ReportedIP Hive Reaches 100 Installations in Four Months
On April 27, 2026 I published the first version of ReportedIP Hive. Four months later the plugin runs on around 100 WordPress installations, and 85 of them report attacks into the community network every day.
To mark it, there is a coupon: until November 20, 2026 the code HIVE50 takes 50% off the first year of Hive PRO at checkout.
Why 100 installations matter more than the number suggests
Hive is built on one principle: every protected website makes all the others safer. When a botnet tries passwords on site A, site A blocks the IP locally and reports it to the network. Every other connected site then rejects the same address before the first password is ever checked there.
That mechanism scales with participants. At 10 installations the network sees a fraction of the attack surface; at around 100, with 85 sites reporting daily, a new attacker IP is usually known to the network within minutes of its first attempt anywhere.
The growth itself was organic. Marketing spend so far: €0. No ads, no sponsored placements. Installations came through GitHub and WordPress communities.
The numbers after four months
All figures below were verified internally on August 19 and 20, 2026.
| Figure | What it stands for |
|---|---|
| ~100 | installations since the first release on April 27, 2026 |
| 85 | active installations talking to the network daily |
| 86 | releases shipped in four months, one every 1 to 2 days on average |
| 16 | attack sensors: brute force, scanners, comment spam, XML-RPC, WAF and more |
| 4 | two-factor methods: authenticator app, passkey/YubiKey, email, SMS |
| 1,300+ | automated tests every release passes before it ships |
| €0 | marketing spend to date |
Every protective feature stays free
Not a single sensor, two-factor method or dashboard sits behind a paywall. A site that never pays loses nothing. That separates Hive from most commercial WordPress security plugins, where the useful half of the feature list starts at the premium tier.
The plugin is GPL-licensed and the full source code is public on GitHub. Paid plans only cover managed services: SMS delivery for two-factor codes, mail relay and higher API quotas.
For sites that want those managed services: Hive PRO costs €14.90 per month incl. VAT and covers up to 3 domains, which works out to under €5 per domain. Wordfence Premium, for comparison, runs at roughly €8.30 per domain (as of August 2026). The Business plan covers 15 domains at €39 per month incl. VAT.
How to redeem the HIVE50 coupon
The coupon halves the first year of Hive PRO. It works on both billing intervals:
- Monthly plan: the first 12 invoices are halved, €7.45 instead of €14.90 per month incl. VAT.
- Yearly plan: the annual invoice is halved; the renewal after 12 months is billed at the regular price.
- Redemption window: the code can be entered until November 20, 2026. Once applied, the discount runs the full 12 months, no matter how late in the window you redeem it.
Redeeming takes three steps: create a free account, pick PRO in the Plans tab of your dashboard, and enter HIVE50 in the promotion-code field of the checkout. The discount is applied before payment, so the reduced amount is what you see on the first invoice.
The community blacklist stays open to everyone
The IP blacklist fed by these installations is a separate open project. It has been on GitHub since February 2026, updates daily and requires no signup. Firewalls, fail2ban jails and mail servers can pull it directly; the blacklist documentation describes the available formats and categories.
Every entry on that list traces back to reports from the roughly 100 Hive installations and the honeypot network. No purchased feeds, no third-party aggregation.
Get started
- Install ReportedIP Hive, the free plugin, protection included
- Plugin documentation, setup, sensors, configuration reference
- The six-step setup wizard, how the onboarding works
- Plans and prices, where to enter
HIVE50before November 20, 2026
Thanks to every site that reports. The network is only as good as the sensors that feed it.