Installation and updates
ReportedIP Hive comes from the WordPress plugin directory and is complete on its own. Sites on a paid plan add the ReportedIP Hive Pro add-on from their reportedip.com account. This page covers both, how updates arrive, the move from version 2.x, MainWP and multisite networks.
Install the free plugin
Install
In wp-admin go to Plugins → Add New, search for "ReportedIP Hive" and click Install Now. For a manual upload, download reportedip-hive.zip and choose it under Plugins → Add New → Upload Plugin.
Activate
Click Activate. On a multisite network, activate it network-wide in the Network Admin; activation per site is not offered.
Run the quickstart
The quickstart opens under ReportedIP Hive. Pick Local Shield or Community Network and switch protection on. See Quickstart and modes.
Set up your own second factor
With 2FA for administrators switched on, your own setup starts right after the quickstart. It also lives on your profile page.
Activation writes nothing into .htaccess. The two optional blocks (bait-path responses and
PHP execution in uploads) are written after an action of yours: the quickstart, saving one of the two
switches, a settings import or WP-CLI. On nginx the plugin shows a snippet to paste instead.
Add the Pro add-on
The add-on is only needed on the Professional, Business or Enterprise plan. It is not hosted on wordpress.org.
- Open Hive Plugin in your reportedip.com account and click Download Hive Pro. The button appears when your plan includes the add-on.
- Upload
reportedip-hive-pro.zipunder Plugins → Add New → Upload Plugin and activate it, network-wide on a multisite network. - Enter your Community Access Key in the quickstart or on the Community page, if it is not stored yet. The add-on reads the plan from the key check and switches on what the plan covers.
When the free plugin is missing, the add-on installs it from wordpress.org and activates it. While the free plugin is inactive, older than 3.0.0 or on another extension API, the add-on stays inert and shows a notice with the next step. Deactivating the add-on keeps its settings, the user data and the audit trail; only the group ban list is released and synced again after reactivation.
How updates arrive
| Plugin | Source | What it needs |
|---|---|---|
| ReportedIP Hive | wordpress.org, on the Plugins screen like any plugin from the directory, automatic updates included | Nothing |
| ReportedIP Hive Pro | reportedip.com, checked every 12 hours and shown on the same Plugins screen | A Community Access Key on a paid plan. Without one the new version is listed, but the package is not delivered |
Plugins → Check for updates on the add-on row forces an immediate check. The add-on sends the key only to reportedip.com and does not follow redirects there.
Coming from an older version
Up to 2.1.74 the plugin was a single download from GitHub with every feature inside. Those sites received
3.0.0 as one last update through the old channel. It switched them to the free plugin from wordpress.org
and, where the plan includes it, installed the Pro add-on on the next scheduled run. Settings, block and
whitelist entries, 2FA methods and security keys, audit rows and the quickstart state are kept. The
.htaccess blocks of a site with a completed quickstart stay in place. A paid site that shows
a notice about the missing add-on after the update gets it from the account page as described above.
A site that still runs version 1.3 of the plugin from wordpress.org receives 3.0 as a normal update. Whitelist entries (ranges and permanent entries included), blocks, attempt counters, the proxy header and the settings are carried over; on a network where it ran per site, the data of every site moves into the network tables. Open the quickstart afterwards to choose the mode.
MainWP
The free plugin carries the MainWP bridge itself, so no separate child plugin is needed: install MainWP Child and Hive on the site and connect it to your dashboard as usual. The ReportedIP extension for the MainWP dashboard shows the protection state of every child site, pushes settings policies and can install ReportedIP Hive Pro on child sites with a paid plan. It is available on request from 1@reportedip.com. What the sync transmits is described under MainWP integration.
Multisite networks
Hive is network-only (Network: true), so the protection is the same on every site. All tables
live under $wpdb->base_prefix: failed sign-ins on every sub-site count into one row, and one
block keeps the address out of the whole network.
- Network Admin: every setting, the logs of all sites with a site filter, whitelist, blocks and firewall exceptions.
- Site administrators: read-only status and logs of their own site, the audit trail of their site (Business, with the add-on), and two settings of their own: the storefront 2FA address and additional roles that must use 2FA. A site can add roles, never drop one the network requires.
- Scheduled tasks run on the main site only, with a self-heal when the main site changes.
- The add-on is activated network-wide as well.
Requirements
| Needed | Notes |
|---|---|
| WordPress 5.9 or newer | Tested up to 7.1. |
| PHP 8.1 or newer | libsodium or OpenSSL for the encrypted 2FA secrets; one of the two is present on almost every host. |
| MySQL 5.7+ or MariaDB | All times are stored in UTC, whatever the server time zone is. |
| Working WP-Cron or a system cron | For the report queue, the rule sync and the cleanup. A stalled cron shows up in the readiness register. |
| Outbound HTTPS to reportedip.com | Only in Community Network mode and for the add-on updates. |
| WooCommerce | Optional. Its sign-in and registration forms are protected when it is active. |
Last updated: · Maintained by the ReportedIP team