, Plesk, FTP or email), the domain name or email address, and roughly when it started. If your email is blocked, reach us through the portal, WhatsApp or phone rather than from that mailbox. We look up which service banned you, lift the ban and tell you where it came from.

How to avoid being banned

• Changed a password? Update it everywhere. A phone, tablet or laptop with the old password keeps retrying in the background. The right settings are in set up email on your phone, tablet and computer.
• Remove old mail accounts. Accounts for addresses that no longer exist, or with a wrong password, look like an attacker trying addresses. On an iPhone, follow remove an email account from your iPhone or iPad.
• Open Plesk from the customer portal. You sign in without a separate password, so there is nothing to mistype. See open Plesk from the customer portal.
• Unsure of your WordPress password? Stop after the first failed attempt and use Lost your password? below the login form.
• Sign in to WordPress through the regular login screen. When your session expires, WordPress shows a login box over the page. On our servers a login through that box counts as an attempt, even with the right password. If you are logged out often, reload the page and sign in through the regular screen.
• Check saved FTP details. An FTP client with an old password retries several times in a row. See upload files with FTP, FTPS and SFTP.
• Use a password manager so you never mistype a password, and turn on two-factor authentication wherever you can. Have I Been Pwned tells you whether your email address appears in a data breach, so you can replace a leaked password in time.

Need help?

Still stuck, or want to know why your IP address was banned? Create a support ticket and we will look into it. If your email is not arriving for another reason, see fix email problems.