Fail2ban + Hardening Across 12 WordPress Sites

12 small-business WordPress sites sharing one VPS were repeatedly targeted by wp-admin password guessing. I configured Fail2ban at the Nginx/SSH layer to auto-block IPs after repeated failed logins, added per-site login attempt limits, renamed the wp-admin path, and ran a hardening checklist. After one month, logged brute-force attempts dropped 90% with zero successful breaches.