There must be a neat way to integrate nginx with fail2ban in that way.

If someone tries to access /wp-admin, it's probably a vuln scanner bot and we don't welcome it