Protection settings
Every setting of Hive sits on one page, ReportedIP Hive → Protection. This page explains its structure, the defaults that matter most, the access lockdown switches, the security headers, the proxy settings and the readiness register that watches the parts of an installation that fail quietly.
The five tabs
| Tab | Areas |
|---|---|
| Core protection | Detection & Thresholds, Blocking & Escalation, Hide Login, Two-Factor Authentication, Password Policy |
| Forms | Form Protection, Registration Rules |
| Firewall & Bots | Firewall & Bots, Access Lockdown, Security Headers |
| Advanced | Attack Response (hardening mode) and Adaptive Step-Up, both from the Pro add-on |
| Operations | Privacy & Logs, Notifications, Performance & Footprint |
Each area shows a short status, its day-to-day switches as rows and its expert settings behind Show technical details. Expert mode in the page header opens the details by default. A search box spans every tab. Each tab carries Save changes and Restore defaults; the latter writes the recommendation for your plan. Check protection runs the readiness register at once and reports the result on the page. A feature of the Pro add-on that your site does not have appears as a row with the plan it belongs to, not as a switch.
What is not a setting lives on Tools: the Server tab (Extended Protection and the web server snippets), Rules (rule sync and firewall exceptions), Data (import, export, reset, uninstall behaviour) and Diagnostics (test mail, form check self-test). Tools is listed in the menu in expert mode and always reachable by its address.
Every option has one entry in a settings registry with its range, its plan and a one-sentence description. The Protection page, the quickstart, the JSON import, MainWP and the fleet management of the Pro add-on all write through it, so a value is checked the same way wherever it comes from.
The most important defaults
| Setting | Default | Meaning |
|---|---|---|
operation_mode | Local Shield | Local Shield or Community Network; the quickstart sets it. |
block_threshold | 75 % | Community confidence from which an address is refused. It cannot go below 25 %. |
failed_login_threshold / _timeframe | 5 / 15 min | Failed sign-ins per address before a block. |
comment_spam_threshold / _timeframe | 3 / 24 h | Spam comments per address before a block. |
scan_404_threshold / _timeframe | 12 / 2 min | 404 responses per address before a scanner block. |
xmlrpc_threshold / _timeframe | 10 / 60 min | XML-RPC calls per address before a block. |
rest_threshold / _timeframe | 240 / 5 min | Anonymous REST requests per address; consent banner routes are skipped. |
block_duration | 24 h | Fixed block length while the escalation ladder is off. |
block_escalation_enabled / block_ladder_minutes | On / 5, 15, 30, 1440, 2880, 10080 | The escalation ladder in minutes. |
report_only_mode | Off | On: every sensor logs and reports but never blocks. |
data_retention_days | 30 | Days the security log is kept. |
auto_anonymize_days | 7 | Days after which address and user agent of a log row are anonymised. |
cache_duration / negative_cache_duration | 24 h / 2 h | Cache for positive and negative reputation lookups. |
max_api_calls_per_hour | 0 | Optional cap per hour; 0 means bound only by the plan. |
password_min_length | 12 | Minimum password length for the roles the policy covers. |
2fa_enforce_roles | administrator | Roles that must use a second factor. |
2fa_enforce_grace_days | 7 | Days before enforcement leads into the forced setup. |
2fa_trusted_device_days | 30 | How long a trusted device skips the second factor. |
hide_login_enabled / _response_mode | Off / block page | Custom sign-in address; the old one answers with a block page or a 404. |
All option names carry the prefix reportedip_hive_.
Access lockdown switches
Switches under Firewall & Bots → Access Lockdown that turn off parts of WordPress a site does not use. All are off by default and take effect at once when switched back.
- REST API access: open, signed-in visitors only, or selected roles. Namespaces on the allowlist stay public in every mode, seeded with the ones that break otherwise (
oembed/1.0,wp-site-health/v1, the common consent banner and form namespaces, the WooCommerce Store API);reportedip-hive/v1always stays open so the 2FA routes keep working. Guests get 401, signed-in users outside the role list 403. - XML-RPC: refuses
xmlrpc.php, switches pingbacks off, drops theX-Pingbackheader and removes the RSD and WLW links. Application passwords over REST are not affected. - Feeds: RSS, Atom and comment feeds answer 404 and their links leave the page head.
- wp-admin for visitors: refuses
/wp-admin/to visitors who are not signed in, together with the/adminand/dashboardaliases.admin-ajax.phpandadmin-post.phpstay reachable. Hide Login closes wp-admin for visitors as well. - PHP execution in uploads: a marker block in the uploads
.htaccessrefuses PHP-like file names, includingshell.php.jpg. Apache only; nginx and unknown servers get the snippet to paste. - Software fingerprints: removes the WordPress generator tag and the version strings plugins print into the page. Version numbers stay derivable from asset addresses, so this is cosmetic. Turning PHP error display off together with it is part of the Pro add-on.
The user sitemap (wp-sitemap-users-1.xml) disappears while Block user enumeration
is on, which is the default, because it published the list that defence hides. Refusals are logged once per
address and event with a five-second throttle (rest_denied, xmlrpc_denied,
feed_denied, admin_guest_denied). They never trip the block ladder and are never
reported: this is access control, not attack detection.
Security headers
Response headers on every front-end request. A header your server or another plugin already sends is left alone.
- Basic, free:
X-Content-Type-Options,X-Frame-Options,Referrer-Policy. - Advanced, Professional with the Pro add-on: HSTS (preload optional),
Permissions-Policy, a Content-Security-Policy builder (report-only first) and the cross-origin trio COOP, CORP and COEP.
The Server tab on Tools can export the configured headers as nginx add_header or Apache Header lines.
Cloudflare, reverse proxies and load balancers
Behind a proxy the connecting address is the proxy, and the visitor address travels in a header. Select that
header under Core protection → Detection & Thresholds → Client IP header:
CF-Connecting-IP, X-Forwarded-For, X-Real-IP, Client-IP,
True-Client-IP or X-Cluster-Client-IP. Then list the proxy addresses under
Trusted proxy ranges, one address or CIDR range per line, for example the published Cloudflare
ranges.
With the list in place the header counts only for requests that come from a listed proxy, so nobody who reaches the origin directly can claim a whitelisted address or shed a block. An empty list accepts the header from every peer and raises a readiness warning. The pre-WordPress guard applies the same check.
System readiness
Detectors watch what fails without a sound. Open issues appear on System Status with their
severity, when they first appeared, a link to the responsible setting and a link here. Critical issues and
warnings also raise one notice on the plugin pages, the wp-admin widget shows the count, and
wp reportedip status lists them in its issues field. Warnings and suggestions can be put
aside for seven days; critical issues stay until they are fixed.
- Guard queue not writable (critical). Extended Protection is on, but the pre-WordPress guard cannot write its hit queue, so its blocks are never imported and never escalate. Fix the permissions of the directory named in the message, or switch Extended Protection off.
- Scheduled tasks stalled (critical). Every Hive cron task is more than 24 hours overdue: report queue, rule sync and cleanup are frozen. Usually a broken WP-Cron loopback; set up a system cron and define
DISABLE_WP_CRON. - WP-Cron disabled without a replacement (warning).
DISABLE_WP_CRONis set,ALTERNATE_WP_CRONis not, and no external trigger has run for over an hour. - Client IP header without proxy ranges (warning). The header is honoured for every peer, so a direct visitor could fake an address. Add your proxy ranges under Detection & Thresholds.
- Database schema outdated (critical). The stored schema is behind the plugin, usually after an aborted migration. Reloading a plugin page retries it.
- Community connection degraded (warning). Many recent requests to reportedip.com failed. Check outbound HTTPS and the access key.
- Mail relay allowance used up (warning, Pro add-on). 2FA mails fall back to
wp_mail()until the monthly reset or a top-up bundle. - SMS relay allowance used up (warning, Pro add-on). Users with SMS as their only method should add a second one.
- Mail delivery failing (warning). WordPress reported repeated
wp_mail_failederrors, so codes and alerts do not arrive. Check the SMTP setup. Recipient addresses are removed from the stored message. - No encryption backend (critical). Neither libsodium nor OpenSSL is available, so 2FA secrets cannot be encrypted. Ask the host to enable one of them.
- Report queue has failed entries (warning). Reports used up their retries. Retry them on the API Queue tab of the Activity page.
- Report queue backlog (warning). Pending reports pile up, which points at the cron or the connection. Both queue checks stay quiet in Local Shield and without a key.
- Sign-in address still public (suggestion). Hide Login is off. The card takes a slug and switches it on in one step.
- Storefront 2FA available but off (suggestion, Pro add-on). The site runs WooCommerce and the plan includes the themed customer challenge.
- Extended Protection possible but not running (suggestion). The server supports the pre-WordPress guard, so blocked requests could end before WordPress boots.
- Local Shield instead of the community (suggestion). The site protects itself but neither asks the network nor contributes to it.
- Form plugin not covered yet (suggestion). A supported form plugin is active and Hive could check it, but its switch is off. One suggestion per plugin.
- Groups included but not used (suggestion, Pro add-on). The plan includes groups and this key is in none. The card opens Groups in your account; Groups explains them.
- Your own second factor is missing (suggestion). 2FA is on for the site and the account looking at the page has no method. Raised per person.
- Footer badge off. No longer raised since 3.0.0: the badge is optional and stays off unless you switch it on.
Support bundle. System Status also offers one JSON file for a support check: versions, the
settings that differ from the defaults, readiness, cron, API health, the report queue, the events of a chosen
period (1, 7, 14 or 30 days) and the active blocks. It contains no access key, password, user name or mail
address, and addresses are cut to their network unless you ask for full ones. The same file comes from
wp reportedip support-bundle and from the MainWP extension.
Protection score
Two dashboard gauges rate detection coverage and hardening from 0 to 100 with a grade from A+ to F. Every item links to the switch that raises it. Features your plan does not include count toward the visible potential, not against the score, so the free plugin can reach the top grade.
Last updated: · Maintained by the ReportedIP team