Troubleshooting and FAQ
The problems that come up most often and how to solve them, then the common questions. For a support request, download the support bundle on System Status and send it along.
Troubleshooting
Locked yourself out
With shell access, wp reportedip unblock <ip> --reset-attempts lifts the block and
wp reportedip whitelist add <ip> prevents the next one. Without WP-CLI, add your address to the
whitelist table through phpMyAdmin or the database console of your host; a whitelisted address wins over every
block:
INSERT INTO wp_reportedip_hive_whitelist (ip_address, ip_type, reason, added_by, is_active)
VALUES ('203.0.113.42', 'ipv4', 'Self-rescue: restore admin access', 1, 1);
Use 'ipv6' or 'cidr' as type for an IPv6 address or a range; for a rotating IPv6
connection whitelist the /64 as 'cidr'. Alternatively delete the row:
DELETE FROM wp_reportedip_hive_blocked WHERE ip_address = '203.0.113.42';. Replace wp_
with your table prefix (on a network the base prefix). If Extended Protection is on and the block persists, delete
wp-content/uploads/reportedip-hive/blocked-*.list as well; it is rebuilt on the next sync. When the
hidden sign-in address is lost, define( 'REPORTEDIP_HIVE_DISABLE_HIDE_LOGIN', true ); in
wp-config.php brings wp-login.php back.
Locked out by 2FA
Use one of the recovery codes. An administrator can reset the second factor of any user under
Users → Two-Factor, or with wp reportedip 2fa reset <user_id>. An enforced
user without a method is not locked out after the grace period but led into the setup; administrators and super
admins always take that path.
Nothing gets blocked
Check whether report-only mode is on, globally or for the firewall: it logs without blocking. Check that automatic blocking is on and that the protection level is not set too high.
Real visitors get blocked
Ask for the reference code on the block page and look it up in the log to see which rule or sensor fired. Add trusted addresses or ranges to the whitelist. When many visitors share one address, behind a carrier NAT or in an office, raise the threshold of the sensor in question. If the site sits behind a proxy and every visitor appears with the same address, the client IP header is missing, see trusted proxies.
The firewall blocks a legitimate request
Find the row on Activity and click Allow: it creates a narrow exception for that rule on that path, for both layers. See exceptions.
Extended Protection shows "not running"
Typical on nginx when the written .user.ini is not read, for example because
user_ini.filename is empty. Tools → Server offers the line for the PHP-FPM pool
or php.ini and the nginx fastcgi_param snippet, and shows whether the guard ran for the current
request. The engine inside WordPress protects the site either way.
Something stopped working after a lockdown switch
Switch the suspect back off on Firewall & Bots → Access Lockdown; it takes effect at once.
Typical cases: an app or service that still speaks XML-RPC, a headless front end or editor plugin calling the REST
API without signing in (add its namespace to the allowlist instead), a podcast or newsletter service reading the
feed, a payment provider posting into /wp-admin/. The log lists every refusal with its path.
The user sitemap is gone
wp-sitemap-users-1.xml disappears while user enumeration blocking is on, which is the default,
because it lists the user names that defence hides. Search engines do not need it; author archives can stay
public with their own switch.
Consent banner requests are blocked
The namespaces real-cookie-banner, complianz, borlabs-cookie and
cookie-law-info are skipped by default. Add another one with the filter
reportedip_hive_rest_bypass_routes.
Connection errors in the Community Network
The server must reach reportedip.com over HTTPS; some hosts block outgoing connections. Check the key
with Test Connection on the Community page and the status in your
account. A slow service never blocks a sign-in: lookups
fail open.
The daily checks run out
Raise cache_duration under Operations → Performance & Footprint, set an
hourly cap, or move to a plan with more checks. The dashboard shows quota and queue.
The Pro add-on stays inactive
The add-on works only next to an active free plugin from version 3.0.0 on and shows a notice when that is missing. It also needs a key on a paid plan; without one the features stay locked and updates are not delivered.
Frequently asked questions
Is ReportedIP Hive free, and do I need an account?
The plugin is free under the GPL and works without an account in Local Shield. A free account adds the community check and the synced rulesets. The Pro add-on is for paid plans.
Will it slow down my site?
A blocked address is refused at the start of the request, before themes and most plugins load. The block check is one indexed query, the whitelist is cached per request, and reports leave in the background by WP-Cron.
Can I use it next to another security plugin?
Yes, but switch off overlapping features. Two plugins that both limit sign-in attempts or both ask for a second factor lock users out twice, so keep one of each.
Does it work with WooCommerce?
Yes. The WooCommerce sign-in and registration forms count like wp-login.php and run through the registration rules. The second factor inside the storefront comes with the Pro add-on.
Does it work behind Cloudflare?
Yes. Choose CF-Connecting-IP as the client IP header and list the Cloudflare ranges as trusted proxies, so the header cannot be faked.
Do I still need a CAPTCHA?
Usually not. The invisible form check stops scripted submissions on comments, sign-ups, password resets and Contact Form 7 without a puzzle for your visitors, and the add-on extends it to further form plugins.
Can I import settings from another site?
Yes, on Tools → Data as a JSON file of up to 512 KB. The access key and 2FA secrets are not part of the export.
Does it scan for malware?
No. Hive does not scan files and does not watch file integrity. Run a scanner next to it if the site needs one.
Where is the source code?
On GitHub and in the wordpress.org repository of the plugin. Security issues go to abuse@reportedip.com, not into a public issue.
Last updated: · Maintained by the ReportedIP team