diff --git a/traefik/compose.yml b/traefik/compose.yml
index 37883aa..e35b060 100644
--- a/traefik/compose.yml
+++ b/traefik/compose.yml
@@ -19,10 +19,12 @@ services:
       - "--entrypoints.web.http.redirections.entryPoint.to=web-secure"
       - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
       - "--entrypoints.web.http.redirections.entryPoint.permanent=true"
-      - "--entrypoints.web-secure.http.middlewares=security-headers@file"
+      - "--entrypoints.web-secure.http.middlewares=security-headers@file,fail2ban@file"
       - "--certificatesresolvers.resolver.acme.tlschallenge=true"
       - "--certificatesresolvers.resolver.acme.email=${ACME_EMAIL}"
       - "--certificatesresolvers.resolver.acme.storage=/letsencrypt/acme.json"
+      - "--experimental.plugins.fail2ban.moduleName=github.com/tomMoulard/fail2ban"
+      - "--experimental.plugins.fail2ban.version=v0.7.1"
     ports:
       - "80:80"
       - "443:443"
diff --git a/traefik/dynamic/fail2ban.yaml b/traefik/dynamic/fail2ban.yaml
new file mode 100644
index 0000000..9a8b360
--- /dev/null
+++ b/traefik/dynamic/fail2ban.yaml
@@ -0,0 +1,15 @@
+http:
+  middlewares:
+    fail2ban:
+      plugin:
+        fail2ban:
+          rules:
+            bantime: "3h"
+            findtime: "10m"
+            maxretry: 5
+          whitelist:
+            ip:
+              - "127.0.0.1/8"
+              - "10.0.0.0/8"
+              - "172.16.0.0/12"
+              - "192.168.0.0/16"