ReportedIP Hive 2.1.54: Form Execution Proof xe2x80x94 ReportedIP

ReportedIP Hive 2.1.53 adds form execution proof against scripted spam, and 2.1.54 removes the ten-step setup wizard in favour of one page. Both shipped within three days of each other and change how a fresh install gets configured and how its forms get defended.

Update from the WordPress admin or grab the ZIP from the v2.1.54 release on GitHub.

Form execution proof stops scripts that never load the page

Comment, sign-up and password-reset forms now carry a hidden anchor field, plus a script-added second field whose name is randomised per installation. A submission missing both fields has never actually rendered the form, which is exactly what a script posting straight at the form URL looks like. According to the 2.1.53 changelog, every spam comment on the site the feature was built for arrived that way overnight.

The verdict is four-way rather than a flat yes or no: a theme with hand-written comment markup keeps the lenient reading it always had, since the site measures for itself whether it plants the anchor rather than assuming every theme does. For comments, a missing proof is a score signal rather than an automatic rejection, a reader browsing without JavaScript gets filed for manual review instead of refused, and that signal alone never trips the block ladder. Sign-up and password-reset forms do refuse and say why, but each can be switched off independently.

It runs on every plan for free, lives under Firewall → Spam Defence, and REPORTEDIP_HIVE_DISABLE_FORM_PROOF in wp-config.php turns the entire layer off for sites that render comment markup in an unusual way.

Community Network now screens comments and sign-ups, not just logins

The sign-in page has checked a visitor’s address against the community network since Hive’s first release. Comments, sign-ups and password resets never did, so an address the network already scored as abusive could keep posting as long as it stayed under the site’s own local threshold. All three surfaces now run the same check at the same protection level the sign-in page enforces, floor and hardening clamp included: an address the site would refuse a login to cannot use the comment form as a side door. A visitor who fails the check is told why, and the address is closed for 24 hours, the same duration a refused sign-in gets.

The check fails open throughout. An exhausted daily lookup allowance, a rate limit, a timeout or an unreachable network all read as “no opinion,” and the submission is judged on local signals alone, exactly as the sign-in page already behaved. It only runs in Community Network mode and is on by default, with the same exemptions as the login check: whitelisted addresses, the site’s own server, and infrastructure the network flags as such.

The setup wizard is gone, replaced by one quickstart page

Hive 2.1.54 retires the ten-step onboarding wizard. The quickstart that replaces it asks two questions: which mode to run in, Community Network or Local Shield, and, for Community Network, a Community Access Key. Checking the key reads the account’s plan and applies a plan-aware recommendation through the settings registry automatically, no per-step form to click through.

Three switches stay visible on the page: 2FA for administrators (7-day grace period), the “Protected by ReportedIP” footer badge, and alert mails to the admin address.
Every other setting, from sensor thresholds to log retention, comes preconfigured from ReportedIP_Hive_Defaults::recommended() for the detected plan.
An “expert mode” link applies the same recommendation and opens the full settings screen instead of the dashboard.
Bookmarked or documented links to page=reportedip-hive-wizard redirect straight to the quickstart.

A plan upgrade now switches on what it recommends

Upgrading a site’s plan applies the new plan’s recommendation, Tor blocking, the HSTS header and 90 days of logs on Professional, one year of logs on Business, to every setting the admin has not changed by hand. A post-upgrade banner lists exactly what changed, so an upgrade no longer leaves better protection sitting unused in a settings tab nobody revisits.

The dashboard lost its clutter

API call statistics and the licensed-domains card moved to the Community page, where the quota already lived. The quick-action tiles that duplicated the main menu are gone, and the activity list now shows the five latest events instead of a longer scroll. New at the bottom: the three latest posts from reportedip.de’s news feed, shown in the admin’s own language and fetched through WordPress’s feed cache, but only in Community Network mode. Local Shield installs make no outbound request for it, consistent with the plugin’s zero-outbound-call default in that mode.

Every stored setting now follows one standard

Eight options that were editable in wp-admin but lived outside the settings registry, the upgrade hints, the quota and plan-change mail settings, the three 2FA reminder settings, the Extended Protection body-inspection switch and the e-mail code’s subject line, now have a registered default and a form. That means export, import, the MainWP integration and the cloud fleet dashboard see them exactly like every other setting instead of silently skipping them.

Upgrading

Both releases install like any other update, from wp-admin or via WP-CLI, no manual migration step.
A site already past onboarding keeps its settings; the quickstart only appears for a fresh install or one that never finished setup.
Sites tested up to WordPress 7.1 on PHP 8.1+.

Full details, including the comment-decoy timing fix and the CI change that now fails on a real Plugin Check error, are in the Hive changelog on GitHub.

ReportedIP Hive 2.1.54: Form Execution Proof and a One-Page Quickstart