fail2ban for Apache

To protect Apache with fail2ban, enable the stock Apache jails in /etc/fail2ban/jail.local — at minimum apache-auth, apache-badbots, apache-noscript and apache-overflows — with backend = auto, then run sudo fail2ban-client reload. fail2ban reads /var/log/apache2/*error.log on Debian and Ubuntu and /var/log/httpd/*error_log on Fedora and RHEL automatically. For 404 scanners, add the custom filter at the end of this page.

[apache-auth]
enabled = true
backend = auto

[apache-badbots]
enabled = true
backend = auto

[apache-noscript]
enabled = true
backend = auto

[apache-overflows]
enabled = true
backend = auto

[apache-shellshock]
enabled = true
backend = auto

sudo fail2ban-client reload
sudo fail2ban-client status

backend = auto matters on Ubuntu 24.04, whose package sets backend = systemd for every jail; with that backend fail2ban ignores logpath and Apache's log files are never read.

Apache log paths: apache2 vs httpd#

The jails don't hard-code paths. They use variables from the distribution's paths-*.conf:

The globs pick up per-site logs such as example.com-error.log — but only files that exist when the jail starts. If a vhost logs somewhere else, add it:

[apache-auth]
enabled = true
backend = auto
logpath = %(apache_error_log)s
          /srv/www/example.com/logs/error.log

Check what a running jail actually reads with sudo fail2ban-client get apache-auth logpath.

Every stock Apache jail#

All of them use port = http,https.

apache-auth#

Catches Apache 2.4 authentication errors such as:

[Sun Oct 25 18:36:10.123456 2026] [auth_basic:error] [pid 2345] [client 203.0.113.42:51234] AH01618: user admin not found: /private/
[Sun Oct 25 18:36:12.654321 2026] [auth_basic:error] [pid 2345] [client 203.0.113.42:51234] AH01617: user admin: authentication failure for "/private/": Password Mismatch

mode = aggressive also counts mod_evasive's "denied by server configuration" messages, which the normal mode skips.

apache-noscript and apache-overflows#

Bots constantly request /wp-login.php, /xmlrpc.php or /shell.php on sites that have none of them. With PHP-FPM, Apache logs these as:

[Sun Oct 25 18:36:10.123456 2026] [proxy_fcgi:error] [pid 2345] [client 203.0.113.42:51234] AH01071: Got error 'Primary script unknown'

apache-noscript counts these. Don't enable it on a PHP site where users can post links to missing scripts (forums, wikis): their visitors would be banned. apache-overflows is safe almost everywhere — normal browsers never send Invalid URI or overlong requests.

apache-botsearch and apache-nohome need LogLevel info#

Both filters match AH00128: File does not exist, which Apache 2.4 logs at info level. With the default LogLevel warn these lines never appear and the jails stay at zero. Raise the level for the core module only:

LogLevel warn core:info

apache-botsearch also assumes your document root is directly under /var/www/ (webroot = /var/www/). On Debian, Ubuntu and RHEL the default root is /var/www/html/, so pass the real one:

[apache-botsearch]
enabled = true
backend = auto
filter  = apache-botsearch[webroot="/var/www/html/"]

We confirmed with fail2ban-regex that a File does not exist: /var/www/html/phpmyadmin line is missed with the default webroot and matched with this one.

apache-fakegooglebot#

This jail matches every access-log line whose user agent contains Googlebot, then runs an ignorecommand script that does a reverse and forward DNS check. Real Googlebot addresses are ignored; impostors get banned on the first request. It costs one DNS lookup per Googlebot request, so enable it only if fake crawlers are a real problem for you.

apache-modsecurity and apache-shellshock#

apache-modsecurity turns ModSecurity's per-request denials into firewall bans: after two blocked requests the client can't reach the server at all. It only makes sense if mod_security2 is installed with a rule set such as the OWASP CRS. apache-shellshock bans clients sending Shellshock payloads to CGI scripts; on a patched server it mostly cleans up noise.

Ban Apache 404 floods with a custom filter#

There's no stock 404 filter. This one reads the combined access-log format (and Debian's vhost_combined used for other_vhosts_access.log), with the status codes chosen per jail:

[Definition]
failregex = ^(?:\S+:\d+ )?<HOST> \S+ \S+ \[\] "[A-Z]+ [^"]*" (?:<codes>)\s
ignoreregex = "(?:GET|HEAD) /(?:favicon\.ico|robots\.txt|apple-touch-icon\S*\.png)\s
datepattern = ^[^\[]*\[({DATE})
              {^LN-BEG}

[Init]
codes = 404

[apache-404]
enabled  = true
backend  = auto
filter   = apache-4xx
logpath  = %(apache_access_log)s
port     = http,https
findtime = 10m
maxretry = 20
bantime  = 1h

[apache-403]
enabled  = true
backend  = auto
filter   = apache-4xx[codes="401|403"]
logpath  = %(apache_access_log)s
port     = http,https
maxretry = 10

Matching lines look like:

203.0.113.42 - - [25/Oct/2026:18:36:10 +0000] "GET /.env HTTP/1.1" 404 196 "-" "curl/8.5.0"
example.com:443 203.0.113.42 - - [25/Oct/2026:18:36:10 +0000] "GET /.git/config HTTP/1.1" 404 196 "-" "curl/8.5.0"

A high maxretry matters: one missing image on a popular page produces 404s for every visitor. For login brute force on WordPress specifically, see the WordPress guide; for writing filters for other formats, see writing a custom filter.

Apache behind a proxy or CDN#

Behind a load balancer, reverse proxy or Cloudflare, Apache logs the proxy's address and fail2ban would ban the proxy. Use mod_remoteip so Apache logs the client:

RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 10.0.0.5

sudo a2enmod remoteip && sudo a2enconf remoteip && sudo systemctl reload apache2

Error-log lines then show the client in [client …]. For the access log, use %a instead of %h in your LogFormat lines. For public proxy ranges (Cloudflare) the directive is RemoteIPTrustedProxy; the Cloudflare guide has the full setup.

Test the Apache jails#

# Debian/Ubuntu
sudo fail2ban-regex /var/log/apache2/error.log apache-auth
sudo fail2ban-regex /var/log/apache2/access.log /etc/fail2ban/filter.d/apache-4xx.conf

# RHEL/Fedora
sudo fail2ban-regex /var/log/httpd/error_log apache-noscript

Then check the running jail and its files:

sudo fail2ban-client status apache-auth
sudo fail2ban-client get apache-404 logpath

To provoke apache-auth, request a password-protected path with a bad password from a second machine (curl -u admin:wrong https://example.com/private/) five times and look for Ban in /var/log/fail2ban.log. The same ideas for nginx are in the nginx guide.

Built-in filter reference: apache-auth, apache-badbots, apache-botsearch and more#

The built-in filters this guide uses, exactly as fail2ban 1.1.1 ships them — with the log lines they match and a link to test them. Looking for something else? See HAProxy, lighttpd, Squid and the other web server, proxy and web-app filters, or the full filter library.

^\[\]\s\[(:?error|(?!evasive)\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client|remote) <HOST>(:\d{1,5})?\] (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$

^client (?:denied by server configuration|used wrong authentication scheme)\b
^user (?!`)<F-USER>(?:\S*|.*?)</F-USER> (?:auth(?:oriz|entic)ation failure|not found|denied by provider)\b
^Authorization of user <F-USER>(?:\S*|.*?)</F-USER> to access .*? failed\b
^([A-Z]\w+: )?user <F-USER>(?:\S*|.*?)</F-USER>: password mismatch\b
^([A-Z]\w+: )?user `<F-USER>(?:[^']*|.*?)</F-USER>' in realm `.+' (auth(?:oriz|entic)ation failure|not found|denied by provider)\b
^([A-Z]\w+: )?invalid nonce .* received - length is not\b
^([A-Z]\w+: )?realm mismatch - got `(?:[^']*|.*?)' but expected\b
^([A-Z]\w+: )?unknown algorithm `(?:[^']*|.*?)' received\b
^invalid qop `(?:[^']*|.*?)' received\b
^([A-Z]\w+: )?invalid nonce .*? received - user attempted time travel\b
^(?:No h|H)ostname \S+ provided via SNI(?:, but no hostname provided| and hostname \S+ provided| for a name based virtual host)\b

^\s*(?:[\w]+[\w\-\.]*\s+)?<ADDR> [^"]*"[A-Z]{3,10} [^"]+" \d+ \d+ "[^"]+" "[^"]*(?:Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailSpider|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Guestbook Auto Submitter|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 \+http\://letscrawl\.com/|Lincoln State Web Browser|LMQueueBot/0\.2|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|MVAClient|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/3\.0 \(compatible; scan4mail \(advanced version\) http\://www\.peterspages\.net/?scan4mail\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|NameOfAgent \(CMS Spider\)|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|ShablastBot 1\.0|snap\.com beta crawler v0|Snapbot/1\.0|Snapbot/1\.0 \(Snap Shots&#44; \+http\://www\.snap\.com\)|sogou develop spider|Sogou Orion spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sogou spider|Sogou web spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|VadixBot|WebVulnCrawl\.unknown/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00|EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider|(?:Mozilla/\d+\.\d+ )?Jorgee)"$

^\[\]\s\[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client|remote) <HOST>(:\d{1,5})?\] (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$

^(?:File does not exist|script not found or unable to stat): /var/www/\/?(roundcube|(ext)?mail|horde|(v-?)?webmail|(typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)|wp-(login|signup|admin)\.php|cgi-bin|mysqladmin)[^,]*(, referer: \S+)?\s*$
^script '/var/www/\/?(roundcube|(ext)?mail|horde|(v-?)?webmail|(typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)|wp-(login|signup|admin)\.php|cgi-bin|mysqladmin)[^,]*' not found or unable to stat(, referer: \S+)?\s*$

^\s*(?:[\w]+[\w\-\.]*\s+)?<ADDR> [^"]*"[A-Z]{3,10} /\S* [^"]*" \d+ \d+ "[^"]*" "[^"]*\bGooglebot/[^"]*"

^\[\]\s\[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client|remote) <HOST>(:\d{1,5})?\](?: \[client [^\]]+\])? ModSecurity:\s+(?:\[(?:\w+ \"[^\"]*\"|[^\]]*)\]\s*)*Access denied with code [45]\d\d

^\[\]\s\[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client|remote) <HOST>(:\d{1,5})?\] (AH00128: )?File does not exist: .*/~.*

^\[\]\s\[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client|remote) <HOST>(:\d{1,5})?\] (?:AH0(?:01(?:28|30)|1(?:264|071)|2811): )?(?=(?:[Ff]ile|[Ss]cript|[Gg]ot error|stderr from) )<F-CONTENT>.+</F-CONTENT>$

^(?:(?:[Ff]ile does not exist|[Ss]cript not found or unable to stat): /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/)\b|[Gg]ot error '[Pp]rimary script unknown\b)
^(?:stderr from |script (?P<_q>'))/\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/)\S*(?(_q)'|) (?:script )?(?:does not exist|not found or unable to stat)

^\[\]\s\[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client|remote) <HOST>(:\d{1,5})?\] (?:(?:AH(?:001[23][456]|10244): )?[Ii]nvalid (method|URI)\b|(?:AH00565: )?request failed: URI too long \(longer than \d+\)|request failed: erroneous characters after protocol string:|(?:AH00566: )?request failed: invalid characters in URI\b)

^\[\]\s\[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client|remote) <HOST>(:\d{1,5})?\] (AH01215: )?/bin/([bd]a)?sh: <F-CONTENT>.+</F-CONTENT>$

^warning: HTTP_[^:]+: ignoring function definition attempt(, referer: \S+)?\s*$
^error importing function definition for `HTTP_[^']+'(, referer: \S+)?\s*$

^<HOST> - \w+ \[\] "GET /knocking/ HTTP/1\.[01]" 200 \d+ ".*" "[^-].*"$

FAQ#

Which Apache filters does fail2ban include?#

fail2ban 1.1.1 ships apache-auth, apache-badbots, apache-botsearch, apache-fakegooglebot, apache-modsecurity, apache-nohome, apache-noscript, apache-overflows and apache-shellshock, each with a disabled jail of the same name in jail.conf. There's also apache-pass, used by the pass2allow-ftp port-knocking example jail.

How do I ban Apache 404 errors with fail2ban?#

Create a filter matching status 404 in the access log, such as failregex = ^<HOST> \S+ \S+ \[\] "[A-Z]+ [^"]*" 404\s, and a jail with logpath = %(apache_access_log)s, maxretry = 20 and findtime = 10m. Ignore favicon.ico and robots.txt so ordinary browsers aren't counted.

Why is apache-botsearch not banning anything?#

Apache 2.4 logs File does not exist at info level, so with LogLevel warn the lines never reach the error log. Set LogLevel warn core:info. Also pass your real document root, e.g. filter = apache-botsearch[webroot="/var/www/html/"], because the filter defaults to /var/www/.

Does fail2ban work with httpd on RHEL and Rocky Linux?#

Yes. The Fedora/EPEL package uses paths-fedora.conf, which points the Apache jails at /var/log/httpd/*error_log and *access_log. Enable the jails in jail.local as on Debian; with fail2ban-firewalld installed, bans are applied through firewalld.

Where are the Apache logs fail2ban reads?#

On Debian and Ubuntu: /var/log/apache2/*error.log and /var/log/apache2/*access.log. On Fedora, RHEL, Rocky and AlmaLinux: /var/log/httpd/*error_log and /var/log/httpd/*access_log. Vhosts logging elsewhere need extra logpath lines in the jail.