Community Threat Intelligence: Hive vs Light

WordPress community threat intelligence only helps if it reaches you before the password is checked: an IP that attacked another protected site gets refused at your login before WordPress verifies anything. This guide explains the two operating modes, fully offline Local Shield and opt-in Community Network, and compares the two editions that implement them: ReportedIP Hive (Full Edition, version 2.1.37) and ReportedIP Hive Light (version 1.3.7 on WordPress.org).

What community threat intelligence means for WordPress

Community threat intelligence is shared attacker data: every protected site reports the IPs that attack it, and every other site can check incoming visitors against that pool. When one site is brute-forced and reports the attacker, thousands of other sites can refuse the same IP before the first password check.

The scale makes the difference. Between May and July 2026 the ReportedIP network logged 1.69 million attacks against WordPress sites, and as of July 2026 the community blacklist lists more than 20,000 high-confidence threat IPs. A single site sees one slice of a botnet; the network sees the campaign.

Local Shield: the fully offline default

Both editions start in Local Shield mode, and in this mode neither of them sends a single outbound HTTP request. Every counter, every block decision and every log entry stays on your own server, no account, no API key, nothing to opt into. The plugins do not contact reportedip.com unless you explicitly tell them to.

In the Full Edition, Local Shield still includes all 16 sensors, the complete 2FA suite, progressive blocking and the dashboard. In Hive Light it includes the per-IP counter and the block ladder. Sites with an air-gapped or strictly offline posture lose no local protection by staying in this mode permanently.

Community Network: one site’s attacker is everyone’s

Switching on Community Network requires a free Community Access Key from reportedip.com and adds two behaviours: pre-authentication IP-reputation lookups against the community database, and anonymised threat reports queued back to the network. Lookups are cached: 24 hours for safe IPs, 2 hours for known-bad ones, so the API footprint stays small.

Reports are batched, not streamed: a 15-minute cron sends them in groups of 20, guarded by a 5-minute transient lock against concurrent workers. The hourly API budget is split into three independent buckets, reputation lookups, report submissions and quota sync, so a lookup storm can never freeze the report queue. If the API is unreachable, nothing breaks: local blocking and the cached reputation keep working, and queued reports retry up to 3 times before surfacing in the API Queue tab.

What actually crosses the wire

In Community mode a report contains the attacker IP, an integer event category and the timestamp; login events add a SHA-256 hash of the attempted username, salted with wp_salt(). Plain-text usernames, passwords, comment content, domains and contact details never leave the server, and user-agents are truncated to 50 characters even in local logs.

The legal basis for processing attacker IPs is GDPR Art. 6(1)(f), legitimate interest in network and information security. Both editions disclose every external call in their settings, and community sharing stays strictly opt-in.

ReportedIP Hive vs. ReportedIP Hive Light

Both editions are free, GPL-2.0 and share the two-mode model, the difference is scope. Hive Light is deliberately one job done well: login brute-force protection, installed from the WordPress.org plugin directory and updated through the standard Updates screen. The Full Edition is a complete security suite, distributed through GitHub releases with a built-in update checker.

	Hive Light 1.3.7	Hive Full Edition 2.1.37
Distribution	WordPress.org directory	GitHub releases, built-in update checker
Scope	Login brute-force protection only	16 sensors: logins, password spray, XML-RPC, REST bursts, comment spam, 404 scanners, user enumeration, Web Application Firewall and more
Two-factor authentication	None	4 methods: authenticator app, email, SMS, passkeys including YubiKey hardware keys
Blocking	Fixed ladder: 5 min, 15 min, 30 min, 24 h, 48 h, 7 days	Progressive escalation plus Hardening Mode against coordinated attacks (PRO)
Multisite	Single site	Network activation, one shared threat state
Local Shield mode	Yes, default	Yes, default
Community Network mode	Yes, opt-in	Yes, opt-in
Dashboard	Settings tabs and a Blocked IPs list, no dashboard	Full dashboard with logs, charts and exports
Price	Free, GPL-2.0	Free, GPL-2.0; optional PRO subscription adds managed mail/SMS relay

Under the hood, Hive Light hooks wp_login_failed to increment an atomic per-IP counter and wp_authenticate_user to short-circuit known-bad IPs before WordPress core authentication runs, the attacker never reaches the password check. The blocked response is an HTTP 403 with explicit no-cache headers, so WP Rocket, W3 Total Cache, WP Super Cache and LiteSpeed serve the block page instead of a cached login form. The Full Edition applies the same cache-safe blocking across all of its 16 attack sensors.

Which edition and which mode fit your site?

You only need login protection, with zero configuration. Hive Light in Local Shield mode. It works the moment you activate it.
Your site must not call any external endpoint. Either edition in Local Shield mode, that is the default, and it is a real mode, not a trial.
You want shared reputation with minimal footprint. Hive Light in Community Network mode: one free Community Access Key, lookups cached, reports batched.
You need 2FA, a firewall, multisite coverage or WooCommerce protection. The Full Edition, four 2FA methods, the WAF, network activation and Hardening Mode are outside Hive Light’s scope by design.

Neither choice holds protection hostage: modes can be switched at any time without losing local data, and the wizard’s Connect step shows both modes side by side before anything is sent.

Moving from Hive Light to the Full Edition

Start with Light if you are unsure, the upgrade path is lossless. Both editions share the same wp_reportedip_hive_ database schema, so an install that outgrows Light keeps its block table and attempt history when the Full Edition takes over. A Community Access Key issued for one edition works for the other.

Frequently asked questions

Is Hive Light a limited trial of the Full Edition?

No. Hive Light is complete on its own: nothing in it is locked, crippled or nagging. It is the login-protection core as a standalone WordPress.org plugin; the Full Edition is a separate download that adds the other 15 sensors, 2FA and multisite support, also free and GPL-2.0.

Does Local Shield mode send any data to reportedip.com?

No. In Local Shield mode both editions make zero outbound requests, no telemetry, no version pings to the community API, no reputation lookups. Data only moves after you opt into Community Network mode with an access key.

Do Hive Light and the Full Edition use the same community network?

Yes. Both report to and read from the same reputation pool with more than 20,000 high-confidence threat IPs, using the same free Community Access Key. A Light site contributes the attackers it sees, and benefits from what every Full Edition site reports, and the other way around.

Can I switch modes later without losing data?

Yes. Switching between Local Shield and Community Network changes only whether lookups and reports happen, local counters, blocks and logs are untouched in both directions.

Related guides

The WordPress plugin documentation covers mode configuration. Browse the full ReportedIP Hive plugin guides, or inspect the API client on GitHub.

Explore ReportedIP Hive →

WordPress Community Threat Intelligence: Hive vs. Hive Light