Looking for an overview? Visit the Plugin landing page for features, pricing, and install steps. This page is the technical reference.
WordPress Plugin: ReportedIP Hive
ReportedIP Hive is a WordPress security plugin: a web application firewall, login security with limited login attempts, two-factor authentication with passkeys, and spam protection for comments, sign-ups and contact forms. It blocks attackers on your own server, works without an account, and can optionally check and share attacking addresses through the ReportedIP community network.
Current version: 3.0.0, free from
wordpress.org/plugins/reportedip-hive.
Requirements: WordPress 5.9 or newer (tested up to 7.1), PHP 8.1 or newer.
On a multisite network it is activated network-wide. The source code is on
GitHub under GPLv2 or later.
Two plugins, one protection
Since version 3.0.0 Hive consists of a free plugin and an optional add-on. Everything that protects the site sits in the free plugin, with no trial and no locked switch. The add-on carries the features of the paid plans.
| ReportedIP Hive | ReportedIP Hive Pro | |
|---|---|---|
| Who needs it | Every site | Sites on the Professional, Business or Enterprise plan |
| Where it comes from | The WordPress plugin directory | Your reportedip.com account; it installs the free plugin by itself when that is missing |
| Updates | From wordpress.org, like any plugin from the directory | From reportedip.com, checked every 12 hours with your Community Access Key |
| What it brings | Firewall, sixteen sensors, login security, 2FA with app, e-mail and one passkey per account, form protection, Contact Form 7, registration rules, lockdown switches, Community Network | Mail and SMS relay, storefront 2FA, adaptive 2FA policies, hardening mode, advanced headers, computation check, further form plugins, Tor blocking, audit trail, account control, group bans, fleet management |
The details per plan are on Pro add-on and plans. Hive runs in one of two modes: Local Shield decides everything on your server and sends nothing anywhere, Community Network adds the reputation check against the community and shares what your site blocks. See Quickstart and modes.
How a request is checked
Hive applies its checks in a fixed order, and each layer can end the request before the next one runs. The
gate is hooked on init at priority 1, so other plugins do not run for a blocked address.
- Whitelist: trusted addresses and ranges always pass.
- Block list: addresses you blocked by hand or that crossed a threshold.
- Web application firewall: the active ruleset against URI, query, body and user agent, optionally already before WordPress loads.
- Attempt counters: sign-ins, comments, XML-RPC, REST bursts and 404 scans block an address once a threshold is reached.
- Community reputation: in Community Network mode an address above the protection level is refused.
- Second factor: protected accounts confirm the sign-in with 2FA.
The guide
Installation and updates
The free plugin from wordpress.org, the Pro add-on, the update from 2.x, MainWP, multisite and the requirements.
Quickstart and modes
The two modes, the access key, what the recommendation switches on per plan, and the dashboard after setup.
Protection settings
The five tabs, the main defaults, lockdown switches, security headers, trusted proxies and every readiness issue.
Sensors and blocking
The sixteen sensors and their thresholds, the escalation ladder, reputation blocks, verified bots, Tor and group bans.
Firewall and WAF
The two firewall layers, signed rule delivery, Priority Sync, the pre-WordPress guard, exceptions and reference codes.
Login security and 2FA
The methods, passkeys and YubiKeys, enforcement per role, recovery, storefront 2FA and adaptive policies.
Forms and spam
The invisible form check, the form plugin adapters, the comment spam filter, disposable mail and registration rules.
Dashboard, logs and audit trail
The dashboard and its charts, the activity log, the badges, the audit trail and account control.
Pro add-on and plans
What the Pro add-on adds per plan, quotas and domains, the mail and SMS relay, MainWP and fleet management.
WP-CLI commands
IP lists, lookup, status, the support bundle, 2FA administration, account blocks and the hardening mode.
Hooks and developer API
Actions and filters, the form check API, the 2FA REST routes, shortcodes, tables and constants.
Privacy and external services
What is stored and for how long, every external request, the privacy tools and what an uninstall removes.
Troubleshooting and FAQ
Locked out, wrong blocks, firewall false positives, the guard, API errors, 2FA and the common questions.
Changelog
What each release changed, from 1.0 to the free plugin and the Pro add-on in 3.0.0.
What it does not do
Hive does not scan files for malware and does not watch file integrity. Run a scanner next to it if your site needs one. It also works next to a cloud firewall: the cloud filters traffic before it reaches the server, Hive sees what only WordPress knows, such as failed sign-ins, tried user names, form submissions and user roles. Set the proxy header so Hive sees the real visitor address (trusted proxies).
Last updated: · Maintained by the ReportedIP team
Security Focused
GDPR Compliant
Made in Germany