Hive Light on WordPress.org: free login protection for WordPress
Update 16 October 2026: Since version 3.0.0, Hive Light has merged into ReportedIP Hive and is no longer offered as a separate plugin. Existing installations receive ReportedIP Hive as a normal update through WordPress.org and keep their whitelist, blocks and settings. Current information is in the ReportedIP Hive documentation.
ReportedIP Hive Light is a free login protection plugin for WordPress, listed in the official WordPress.org plugin directory since 17 May 2026. It counts failed logins per IP address, blocks attackers on a rising ladder from 5 minutes to 7 days and works without an account.
You can install it from Plugins → Add New Plugin in your WordPress admin. This post was updated on 29 September 2026 for version 1.3.7.
What is ReportedIP Hive Light?
Hive Light is the WordPress.org edition of ReportedIP Hive. It does one job: it protects the standard WordPress login against brute-force and password-spray attacks. The plugin is licensed under GPL-2.0 or later, costs nothing and keeps none of its functions behind a paid plan.
| Detail | Value |
|---|---|
| Current version | 1.3.7 |
| Requires WordPress | 6.1 or later |
| Tested up to | WordPress 7.0 |
| Requires PHP | 8.1 or later |
| Licence | GPL-2.0 or later |
| Price | Free |
The plugin slug is reportedip-hive, so the listing lives at wordpress.org/plugins/reportedip-hive. In your admin menu the plugin appears as ReportedIP Hive Light.
How does Hive Light stop brute-force logins?
The plugin hooks into two WordPress actions. It needs no rules file and no access to the server configuration.
wp_login_failedrecords every failed login and adds it to a counter for the source IP. The counter uses an atomic database write, so parallel requests cannot slip past it.wp_authenticate_userrejects blocked addresses before WordPress checks the password. A blocked attacker gets no further guesses.
A second check looks for password spraying, where one address tries many different usernames. The OWASP page on password spraying explains why this pattern slips past lockouts per account. Hive Light therefore counts per IP address.
When an address crosses the threshold you set, it is blocked for 5 minutes. Each repeat offence moves it one step up the ladder: 15 minutes, 30 minutes, 24 hours, 48 hours and finally 7 days. The block page answers with HTTP 403 and no-cache headers, so WP Rocket, W3 Total Cache, WP Super Cache and LiteSpeed do not serve a cached login form to a blocked visitor.
Failed logins on WooCommerce forms are counted too, because WooCommerce fires the same wp_login_failed action. Application Passwords are not monitored by Hive Light.
What can you manage in the admin area?
The menu ReportedIP Hive Light has four pages:
- Dashboard: active blocks, blocks and attempts in the last 24 hours, the whitelist size and defended attacks over 24 hours, 7 days, 30 days and all time.
- Settings: the tabs Connection, Protection and Privacy.
- Blocked IPs: the block list with a bulk action to unblock addresses, including your own.
- Whitelist: trusted addresses and CIDR ranges, each with an optional expiry date.
A setup wizard with four steps opens on first activation. The login is protected as soon as the plugin is active; the wizard only confirms the operating mode and the thresholds.
Does Hive Light send data to reportedip.com?
Not by default. Hive Light starts in Local Shield mode: counters, blocks and logs stay in your own database, and the plugin makes no outbound requests.
Community Network mode is optional and needs a free Community Access Key from a ReportedIP account. In this mode the plugin does two more things:
- During a login attempt it asks the community database about the source IP. Addresses with a confidence score of 75 or higher are rejected. If the API does not answer within 2 seconds, the login continues.
- When the plugin blocks an address, it queues a report. A cron job sends the queue every 15 minutes.
A report contains the IP address, a threat category number and a short reason text. Usernames stay on your server and are stored only as a SHA-256 hash salted with wp_salt(). Passwords, domain names and request headers are never sent. Switching back to Local Shield stops all outbound traffic at once.
The legal basis for processing IP addresses is GDPR Art. 6(1)(f), the legitimate interest in network security. The free key includes 1,000 checks and 50 reports per day.
Hive Light or the Full Edition: which one do you need?
Both editions are free and licensed under GPL-2.0 or later. Hive Light comes from WordPress.org and protects the login. The Full Edition is downloaded from the product page and protects the whole site with 16 attack sensors, a web application firewall and four 2FA methods.
| If your site needs | Edition |
|---|---|
| Login protection only | Hive Light |
| Updates from WordPress.org | Hive Light |
| No outbound requests by default | Both editions |
| 2FA with authenticator app, email or passkey | Full Edition |
| Protection for XML-RPC, comments and the REST API | Full Edition |
| Multisite networks | Full Edition |
| SMS codes through the EU relay | Full Edition with Hive Pro |
| 2FA in the WooCommerce storefront | Full Edition with Hive Pro |
| Automatic hardening during coordinated attacks | Full Edition with Hive Pro |
Hive Pro is a paid subscription for the Full Edition, and the pricing page lists all plans. Hive Light itself has no paid tier.
How do you switch from Hive Light to the Full Edition?
The two editions share the same plugin slug and code prefix, so they cannot run side by side. If the Full Edition is already active, Hive Light deactivates itself and shows a notice.
- Deactivate Hive Light under Plugins.
- Download the Full Edition from the Hive product page and upload the ZIP under Plugins → Add New Plugin → Upload Plugin.
- Activate the Full Edition and run its setup wizard.
Both editions use the same database table names, so blocked IPs and whitelist entries stay in the database. The upgrade section of the documentation covers the details.
Which hooks does Hive Light offer developers?
Four filters change the plugin’s behaviour:
reportedip_hive_is_whitelistedlets addresses you trust pass without checks, such as CI runners or monitoring probes.reportedip_hive_get_client_ipreplaces the IP detection when your reverse proxy uses a header the settings do not offer.reportedip_hive_event_category_mapchanges the threat categories before a report is queued.reportedip_hive_api_endpointpoints the plugin at a different API address.
The actions reportedip_hive_log, reportedip_hive_ip_blocked and reportedip_hive_report_queued let you pass blocks and reports on to your own logging.
Questions about Hive Light
Is Hive Light really free?
Hive Light is free under GPL-2.0 or later, with no paid tier and no locked functions. Local Shield mode works without any account. The optional Community Access Key is free as well and includes 1,000 reputation checks and 50 reports per day. Paid plans only exist for the separate Full Edition.
Can Hive Light lock me out of my own site?
Hive Light can block your own IP address if you fail the login too often. The first block lasts 5 minutes. You can wait, or sign in from another network and remove the address under Blocked IPs. Adding your office range to the Whitelist in advance prevents the problem.
Does Hive Light work behind Cloudflare?
Hive Light works behind Cloudflare once you set the Trusted Proxy Header on the Connection tab to CF-Connecting-IP. Only set it when every request passes through the proxy, because a header sent straight to your server can be forged. Without the setting, all visitors appear with Cloudflare addresses.
Read on
The documentation explains the two operating modes of Hive Light and every feature of the Full Edition.