Skip to main contentSkip to footer
reportedIP
Developer Documentation ReportedIP REST API & Ecosystem
API v2
API
Integrations
Linux Agent
Blocking
Tools
Support

Hooks and developer API

Stable actions and filters for webhooks, SIEM integrations and custom code, the form check for your own forms, the 2FA REST routes, the shortcodes and the database tables. Everything on this page belongs to the free plugin unless a line says otherwise.

Actions

  • reportedip_hive_threshold_exceeded( $ip, $event_type, $details ): once per confirmed sensor detection, whatever the block and report settings are. The place for a SIEM.
  • reportedip_hive_ip_blocked( $ip, $reason, $blocked_until ): an address was blocked; $blocked_until is a UTC datetime or null for a permanent block.
  • reportedip_hive_ip_unblocked( $ip ): a block was lifted.
  • reportedip_hive_report_queued( $ip, $category_ids, $report_type ): a report entered the queue, after cooldown and duplicate checks; comma-separated category ids, negative or positive.
  • reportedip_hive_access_denied( $ip, $context ): just before the 403 block page. Refusals by the pre-WordPress guard end earlier and do not reach it.
  • reportedip_hive_2fa_verified( $user_id, $method, $context ): a second factor was passed, on wp-login and on the REST route. Core wp_login fires there as well.
  • reportedip_hive_2fa_method_enabled( $user_id, $method ): a 2FA method went live for a user.
  • reportedip_hive_mode_changed( $old, $new ) and reportedip_hive_tier_changed( $old, $new ): the operating mode or the plan changed.
add_action( 'reportedip_hive_threshold_exceeded', function ( $ip, $event_type, $details ) {
    wp_remote_post( 'https://siem.example.com/ingest', array(
        'body' => wp_json_encode( compact( 'ip', 'event_type', 'details' ) ),
    ) );
}, 10, 3 );

Filters

  • reportedip_hive_rest_bypass_routes( $routes ): REST prefixes the burst sensor skips, for example a consent plugin of your own.
  • reportedip_hive_rest_sensitive_routes( $routes ): REST routes the burst sensor watches more closely.
  • reportedip_hive_scan_paths( $paths ) and reportedip_hive_decoy_paths( $paths ): extend the probe and bait path lists.
  • reportedip_hive_waf_bypass_routes( $routes ): REST routes the engine skips, matched as an anchored prefix of the resolved route. Prefer an exception in the admin for a single false positive.
  • reportedip_hive_bot_allowlist_patterns( $patterns ): user agent patterns of crawlers that are verified instead of treated as scanners.
  • reportedip_hive_event_category_map( $map ): which community category an event type is reported as.
  • reportedip_hive_reputation_block_hours( 24 ): length of the local block after a reputation hit.
  • reportedip_hive_reputation_threshold_floor( 25 ): raise the floor under the protection level; lowering it is not possible.
  • reportedip_hive_blocked_page_strings( $strings, $context ): the texts of the block page (doc_title, title, message, reason).
  • reportedip_hive_external_url( $url, $context ): replace the reportedip.com addresses the plugin links, such as the IP record or the news feed.
  • reportedip_hive_mail_provider( $provider ): your own mail provider, implementing interface-mail-provider.php.
  • reportedip_2fa_bypass( false, $user ): skip the second factor for a user; the adaptive step-up respects it too.
  • reportedip_hive_webauthn_rp_id, reportedip_hive_webauthn_allowed_origins, reportedip_hive_webauthn_user_verification: relying party, origins and user verification of passkeys.
  • reportedip_hive_form_proof_adapters and reportedip_hive_reputation_form_surfaces: the forms the form check and the community check cover.
  • reportedip_hive_tor_block_hours( 24 ): length of a Tor block, Pro add-on.

The form check for your own forms

A contact form, a booking form or any plugin form can use the invisible check instead of a CAPTCHA. Register the form as a surface, print the field where the form renders and ask for the verdict where it validates: 

add_filter( 'reportedip_hive_form_proof_adapters', function ( $surfaces ) {
    $surfaces[] = 'my_form';
    return $surfaces;
} );

// Inside the <form> element:
ReportedIP_Hive_Form_Proof::field( 'my_form' );

// When the form is submitted:
if ( ! ReportedIP_Hive_Form_Proof::passes( 'my_form' ) ) {
    // Refuse and tell the sender why.
}

passes( $surface, $strict = true ) refuses a submission without the field in strict mode; pass false while pages from an older cache may still be served. check( $surface ) returns the verdict itself. The page carries nothing request-specific, so page caches keep working.

2FA REST routes

For apps and headless front ends, namespace reportedip-hive/v1:

  • POST /2fa/challenge: user name and password, answers with a challenge token and the user's methods. 20 requests per 5 minutes per address.
  • POST /2fa/verify: token, method and code, sets the auth cookie. 30 requests per 5 minutes per address.
  • GET /2fa/methods: the active methods of the signed-in user.

The Pro add-on adds a route for the tasks of the computation check and the signed routes of the fleet management; neither is meant to be called by your own code.

Shortcodes

Every shortcode renders the same <rip-hive-banner> web component with numbers from a six-hour cache.

  • [reportedip_badge]: small badge, tone protect.
  • [reportedip_stat]: a single number, tone trust.
  • [reportedip_banner]: wide banner, tone community.
  • [reportedip_shield]: shield, tone protect.

Attributes: stat (attacks_30d, attacks_total, blocked_active, whitelist_active, logins_30d, spam_30d, api_reports_30d, reports_total), tone (protect, trust, community, contributor), color, background, label, intro. The banner builder on the Community page, Badges tab, writes the shortcode for you.

Database tables

The free plugin creates eight tables with the prefix {prefix}reportedip_hive_, on a network under the base prefix, so every decision applies network-wide. Schema version 25; each update migrates step by step. All times are UTC.

  • logs: security events with details, severity and site.
  • whitelist: trusted addresses and ranges, optionally with an expiry.
  • blocked: active blocks (manual, automatic, reputation, group) with their end.
  • attempts: counters per address and attempt type.
  • api_queue: reports waiting for the community, with retries.
  • stats: daily totals for the charts.
  • trusted_devices: 2FA device tokens as SHA-256 hashes.
  • waf_exceptions: the firewall exceptions.

The Pro add-on adds audit_log (audit trail) and group_entries (group list).

Constants

  • REPORTEDIP_HIVE_DISABLE_HIDE_LOGIN: switches Hide Login off from wp-config.php when you cannot reach the sign-in page any more.
  • REPORTEDIP_HIVE_DISABLE_FORM_PROOF: switches the form check off entirely.

Building an add-on

The free plugin publishes an extension API: the action reportedip_hive_loaded once it is ready, reportedip_hive_uninstall on removal, and filters for settings, sections, tables, scheduled tasks and the feature list. The Pro add-on is built on it alone. The plugin source and its changelog are on GitHub.

Last updated: · Maintained by the ReportedIP team

Related pages

Security Focused
GDPR Compliant
Made in Germany
Back to Docs