Simple, fair pricing
The protection is free forever, all 16 sensors and the full 2FA suite, with no rules held back behind a paid plan. A paid plan buys our servers: 2FA mail that lands in the inbox, SMS without a Twilio account, higher API quotas and every site in one dashboard.
Professional works out at 4.97 € per domain per month. Wordfence, Solid Security and WP 2FA charge around 8.30 € for a single domain, and none of them include mail or SMS delivery. See the full comparison.
ReportedIP pricing at a glance: the Free tier includes 1,000 API checks and 50 reports per day plus the full Hive WordPress security plugin; Professional costs 14.90 €/month (149 €/year) and Business 39 €/month (389 €/year), both incl. 19 % VAT. Every plan works with all ReportedIP products: API, blacklist, DNSBL zone and plugin.
Free
Local protection, free forever
- Full local Hive plugin, all 16 attack sensors
- Web Application Firewall (engine + OWASP-Top-10 baseline ruleset)
- Verified-bot detection, disposable-email blocking, comment honeypot & form execution proof
- Registration defence (prohibited usernames, e-mail rules, sign-up rate limit)
- Access lockdown switches (REST, XML-RPC, feeds, PHP in uploads)
- System readiness register (12 detectors)
- Basic security headers + protection & hardening score
- Block-page reference codes & MainWP integration
- Complete 2FA suite (TOTP, Email, WebAuthn incl. one YubiKey / security key per account)
- 1,000 API checks / day
- 50 reports / day
- 1 domain
- Community support
Professional
Solo developers and small sites
- Everything in Free & Contributor
- Covers 3 sites on one licence 1.66 € per site per month
- 2FA mail that actually arrives 500 mails a month from our EU relay, our SPF, DKIM and DMARC reputation, not your shared host
- SMS 2FA without a Twilio account 25 SMS a month included, top-up bundles available
- 25,000 API checks and 1,000 reports a day Room for busy sites, fail2ban and your own scripts
- Daily WAF rule updates, no delay Paranoia Level 2 and 3 rulesets plus live bot-IP and disposable-domain feeds
- Hardening mode for burst attacks Thresholds tighten automatically while an attack runs
- Advanced security headers HSTS, Content-Security-Policy, Permissions-Policy, cross-origin isolation
- WooCommerce 2FA in your own storefront Themed challenge on My Account and checkout, no wp-login bounce
- Ask for the second factor when it matters Per-role step-up on a new country, IP address, network or device, every N days or sign-ins, or above a session limit, even on a trusted device
- Unlimited registration rules No ten-entry cap on the username and e-mail lists, regular-expression patterns, registration only from allowlisted IP ranges
- Bulk operations, analytics and trends
- Email support, 48 h SLA
14-day money-back guarantee. Cancel anytime.
Business
Agencies, WooCommerce, white-label
- Everything in Professional
- Covers 15 client sites on one licence 2.60 € per site per month, bundle it into your care plan
- Book 2 to 20 licences on one bill Quota, 2FA mail, SMS and domains all multiply, up to 15 % volume discount, 20 licences means 300 sites
- Run every client site from one dashboard One settings policy, per-site overrides, one-click push and drift detection
- Your brand, not ours White-label quickstart, 2FA pages and mail templates
- 100,000 API checks and 5,000 reports a day 2,500 2FA mails and 75 SMS a month included
- WooCommerce end to end White-label templates plus Subscriptions and Memberships audit
- Proof for your compliance questions Append-only audit trail of logins, password resets and role changes with CSV and JSON export, plus GDPR export tool
- Backup security keys per user Multiple WebAuthn keys, model detection, key-lifecycle alerts
- Shut an account out in one click Block the account, end every session and trusted device, and see who is signed in right now
- Priority support, 12 h SLA
14-day money-back guarantee. Cancel anytime.
Other options
Contributor
Free + active honeypot contribution
- Everything in Free
- 5,000 API checks / day
- 200 reports / day
- Threat feed access
- Honeypot contributor badge
Enterprise
Beyond 20× Business, hosting providers and large organisations
- Everything in 20× Business and beyond
- Unlimited API quotas
- Unlimited domains
- Custom mail and SMS volume
- Phone support, 4 h response SLA
- Custom AVV / DPA, dedicated onboarding
- Configurable log retention
Add-ons & bundles
Bookable on Professional and above. Bundles are one-time top-ups that never expire and stack on your monthly included quota. The DNS / RBL Zone is a recurring add-on you can cancel anytime.
DNS / RBL Zone
Live blocklist lookups straight from your mail server
- Your community blacklist as a private DNSBL / RBL zone
- Drop-in for Postfix, Rspamd, BIND RPZ & any RBL-capable software
- Per-category sub-zones (spam, brute-force, malware ...)
- 100,000 DNS queries / day per token
2FA Mail bundles
Extra managed 2FA e-mails when your monthly allotment runs low.
- 1,000 mails 4.90 €
- 5,000 mails 14.90 €
- 25,000 mails 49.90 €
One-time payment, incl. 19 % VAT. Credits never expire.
2FA SMS bundles
Extra managed 2FA text messages for high-assurance logins.
- 50 SMS 14.90 €
- 200 SMS 49.90 €
- 500 SMS 99.90 €
One-time payment, incl. 19 % VAT. Credits never expire.
Detailed feature comparison
| Free | Contributor | PRO | Business | Enterprise | |
|---|---|---|---|---|---|
| API checks / day | 1,000 | 5,000 | 25,000 | 100,000 | Unlimited |
| Reports / day | 50 | 200 | 1,000 | 5,000 | Unlimited |
| Domains per licence | 1 | 1 | 3 | 15 | Unlimited |
| 2FA mails / month | Not included | Not included | 500 | 2,500 | Unlimited (fair use) |
| 2FA SMS / month | Not included | Not included | 25 | 75 | Custom |
| Decoy-path detect-and-report (auto-managed .htaccess) | Included | Included | Included | Included | Included |
| Coordinated-attack hardening mode | Not included | Not included | Included | Included | Included |
| Web Application Firewall (engine + baseline ruleset) | Included | Included | Included | Included | Included |
| Priority Sync: advanced WAF rulesets (Level 2/3) + live feeds | Not included | Weekly | Daily | Daily | Daily |
| Verified-bot detection | Included | Included | Included | Included | Included |
| Registration rules (usernames, e-mail rules, rate limit) | 10 per list | 10 per list | Unlimited + regex | Unlimited + regex | Unlimited + regex |
| Access lockdown switches (REST, XML-RPC, feeds, uploads) | Included | Included | Included | Included | Included |
| System readiness register | Included | Included | Included | Included | Included |
| Adaptive 2FA triggers per role | Not included | Not included | Included | Included | Included |
| Block user accounts & session manager | Not included | Not included | Not included | Included | Included |
| Disposable-email blocking, comment honeypot & form execution proof | Included | Included | Included | Included | Included |
| Security headers (basic trio) | Included | Included | Included | Included | Included |
| Advanced security headers (HSTS, CSP, cross-origin isolation) | Not included | Not included | Included | Included | Included |
| Protection & hardening score | Included | Included | Included | Included | Included |
| Block-page reference codes | Included | Included | Included | Included | Included |
| MainWP integration | Included | Included | Included | Included | Included |
| Cloud fleet management (central Hive settings policy + drift detection) | Not included | Not included | Not included | Included | Included |
| Audit event trail (user-lifecycle log + export) | Not included | Not included | Not included | Included | Included |
| Advanced Security Keys (multiple YubiKeys, model detection, key alerts) | 1 key | 1 key | 1 key | Included | Included |
| Bulk operations | Not included | Not included | Included | Included | Included |
| Analytics & trends | Not included | Not included | Included | Included | Included |
| Threat feed | Not included | Included | Included | Included | Included |
| White-label | Not included | Not included | Not included | Included | Included |
| WooCommerce Frontend-2FA | Not included | Not included | Included | Included | Included |
| WooCommerce complete integration | Not included | Not included | Not included | Included | Included |
| Multi-site dashboard | Not included | Not included | Included | Included | Included |
| Mail & SMS top-up bundles | Not included | Not included | Bookable | Bookable | Bookable |
| DNS / RBL Zone add-on | Not included | Not included | Bookable | Bookable | Bookable |
| Log retention | 30 d | 30 d | 90 d | 1 year | Configurable |
| Cloud backup of settings | Not included | Not included | 30 d | 90 d | 1 year |
| Weekly PDF security report | Not included | Not included | Included | Daily optional | Included |
| Support SLA | Community | Community | Email 48 h | Priority 12 h | Phone 4 h |
| Custom AVV / DPA | Not included | Not included | Not included | Not included | Included |
Business figures are per licence. Book Business x2-x20 to multiply checks, reports, 2FA mails/SMS and domains across your account, e.g. x5 = 500,000 checks/day and 75 domains. A volume discount applies automatically. Once you need more than 20× Business, Enterprise picks up from there with unlimited (fair use) quotas that are never multiplied.
Pricing FAQ
How much does ReportedIP cost?
The core service is free: a Free account includes 1,000 API checks and 50 reports per day, one domain, and the full local ReportedIP Hive security plugin with all 16 attack sensors and the complete 2FA suite, forever, without a paid gate. Paid plans only add the comfort of our managed servers: Professional costs 14.90 €/month (or 149 €/year, incl. 19 % VAT) and raises the limits to 25,000 checks and 1,000 reports per day across 3 domains, including 500 relay mails and 25 SMS per month for 2FA delivery. Business costs 39 €/month (389 €/year, incl. VAT) with 100,000 checks, 5,000 reports, 15 domains, 2,500 mails and 75 SMS. Full API details are in the documentation.
Is there a free tier, and what does it include?
Yes. The Free tier is not a trial, it is the permanent baseline. It includes 1,000 IP reputation checks and 50 attack reports per day via the REST API, access to the community blacklist, and the complete Hive WordPress plugin with every local protection feature (WAF engine, brute-force blocking, TOTP/email/passkey 2FA). You never pay for the protection itself, only for managed extras like SMS delivery, higher quotas, or multi-site management. See all products for what runs on the free tier.
What is the difference between Professional and Business?
Professional (14.90 €/month incl. VAT) targets freelancers and small teams: 3 domains, 25,000 checks/day, 500 relay mails and 25 SMS per month, priority rule sync and analytics. Business (39 €/month incl. VAT) targets agencies and shops: 15 domains, 100,000 checks/day, 2,500 mails and 75 SMS per month, plus whitelabel branding, full WP-CLI automation, WooCommerce complete integration, DSGVO export tooling and 12-hour priority support. Business can also be booked as x2 to x20 volume licences with an automatic discount, beyond 20×, Enterprise takes over with unlimited fair-use quotas.
Do prices include VAT?
Yes. All listed prices are gross and include 19 % German VAT, as required by German price-display law (PAngV). During checkout, Stripe Tax automatically applies your country’s rules: EU business customers with a valid VAT ID are billed under the reverse-charge mechanism at 0 % VAT, and consumers in other EU countries pay their local rate via the One-Stop-Shop scheme. The invoice always shows the exact tax breakdown.
Can I cancel or change my plan at any time?
Yes. Professional and Business run month-to-month (or yearly at a 17 % discount) with no minimum term, you can cancel, upgrade, or downgrade in the Stripe customer portal from your dashboard at any time. If you cancel, your account simply returns to the Free tier: the Hive plugin keeps protecting your sites locally with all sensors active, because local protection is never paywalled. Consumers additionally have the statutory 14-day right of withdrawal.
What are the SMS and mail bundles?
Bundles are one-time top-ups for the managed 2FA relay, available on Professional and higher. SMS bundles: 50 SMS for 14.90 €, 200 for 49.90 €, 500 for 99.90 €. Mail bundles: 1,000 mails for 4.90 €, 5,000 for 14.90 €, 25,000 for 49.90 € (all incl. VAT). Your monthly included quota is consumed first, then the bundle balance, and bundle credits never expire.
How are domains counted?
Every Hive installation announces its site address with each API request, and each distinct domain occupies one slot of your plan: Free covers 1 domain, Professional 3, Business 15 per licence and Enterprise is unlimited. A WordPress Multisite network counts as a single domain. Your dashboard shows the used and included domains, lets you release the slot of a retired or moved site (up to three self-service releases per 30 days), and domains that stop reporting for 60 days free their slot automatically. The count is currently informational, nothing is blocked while an account is over its allowance.
All prices include 19 % German VAT (PAngV). Reverse charge applies to EU B2B with valid VAT-ID. Stripe Tax handles country-specific calculations automatically.