In reply to Marko Heijnen.

Yes, fail2ban is very useful for SSH.
For webserver I do prefer Openresty - with it's Lua I can block/ban a "bad" request IP immediately, before it will be sent to php. Fail2ban requires a log entry to take an action, so it's not that effective.
Thank you for taking your time, anyways :-)