Stop brute-force attacks before they reach WordPress

The Hive WordPress security plugin is free and open source under GPL-2.0, with all 16 attack sensors, the Web Application Firewall and four-method two-factor authentication. Hive PRO is an optional subscription on top: it connects your sites to the managed, EU-hosted 2FA relay for SMS and e-mail codes, no Twilio account, no API keys, with 25 SMS and 500 e-mails per month included, and one licence covers three domains and one Linux server. Agencies and shops with more sites take Business, which covers fifteen domains and three servers. The plugin itself stays free; the paid plans only add the managed services. See the pricing page for current plans.

Three differences. First, nothing is held back: all 16 sensors, the firewall engine and the full 2FA suite are free in every mode, while Wordfence delays new firewall rules for free users by 30 days. Second, two-factor codes by e-mail and SMS are delivered through our EU relay with its own SPF, DKIM and DMARC reputation, so a code arrives even when your shared host’s mail does not, and no Twilio account is needed. Third, the whole service is built and hosted in Germany under EU data-protection law, with a data-processing agreement on offer. Wordfence remains the better answer if you need malware scanning of your files, which Hive does not do. See the full Wordfence comparison.

The ReportedIP Agent is a single static binary for Linux servers. It downloads the community blocklist and keeps it in your kernel firewall as ipset or nftables sets, split by service, so an address known for attacking mail servers is dropped on your mail ports only. At the same time it watches the logs your server already writes, thirteen source types across web, mail, FTP, DNS and the control panel, and reports the attacks it finds, so the next operator is spared them. It sends the address, the threat category and one generated sentence, never a log line, a user name or a URL. One server is included from Professional, three with Business; further servers are a monthly licence. The host starts in log mode, so you can read for a week what would have been blocked before anything is.

Yes. ReportedIP is operated by a German company (CMS ADMINS, Munich) and all processing runs on German infrastructure under EU data-protection law (GDPR). Every sub-processor is EU-based: the managed reportedIP mail / SMS relay, Stripe Payments Europe (Ireland) for billing, and sevDesk (Germany) for invoicing. No personal data leaves the EU, and a data-processing agreement is available for business customers. IP addresses in reports are handled as the minimum necessary for the security purpose and aged out over time. For teams with a compliance requirement to keep threat-intelligence data inside the EU, this is the core reason they pick ReportedIP over US-hosted alternatives.

Every IP carries a confidence score from 0 to 100 that estimates how likely it is to be malicious. Five weighted components feed it: the number of reports, reporter diversity (independent sources count for more than one noisy reporter), recency (reports under 24 hours old weigh most), the severity of the threat category, and a bonus for reports confirmed by verified honeypots. Reports decay exponentially on a 30-day half-life, after 30 days a report carries half its weight, after 60 days a quarter, so an IP that stops attacking is delisted automatically. An IP needs at least five reports to exceed 50 and ten to pass 75. Add verbose=true to any check to see the full breakdown.

No. The IP check on this page is open to everyone and needs no signup; it is rate-limited to 100 lookups per IP per day to keep it free and abuse-resistant. That is enough for occasional manual checks when you spot a suspicious address in your logs. For programmatic access, scripting, automated ban actions, bulk work or anything that runs on a schedule, create a free account, which raises the limit to 1,000 checks and 50 reports per day and gives you an API key plus a usage dashboard. Higher tiers lift the quotas further and add bulk endpoints and multi-site management.