There seems to be some missmatch in the version hosted at WordPressOrg vs. GitHub.
In lib/syslog.php
the file wp-fail2ban.5.4.0.zip from WordPressOrg contains a changed tag “WordPress” in getLine()
.
Example log line from auth.log
:
2025-01-28T10:31:22.288579+01:00 wordpress.example.com WordPress(wordpress.example.com/)[3988751]: Authentication attempt for unknown user newadminuser1 from 123.123.123.123
But in the GitHub version, this tag ist still written in lowercase as “wordpress”.
So after automatically updating from WordPressOrg the fail2ban filter does not work anymore. Hope to see a fix 5.4.1 soon.