Dashboard, logs and audit trail

What Hive blocked, why, and who changed what on the site. The dashboard and the activity log are part of the free plugin on every plan, with real numbers. The audit trail and the account control come with the Pro add-on on the Business plan.

The dashboard

ReportedIP Hive → Dashboard opens with the status line and the next steps described on Quickstart and modes, then a strip with attacks blocked in 30 days and today, addresses currently blocked and how many protection layers are on.

• Security events: a timeline over 7, 30 or 90 days in seven families: sign-in and credentials, firewall, scanners and probes, fake bots, reconnaissance and enumeration, spam and flooding, anomalies.
• Threat distribution and top attack types of the firewall by rule group.
• Severity: critical, high, medium and low counted separately.
• Top attackers of 30 days with hits, last seen and whether they are blocked.
• Recent activity with severity, family and the detail that matters, such as the matched rule or the probed path.
• News from reportedip.com in the admin's language, loaded only in the Community Network.

The same numbers appear in a widget on the WordPress dashboard, with the open readiness issues. On a network the widget shows on the network dashboard and, for super admins, on the site dashboards.

The Activity page

Activity opens on the event log behind a filter bar whose state stays in the address, so a filtered view can be bookmarked. The event filter can be searched and selects single events or whole groups. Further tabs hold the IP lists (blocked addresses, the whitelist and, with the Pro add-on, the group list), the firewall log with the Allow action and the API queue with a retry button. Lists can be exported as CSV, and every IP address links to its record on reportedip.com.

The log keeps 30 days by default, adjustable under Operations → Privacy & Logs; addresses and user agents are anonymised after 7 days. On a network the Network Admin sees every site with a site filter, and each site administrator sees the rows of their own site.

Alerts and notices

Alert mails go to the site admin address or the recipients you set under Operations → Notifications. Notices on the plugin pages can be closed: the rate limit notice returns after an hour, the 2FA reminder, the missing key, the domain limit and the queue warning after a day. A critical queue state and a critical readiness issue stay until they are fixed.

Footer badge and banners

The "Protected by ReportedIP" badge is optional and off until you switch it on in the quickstart or on the Community page, Badges tab. The same tab has a banner builder with six templates (footer badge, shield, threat counter, community banner, contributor, login shield) that writes the shortcode for you. The numbers come from a six-hour cache, never from an API call per page view; the attributes are on Hooks and developer API.

Audit trail

Part of the Pro add-on on the Business plan. The audit trail records who changed what, in eight trigger groups, each a switch under Operations → Privacy & Logs:

• Sign-ins and sign-outs, off by default, because failed attempts are in the security log anyway.
• User accounts: registration, deletion, profile, e-mail and password changes, role changes, password resets, account blocks, ended sessions, edited role capabilities.
• Pages and posts: published, unpublished, trashed, restored, deleted, address changed. Autosaves and revisions are left out.
• Plugins, themes and core: installed, updated, activated, deactivated, deleted, theme switched, core updated, with the version before and after.
• Site settings: 26 core options and every Hive setting with the old and the new value.
• Menus and widgets.
• File editor: a theme or plugin file saved through the built-in editor, when it really changed.
• Network (multisite): sites created, changed or deleted, users added to or removed from a site, super admin granted or revoked.

Each row names the acting user, the channel (browser, WP-CLI, cron, REST, AJAX, XML-RPC) and the affected object. Values of keys that name a password, token, key or code are never written. Retention is 90 days by default, from 1 to 365. The Activity tab filters by event, group, user, address, object and date, and exports CSV and JSON. On a network every site administrator has an Audit Trail page with the rows of their site. Without the plan the tab shows a few sample rows and records nothing.

Account control and sessions

Part of the Pro add-on on the Business plan. An account can be blocked without deleting it: from the profile, the Users list (column, view and bulk action) or with wp reportedip user block, with an optional message shown at sign-in and an internal note. A blocked account keeps its content but cannot sign in, use an application password or reset its password; its sessions and trusted devices end at once. Blocking yourself, a super admin or the last administrator is refused.

A block stays enforced by the free plugin when the plan ends or the add-on is removed, and lifting it is always possible, with the add-on from the profile and without it through wp reportedip user unblock. Users → Sessions lists the active sessions of every user with sign-in time, expiry, address and device, and ends a single session or all of a user's; your own current session is never offered.

Last updated: 16. October 2026 · Maintained by the ReportedIP team