# SPDX-License-Identifier: AGPL-3.0-only
# A WordPress login that did not work. WordPress answers a successful
# login with a 302 to the dashboard and a failed one by re-rendering the
# form, which is a 200 — so the status is the whole distinction, and it
# is the same one every fail2ban and CrowdSec rule for this uses.
#
# This is the one HTTP parser whose matches include real people. A
# customer mistyping their password produces exactly this line. Score it
# on a rule with a progressive ban, never a first-strike one, unless
# nobody but you can log in.
parser: wp-login-fail
log: http
prefilter: "/wp-login.php"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "POST (?P<path>[^ "?]*/wp-login\.php)(?:\?[^ "]*)? [^"]*" 200 '
time_field: time
time_format: nginx
