Changelog

What each release changed, in short. The full history of the free plugin is in its changelog on GitHub and on the wordpress.org plugin page; the add-on lists its changes on the Plugins screen when an update arrives.

Release highlights

• 3.0.0: Hive is now a free plugin from the WordPress plugin directory, complete and without locked switches; the features of the paid plans moved to the separate ReportedIP Hive Pro add-on, which updates from reportedip.com and installs the free plugin when it is missing. Sites on 2.1.x moved over with one last update and kept every setting. Local Shield sends no request to reportedip.com even with a key stored, .htaccess blocks are written only after an action of the operator, the breach check and the footer badge are off until switched on, notices can be closed, and a security key assertion can only be used once. Database schema 25.
• 2.1.74: Sensor counters run on their configured window instead of adding up over days, a slow community service pauses live lookups for two minutes instead of slowing every sign-in, DuckDuckBot can crawl again, an empty queue run no longer writes a log row, and a firewall hit on admin-ajax.php names the AJAX action.
• 2.1.73: A support bundle on System Status, as one JSON file for a support check, also through WP-CLI and MainWP. A Gravity Forms submission the form itself turned down no longer spends the form check. Blocked addresses no longer fill the log with firewall rows, a block the plugin set by itself is lifted when the network vouches for the address, Local Shield no longer asks for the relay quota, CSV exports quote correctly and dates follow the site language.
• 2.1.72: Disposable mail addresses are refused on comments and on every protected contact form, with a setting of its own that blocks by default. A form left open longer than ten minutes is no longer refused: the browser replaces its answer to the form check before it runs out. A crawler proven by its published address range (OAI-SearchBot asking for a bait path) is no longer blocked and reported, and a report the network refuses because it vouches for the address leaves the queue at once. Bulk actions work again after filtering a list, and Extended Protection on the Tools page is one card with one status and one button.
• 2.1.69–2.1.71: The Protection page in five tabs with switch rows, plan rows, folded details, a reset to the recommendation and a protection check. Hive stays visible to the wordpress.org update check, so installations are counted. On a network with a domain per site, admin links to another domain lead through that domain's login instead of the block page.
• 2.1.68: The bundled offline ruleset now also blocks error-based SQL injection and second-order SQL injection through the trackback body, so a site in Local Shield mode is covered as well. Priority Sync starts with Contributor: the Paranoia Level 2 ruleset and the bot IP-range feeds, refreshed weekly; Level 3 and the daily refresh stay with Professional. The audit trail stores the browser identification only while "Log user agents" is on, the same switch as the security log.
• 2.1.67: Group bans: a key that belongs to a group on reportedip.com mirrors the group list every fifteen minutes as blocks of the type Group Ban, lifted when an entry leaves the list, with the whitelist and manual blocks untouched. The Community page shows the group and the community reputation of the address this site connects from. A comment from a browser that never ran the script is refused at the door like every other protected form, and a link in the comment text counts like one in the website field.
• 2.1.66: Form protection reaches Forminator (Business), whether the form sits in the page or is loaded afterwards. A filled decoy field is now blocked and reported on the first try instead of the third: nobody can see that field, so filling it takes a machine, and waiting for two more attempts only gave the sender two free runs. A visitor whose browser never ran the script is untouched by this and is still only refused. A trusted address on your allow list can no longer be blocked by a check that acts this quickly, and the report sent to the community now names the form or the signals instead of reading "suspicious activity".
• 2.1.65: Form protection reaches WPForms and WPForms Lite (Business), on the page-load path and the background path alike. A refused Elementor submission no longer sends the form mail: Elementor stops a submission only on a field error, so a refusal given as a message alone let the mail go out and reported the failure afterwards. Sign-ups through Ultimate Member are no longer refused when a person filled the form in.
• 2.1.63: Form protection reaches Gravity Forms (Business), including forms sent in the background and forms with several pages; a refused submission is a validation error the sender sees, never a silent entry in the spam folder. Contact Form 7 protection is included in every plan, Ultimate Member moves to Business. The firewall's traversal rule now matches the double-encoded shape behind the WordPress 7.1.2 template fix.
• 2.1.62: The audit trail records who changed what: eight trigger groups (accounts, pages and posts, plugins and themes, settings with old and new value, menus and widgets, the file editor, the network) with the acting user, the request agent and the affected object, switches per group, 90-day default retention with a chunked sweep, a site filter for networks and an Audit Trail page for every site administrator. Every event type lives in one registry; the event log filter can be searched and selects whole groups, and form spam is back in the charts.
• 2.1.58–2.1.61: The form execution proof can demand a computation (Professional), a captcha replacement your own forms can use through a small API; Contact Form 7 and Ultimate Member are covered on Professional, Formidable Forms and Elementor Forms on Business; the comment spam filter reads eight more signals; the form settings got a card of their own and every setting names the plan it belongs to.
• 2.1.57: The Activity page opens on the event log behind a bookmarkable filter bar, the Community page splits into Settings, Community and Badges (one-click footer badge plus banner builder), the dashboard carries one status line and collapsed protection areas, and the report-queue readiness issues stay quiet while nothing can send them. A rejected access key no longer counts as a failed sample in the API health window.
• 2.1.56: The Settings and Firewall pages were replaced by one Protection page (a card per registry area, search, simple and expert depth, one apply service shared with MainWP, the fleet and the import) and a Tools page for the drop-in, rule sync, WAF exceptions, import, export, reset and the test mail. The dashboard gained a status banner, next-step cards from six advisory readiness detectors and a row per protection area. Old settings and firewall addresses redirect.
• 2.1.54–2.1.55: The setup wizard became a one-page quickstart that reads the plan from the key check and applies a plan-aware recommendation through the settings registry; a later plan upgrade switches on what the new plan recommends for untouched values. Every stored setting now follows one standard, and the dashboard shows the latest news from reportedip.com in the admin's language.
• 2.1.52–2.1.53: Comment and form defence. A scored comment spam filter of around twenty signals (a comment waiting for moderation is no longer a spam verdict), a cache-safe form execution proof on comment, sign-up and password-reset forms, and the community threat check extended from the sign-in page to those same three forms. Free on every plan.
• 2.1.51: Five new protections. Registration defence (prohibited usernames, e-mail rules, a per-IP sign-up rate limit, an opt-in block for sign-ins against usernames that do not exist), access lockdown switches for REST, XML-RPC, feeds, wp-admin, PHP in uploads and version fingerprints, and a system readiness register with twelve detectors, all free on every plan. Blocking an account plus the session manager under Users → Sessions on Business, adaptive two-factor step-up triggers per role on Professional. Seventy options moved into the settings registry (169 in total, all described, 71 remotely manageable), settings import can no longer bypass the sanitiser, and hardening mode now clamps thresholds on the WooCommerce and application-password login surfaces as well.
• 2.1.48–2.1.50: Cloud Fleet Management (Business) over three Ed25519-signed REST routes with a freshness window, single-use request IDs and audience binding, opt-in and off by default. A 25 % floor under the community-confidence block threshold with migration v16 lifting stored sub-floor values, and full IP management on WP-CLI (whitelist, block, unblock, blocked list, attempts reset) alongside wp reportedip status.
• 2.1.42–2.1.47: The security and correctness audit: admin-ajax.php brought inside the block gate and the firewall, single-use TOTP codes, a WAF exception that no longer masks the rules behind it, percent-encoded probes matched by three more sensors, and forty-two AJAX handlers on one shared permission guard. Plus a wp.org-style installation identity on every API request, a licensed-domains card on the dashboard, the canonical settings registry with its versioned remote protocol, and plugin updates visible to MainWP and ManageWP again.
• 2.1.37–2.1.41: Opt-in Tor exit-node blocking (Professional, signed tor_exits ruleset), trusted-proxy source ranges against forwarded-header spoofing, a security widget on the wp-admin dashboard, a never-block veto for community-verified infrastructure, a richer IP lookup with wp reportedip lookup, stable integrator hooks (reportedip_hive_threshold_exceeded), race-safe attempt counters (schema v15), plus a stricter firewall: crawler exemptions require a verifiable signal, payload rule groups block on the first hit, release builds ship the bundled rulesets again, and four rules close the CVE-2026-64638 (XSS2Shell) login-screen chain. Domain moved to reportedip.com.
• 2.1.33–2.1.36: Official YubiKey / hardware security-key support: full WebAuthn ceremonies on all three challenge surfaces, a multi-key manager with attestation-based model detection (Business), cloned-key detection via signature-counter regression with mail alerts on every plan, Ed25519 when libsodium is available, and a rebuilt plain-language profile 2FA section with a user-selectable default method.
• 2.1.26–2.1.32: Verified-crawler cross-checking (a spoofed Googlebot user-agent buys nothing), a central never-block-a-verified-bot guard, community-reputation blocks that cover every surface, self-block prevention for the server's own addresses, volume-weighted block escalation, and the performance release: 36 → 11 queries per request, an 8 KB blocklist header read and dashboard TTFB 920 → 278 ms (schema v13).
• 2.1.25: The WAF blocks the WordPress-core REST batch route-confusion attack class on every plan (structural rules, not token matching), inspects a decoded copy of the request body (closing an encoded-payload bypass), and Paranoia-Level-2/3 blocks render their specific reference category.
• 2.1.22–2.1.24: Enforced 2FA defaults to forced enrolment instead of a lockout (admins and super admins can never be hard-locked out); a duplicate submit of the 2FA challenge no longer strands users on "session expired"; the PHPUnit eval-stdin.php RCE probe (CVE-2017-9841) is blocked on every plan.
• 2.1.14–2.1.20: Production-hosting correctness: UTC-consistent datetimes (auto-blocking silently failed on non-UTC database servers), hidden login works behind page caches and on trailing-slash/nginx sites, Extended Protection auto-configures on nginx + PHP-FPM and skips body inspection for signed-in editors, API health uses a rolling window, and hot-path relay-quota polling was eliminated.
• 2.1.9–2.1.13: Backend-managed WAF exceptions with a one-click "Allow" action (schema v10), self-explanatory block logging (matched value, target, method, URI, user-agent), MainWP provisioning can switch sites into Community mode, and the security dashboard became a full analytics view (seven threat families, WAF rule-group chart, top attackers).
• 2.1.0–2.1.8: The firewall release: a server-delivered, Ed25519-signed Rule Delivery Framework feeding a request-inspecting Web Application Firewall (free engine + Paranoia-Level-1 baseline, PRO Level 2/3 via Priority Sync), verified-bot detection, disposable-email blocking, a comment honeypot, security response headers (basic free, advanced PRO), a dashboard protection & hardening score, block-page reference codes (X-RIP-Ref), the Business audit event trail (schema v9), MainWP integration and a Firewall admin area, followed by false-positive fixes for genuine crawlers and the fail-safe drop-in removal.
• 2.0.x: Network-wide multisite activation (Network: true), per-blog tier management, tier-upgrade banners, app-password & geo-anomaly monitors hardened, WooCommerce frontend 2FA opens to PRO+, coordinated-attack Hardening Mode, decoy-path detect-and-report.
• 1.5.2: Cache-plugin compatibility on the 403 page; 2FA throttle graduates to real escalation block; init priority 1.
• 1.5.1: Blocking-tab clarity (Report-only > Auto-blocking > duration strategy); fixed-length and ladder editors swap inline.
• 1.5.0: Progressive block escalation (5 m → 7 d ladder); cookie-banner endpoints bypassed by default; 404/comment-spam defaults relaxed.
• 1.2.4: API-queue "Retry" button now actually fires the API call.
• 1.2.0: Seven new sensors: app-password monitor, REST-burst monitor, user-enumeration block, 404/scan detector, geo-anomaly, password strength, hide-login URL.
• 1.1.0: Central mailer with brand template.
• 1.0.0: Initial public release: IP blocking, 4-method 2FA, setup wizard, list tables.

Last updated: 16. October 2026 · Maintained by the ReportedIP team