ReportedIP Hive 2.1.41 — Tor Exit Blocking, Trusted Proxies and a Dashboard Security Widget
ReportedIP Hive 2.1.41 adds opt-in Tor exit-node blocking, trusted-proxy source ranges and a security widget right on the WordPress dashboard. It caps a five-release run that also repaired two real firewall gaps: release builds that shipped without their bundled rulesets, and crawler exemptions that took an unverifiable user-agent at its word.
Grab the update via Plugins → Check for updates or from the GitHub releases page; the hardware-key milestone that preceded this run is covered in the 2.1.36 write-up.
What changed between Hive 2.1.37 and 2.1.41
Five releases shipped in nine days, between 2026-08-06 and 2026-08-14. Three of them are small and surgical; 2.1.40 and 2.1.41 carry the weight.
| Version | Headline change |
|---|---|
| 2.1.37 | Domain move to reportedip.com — all links, the API endpoint default and the contact addresses; migration v14 rewrites a stored default endpoint, the old domain keeps a permanent redirect. |
| 2.1.38 | wp reportedip 2fa enable --method=totp now generates and prints a secret instead of flagging a method that could never verify; the email/SMS challenge sends a code on first submit instead of rejecting it. |
| 2.1.39 | Release builds ship the bundled WAF rulesets again — they were missing entirely — plus four firewall rules against the CVE-2026-64638 login-screen XSS chain. |
| 2.1.40 | A crawler user-agent nobody can verify no longer buys a block-ladder exemption, and unambiguously malicious requests revoke the exemption outright. |
| 2.1.41 | Tor exit-node blocking, trusted-proxy source ranges, a wp-admin security widget, a never-block veto for verified infrastructure, a richer IP lookup and race-safe attempt counters. |
Tor exit nodes can now be blocked at login
Professional installs get a new opt-in toggle on the Protection tab that rejects login attempts from known Tor exit nodes. The exit-node list arrives as a new signed tor_exits ruleset through the regular rule sync and is refreshed twice a day server-side, so it keeps up as exit nodes rotate; for addresses the list has not caught up with yet, the community isTor flag steps in.
Two deliberate limits are built in. Blocks are temporary — 24 hours by default, adjustable via the reportedip_hive_tor_block_hours filter — and a Tor block is never reported to the community, because operating an exit node is not abuse evidence. The toggle punishes a behaviour on your site, not participation in the Tor network.
Trusted-proxy source ranges close a header-spoofing hole
If your site sits behind Cloudflare or a reverse proxy, Hive reads the visitor address from a forwarded header. Until now, anyone connecting directly to the origin could send that header themselves — and impersonate a whitelisted address, or shed a blocked one.
2.1.41 only honors the trusted IP header when the connecting peer is one of the proxy addresses you declare (an IP/CIDR list under Settings → General). An empty list keeps the previous behavior, so nothing breaks on update. The same range check is baked into the pre-WordPress guard, which now also applies the public-address requirement to header candidates — closing a parity gap with the in-WordPress resolver.
The firewall stopped taking crawlers at their word
2.1.40 fixes the most consequential finding of this run. The crawler allowlist carries 71 user-agent tokens, but the bot_signatures ruleset only ships verification rules for a handful of them. For every token in between, the verifier returned unmatched — and is_exempt_crawler() treated anything short of a confirmed fake as a pass. Claiming to be GPTBot, PerplexityBot or UptimeRobot was therefore enough to sit out the block ladder and stay out of the community reports. On one production site, 47 blocks were skipped in three days — every single one for a request probing /.env, /config.php.bak or /ssl/server.key from a cloud range that belongs to nobody the user-agent claimed to be.
An exemption now requires a rule that ships an actual verification signal — a reverse-DNS suffix or an official IP range — and a verdict that is not fake. To keep the checkable set meaningful on free installs, the bundled baseline gained Baiduspider, LinkedInBot and Amazonbot, all verifiable by reverse DNS alone.
The second half of the fix: unambiguously malicious requests revoke the exemption outright. A honeypot hit, a decoy-path hit or a WAF match in the payload rule groups (path traversal, file probe, command and PHP injection, webshell, Log4Shell, XXE, SSTI, NoSQL, CRLF, SSRF) now denies the crawler exemption and is logged as bot_exemption_denied. SQL-injection and XSS rules deliberately keep the normal ladder — search terms and editor content do trip those patterns, and a customer searching a product code must not be locked out over it.
Those same payload groups also block on the first hit now, instead of waiting for the default threshold of three. The threshold exists so a false positive costs one request and nothing more — but a webshell upload has no false-positive surface worth protecting, so waiting only gave the scanner a head start. Filterable via reportedip_hive_waf_immediate_block_groups.
2.1.39 put the bundled rulesets back into the release build
This one deserves a plain confession. The release workflow staged includes, admin, assets, templates and languages — but not data, which is where the four baseline rulesets live. In an installed release copy, Rule_Sync::load_baseline() found no file and returned an empty set, so the firewall returned before inspecting anything; the bot signatures and the disposable-domain list were empty for the same reason.
Installs that sync rulesets from the API were unaffected, because a stored ruleset replaces the baseline rather than merging with it — which is precisely why this stayed invisible: the connected installs that get looked at were fine, while local-mode and unconnected installs ran an inert firewall. Both the release workflow and the local build now stage data and abort if any of the four baselines is absent from the staged tree. If you run Hive in Local Shield mode, update promptly.
The same release added four Paranoia-Level-1 rules against CVE-2026-64638 (XSS2Shell), the WordPress login-screen chain published on 2026-08-06. The chain needs neither a <script> tag nor an event handler — it smuggles plain HTML through a sanitiser parser differential and lets an id attribute clobber a JavaScript global. waf_xss_login_markup rejects a login value containing an angle bracket (never legitimate, sanitize_user() strips those), waf_xss_tag_differential detects the clobbering primitive itself and therefore covers the bug class rather than one advisory, and two companion rules close the Same-Origin-Method-Execution escalation. Measured against 12 attack variants and 34 legitimate requests: 12 blocked, 0 false positives. This is defence in depth, not a substitute for the fix — WordPress 7.0.3, or the patched release of your branch, remains required.
The wp-admin dashboard finally shows what Hive is doing
A new security widget (admin/class-dashboard-widget.php) puts attacks blocked in the last 30 days, blocks today, active IP blocks, the enabled protection layers and the detection score on wp-admin’s front page, with deep links into the plugin. On Multisite the widget appears on the network dashboard and, for super admins, on sub-site dashboards with network-wide numbers.
Three smaller visibility changes land alongside it. An API status strip on the Security Dashboard summarizes connection, quota (with reset countdown) and rate-limit state in one glance, from cached data only. The daily quota display stays fresh between cron runs by reading the X-RateLimit headers the API already sends on every response. And after an update, plugin pages show a one-time dismissible “What’s new” banner with the release highlights (includes/class-whats-new.php) — dismissal is per user, and the banner never blocks a page when the feed is unreachable.
IP addresses became first-class citizens in the admin
Every IP in the logs, blocked, whitelist and top-attackers tables now carries copy, internal-lookup and an external link to its public reportedip.com profile page; top attackers gained inline Block/Unblock actions. The lookup tab itself grew up: it now shows ISP, ASN, usage type, domain, distinct reporters and last-reported time, flags Tor exit nodes and community-verified infrastructure, and offers Block/Whitelist quick actions on the result card.
wp reportedip lookup <ip>(includes/class-lookup-cli.php) brings the same lookup to WP-CLI with table, json, csv and yaml output.- An add-my-IP helper on the whitelist form whitelists your current address in one click — for IPv6 it prefills the /64 network, so rotating residential prefixes stop locking their owners out. Blocking your own current IP now asks for confirmation first.
- The event log gained a date-range filter, and the block-from-log row action offers a duration choice instead of a fixed 24 hours.
Verified infrastructure is never blocked — and integrators get a stable hook
When the reputation service marks an address as curated infrastructure — search-engine crawlers, major CDNs, monitoring fleets — Hive no longer writes a local block for it, neither from the reputation path nor from the auto-block ladder, and logs infrastructure_spared instead. Reports still go out: blocks are consequences, reports are evidence.
For webhook, SIEM and Slack integrations there is now one stable attach point: reportedip_hive_threshold_exceeded fires on every confirmed sensor detection, regardless of the auto-block and reporting settings. The documented reportedip_hive_report_queued action now actually exists (it fires once per report entering the API queue), and the block page gained reportedip_hive_access_denied plus a reportedip_hive_blocked_page_strings filter for white-label text overrides.
Fixes worth knowing about: invisible mail titles, racing counters, stale caches
The most visible fix concerns the notification and 2FA emails. The header cell carried its color only as a CSS gradient — GMX Webmail and Outlook for Android drop linear-gradient(), which left white header text on a white cell and let spam filters score the message with HTML_FONT_LOW_CONTRAST. Header and call-to-action button now set a solid indigo background (bgcolor attribute plus background-color) and keep the gradient as progressive enhancement; the inline SVG logo, which both clients rendered as stray artifacts, is gone. Reported by Benjamin Grösch — thank you.
- Race-safe attempt counters.
track_attempt()is now a single atomic upsert on a unique(ip_address, attempt_type)key (schema v15, with duplicate-row cleanup), so parallel failed-login bursts can no longer lose counts to read-then-update races. - Rate-limit back-off is scoped per endpoint. A 429 on the report path no longer pauses reputation lookups, and the report path now honors Retry-After, which it previously ignored.
- The reputation cache respects verbosity and your own reports. A non-verbose cache entry no longer satisfies a verbose lookup, and a successful own report invalidates the cached reputation instead of serving up-to-24-hour-old data.
- CIDR ranges are accepted in the manual block form — the enforcement layers supported them since 2.1.32, the form’s validation now agrees.
- WooCommerce-only settings grey out without WooCommerce, with an explanatory note instead of a toggle that cannot do anything, and the Multisite blocked-page contact URL resolves network-wide again.
- Accessibility. Focus rings survive Windows High Contrast, forced-colors and reduced-motion blocks cover the admin design system, icon buttons meet 40px touch targets on coarse pointers, AJAX notifications are announced via a polite live region, and roughly 90 previously hardcoded admin-JS strings are now translatable.
How to update to Hive 2.1.41
The built-in update checker polls GitHub every 12 hours; to pull the release immediately, open Plugins → Check for updates. Requirements are unchanged: WordPress 5.9+ and PHP 8.1+. There is no manual migration — the upgrade routine runs migration v14 (rewriting a stored default API endpoint to reportedip.com) and schema v15 automatically.