Login Lockout Layer SOP

Login Lockout Layer SOP
fail2ban (IP-based) vs app-level lockout (account-based). Use both, at different layers.

— Use fail2ban when: attacks come from few IPs hitting many usernames. Bans the source at the firewall, cheap on app resources.
— Use app-level lockout (Limit Login Attempts, Wordfence) when: one account is targeted from rotating IPs. fail2ban can't see that pattern.
— Verify fail2ban actually parses your auth log path and the regex matches real failed-login lines.
— Set thresholds apart: fail2ban at 10 fails/IP, app lockout at 5 fails/account, so they don't collide.
— Confirm: trigger 5 bad logins on a test account, check both the firewall ban and the app lock fired.

Run this on every new server.