ReportedIP Hive 3.0.0: one free plugin on WordPress.org, paid features in the Pro add-on
ReportedIP Hive 3.0.0 is one free plugin from the WordPress plugin directory, and everything that belongs to a paid plan now lives in the separate ReportedIP Hive Pro add-on. The release came out on 16 October 2026 and replaces the two editions we used to ship, the full standalone download and the smaller plugin on wordpress.org.
New sites install Hive from the WordPress plugin directory. Existing sites need to do nothing: both former editions receive 3.0.0 as an update and keep their settings and data. This post explains why we split the plugin, what each part contains, how the move works for every kind of installation and how we tested it.
Why does ReportedIP Hive 3.0.0 come from the WordPress plugin directory?
Up to version 2.1.74 Hive existed twice. The full plugin was a separate download and updated itself through its own update checker. A second, much smaller plugin with login protection only was listed on wordpress.org under the same slug. Two code bases meant two sets of bugs, two changelogs and a choice that confused new users before they had installed anything.
We wanted one plugin that installs and updates through WordPress itself, with automatic updates, the Plugins screen and the review of the plugin team. The directory has clear rules for that. The plugin guidelines do not allow a directory plugin to ship features that stay locked until someone pays, and they do not allow a plugin to update itself from another server. The 2.x plugin did both: it carried the code of every plan and unlocked parts of it by Community Access Key.
So we cut it in two along the plan line. The free plugin holds everything that protects a site and contains no switch that waits for a payment. The paid features moved into an add-on that we distribute ourselves.
What does the free ReportedIP Hive 3.0.0 include?
The free plugin is complete on its own. It needs no account, no trial and no key, and it is licensed under the GPL.
- Login security. Sixteen sensors watch the sign-in form, XML-RPC, the REST API, the comment, registration and password-reset forms and the request itself. Failed sign-ins are limited per address, password spraying is caught separately and a block ladder runs in six steps from 5 minutes to 7 days.
- Two-factor authentication. Authenticator apps, e-mail codes, ten recovery codes and one passkey or hardware security key per account, for example a YubiKey or Windows Hello. 2FA can be enforced per role, and the password-reset gate asks for the second factor too.
- Firewall. A bundled baseline ruleset against SQL injection, XSS, path traversal and scanners, the optional pre-WordPress guard that applies the same rules before WordPress loads, bait-path detection and verified bot detection.
- Forms and spam. An invisible execution check instead of a CAPTCHA on comments, registration, password reset and Contact Form 7, a comment spam filter, a comment honeypot, disposable e-mail blocking and registration rules with ten entries per list.
- Lockdown and operations. Switches for REST access, XML-RPC, feeds, wp-admin for guests, PHP in uploads and version fingerprints, basic security headers, the activity log, the protection score, WP-CLI commands, multisite support and the MainWP bridge.
Local Shield is the default mode and makes no outbound request. The Community Network is optional: with a free Community Access Key the plugin checks attacking addresses against the community blocklist and shares the ones it blocks. Hive does not scan files for malware, and we say so in the directory listing as well.
What does ReportedIP Hive Pro add on each plan?
ReportedIP Hive Pro is one add-on for the Professional, Business and Enterprise plans. It runs next to the free plugin and reads the plan from your Community Access Key, so there is no second licence key. The features are the ones the paid plans already had in 2.1.74:
| Feature in the Pro add-on | Professional | Business and Enterprise |
|---|---|---|
| 2FA mails and SMS codes through the managed relay | 500 mails and 25 SMS a month | Business: 2,500 mails and 75 SMS a month |
| Two-factor login on the WooCommerce storefront | Yes | Yes |
| Adaptive 2FA step-up per role | Yes | Yes |
| Hardening mode during attack waves | Yes | Yes |
| Advanced security headers and the CSP builder | Yes | Yes |
| Computation check on forms | Yes | Yes |
| Tor exit node blocking | Yes | Yes |
| Unlimited registration rules with regular expressions | Yes | Yes |
| Group bans across sites | 1 group with 10 keys | Business: 3 groups with 50 keys |
| Form protection for WPForms, Gravity Forms, Forminator, Formidable, Elementor Forms and Ultimate Member | No | Yes |
| Several security keys per account | No | Yes |
| Audit trail | No | Yes |
| Account blocking and session manager | No | Yes |
| Cloud fleet management | No | Yes |
Enterprise gets mails within fair use, SMS by contract and up to 100 groups. Priority Sync of the firewall rulesets is not part of the add-on: the free plugin receives the deeper rulesets as soon as the key belongs to a Contributor plan or higher.
- Download. The add-on is not on wordpress.org. Customers on a paid plan find the button Download Hive Pro on the Hive page of their reportedip.com account.
- Updates. The add-on checks reportedip.com every 12 hours and shows new versions on the normal Plugins screen. The package is delivered only for a Community Access Key on a paid plan.
- Installs what it needs. Activated on a site without the free plugin, the add-on installs ReportedIP Hive from wordpress.org and activates it. If the free plugin is inactive or too old, the add-on waits and shows a notice with the next step.
- Nothing is lost on deactivation. Settings, user data and the audit trail stay. Only the group ban list is released and synced again after reactivation.
How do existing sites move to Hive 3.0.0?
Sites on 2.1.x update automatically
Sites that ran 2.1.74 or an older 2.1 release received 3.0.0 once more through the old update channel. That release contains a small migration helper. It switches the site to updates from wordpress.org, removes the old update checker and its scheduled task, and keeps every setting, block, whitelist entry, 2FA method, security key and audit row.
On a site whose key belongs to the Professional, Business or Enterprise plan, the helper downloads ReportedIP Hive Pro on the next scheduled run and activates it, so the paid features keep working without a click. A site on the Free or Contributor plan sees one short note that paid features now live in a separate add-on. If an automatic install fails, for example because the host disallows file changes, the note names the reason and points to the download in the account.
Sites on version 1.3 from wordpress.org update normally
The former ReportedIP Hive Light used the same slug in the directory, so its sites receive 3.0.0 as an ordinary update. Their data comes along: permanent whitelist entries stay permanent, whitelisted ranges and IPv6 addresses match again, attempt counters are merged per address, and the proxy headers True-Client-IP and X-Cluster-Client-IP stay selected. Open the quickstart afterwards to choose Local Shield or the Community Network.
Multisite networks keep the data of every site
Where version 1.3 was activated site by site on a network, each sub-site kept its own tables. Hive 3.0.0 is network-activated and copies the blocks, whitelist entries, counters and pending reports of every site into the network tables. A duplicate keeps the entry that lasts longer, counters are summed, and the old tables stay as a backup until an uninstall with data deletion.
MainWP dashboards install the add-on for you
The free plugin still carries the MainWP bridge, so child sites need no extra plugin. Version 1.4.1 of the ReportedIP extension for the MainWP dashboard shows whether the add-on is present on each child site and installs ReportedIP Hive Pro on sites with a paid plan.
Five defaults changed in 3.0.0
- The breach check for new passwords is off until you switch it on. A site updating from 2.x keeps its stored value.
- Activation writes nothing into
.htaccess. The bait-path and uploads blocks follow an action of yours, such as the quickstart or saving the switch. A 2.x site with a completed quickstart keeps its blocks. - Local Shield sends no request to reportedip.com, even with a key stored, and the news card loads only in Community Network mode.
- The “Protected by ReportedIP” footer badge stays off until you tick it. A site that already shows it keeps it.
- Every notice can be closed. A critical queue or setup problem stays until it is fixed.
How did we test Hive 3.0.0 against 2.1.74?
The rule for the split was simple: the free plugin plus the add-on must do everything 2.1.74 did. An automated comparison checks every class, method, hook, option, database table, REST route, WP-CLI command and test of 2.1.74 against the two new plugins. For 2.1.74 that is 134 classes, 2,178 methods, 323 hooks, 210 options and 10 tables. The run ends with zero unexplained gaps; every moved or renamed item carries a written reason.
- Automated tests. More than 2,000 unit and multisite tests for the free plugin and more than 650 for the add-on, plus 255 end-to-end tests in a real browser on a single site and on a multisite network.
- Every update path in the browser. 53 of 53 acceptance tests passed on fresh test installations: 2.1.74 with real data to 3.0.0 and the add-on, version 1.3.9 to 3.0.0 on a single site and on a network, every plan with and without the add-on, a multisite network, and a security run.
- Security after removal. The security run attacks the site with the free plugin alone, with the add-on and after the add-on was deleted: brute force on the login and on application passwords, firewall rules in both layers, a filled form decoy, Hide Login, the 2FA reset gate and a forged REST verification. The free plugin kept protecting in every case.
- Plugin Check. The official Plugin Check of wordpress.org reports 0 errors and 0 warnings on the release package.
Is Hive 3.0.0 slower than 2.1.74?
No. We set a limit of 10 per cent before the work started and measured seven scenarios on the same data: 500,000 log rows, 5,000 blocks and a 1 MB blocklist. Times on a shared test machine vary, so we switched the three variants round by round on one installation and took the median.
| Scenario | Database queries 2.1.74 | Free plugin | Free plugin and Pro | Time, free plugin | Time, free plugin and Pro |
|---|---|---|---|---|---|
| Front page, anonymous visitor | 36 | 31 | 36 | -4.0 % | -7.0 % |
| Rapid 404 requests | 36 | 31 | 36 | +8.4 % | +5.1 % |
| REST API post list | 33.7 | 28.7 | 33.7 | -19.8 % | -3.5 % |
| Login flood | 35.6 | 28.6 | 35.6 | -17.7 % | -25.4 % |
| Request from a blocked address | not counted | not counted | not counted | -42 % | -48 % |
| 64 KB POST request | 36 | 31 | 36 | -10.3 % | -5.5 % |
| Admin dashboard | 60 | 54 | 56 | -3.7 % | +5.6 % |
The free plugin alone needs five to seven queries fewer than 2.1.74 on every request. With the add-on the count matches 2.1.74 on the front end and is four lower on the dashboard. The first measurement found 66 queries on the dashboard with the add-on; the add-on now loads its stored state in one query, and that fix shipped in 3.0.0.
What data leaves the site with Hive 3.0.0?
In Local Shield mode nothing does, not even with a Community Access Key stored. In Community Network mode the plugin sends the attacking address, the event category, the time, the site name and address, the attempt count and the plugin version. Usernames, passwords and form content never leave the site. The add-on adds one request: its update check sends the key to reportedip.com and to nowhere else. The privacy page of the documentation lists every request and what is stored locally.
Is the source code of ReportedIP Hive open?
Yes. The free plugin is licensed under the GPL 2.0 or later, and its code is in the directory’s SVN like every listed plugin. The source code and the development version are available on the plugin page on wordpress.org. Since 3.0.0 the old update channel no longer delivers updates.
What comes after Hive 3.0.0?
Version 3.0.1 removes the migration helper. It is only needed for the one step from the old update channel to wordpress.org, and the first update from the directory replaces it anyway. German ships with 3.0.0. French, Spanish, Austrian German and formal German translations are prepared and go to translate.wordpress.org, where anyone can review and improve them. After that the work goes back to features, now in two plugins with one release schedule.
Questions about Hive 3.0.0
Do I need the Pro add-on?
Only on the Professional, Business or Enterprise plan. The free plugin protects a site completely: firewall, login limits, 2FA, form checks and the Community Network work without the add-on. Without a paid plan the add-on has nothing to switch on, and its package is not delivered.
What happens to my paid features if the add-on is missing after the update?
They pause, and nothing is deleted. Settings, 2FA methods, security keys and audit rows stay in the database, and account blocks stay enforced by the free plugin. Download the add-on from your reportedip.com account, upload it under Plugins and activate it; every paid feature continues where it stopped.
Where do updates come from now?
ReportedIP Hive updates from wordpress.org like any plugin from the directory, automatic updates included. ReportedIP Hive Pro updates from reportedip.com with your Community Access Key and shows up on the same Plugins screen. The update check link on the add-on row forces an immediate check.
Read on
The last release of the 2.1 series is described in the post on Hive 2.1.72 and group bans. Prices and quotas of every plan are on the pricing page.
Protect your WordPress site with a firewall, login security, 2FA and form checks. Free from the WordPress plugin directory.