An attacker who fails at the login of one WordPress site is already blocked on every other site running Hive before the first attempt there. On top: 16 sensors including a firewall, and 2FA by app, passkey, email or SMS that also protects the password reset. Free and open source, built and hosted in Germany.
Free in the WordPress plugin directory: in WordPress go to Plugins → Add New Plugin and search for „ReportedIP Hive“. No account needed. Compare plans
One plugin, no second subscription. The detection and identity core is free and GPL-2.0 in every mode; paid plans add managed relays, fleet management and a handful of advanced modules on top. Nothing below is a teaser for a capability that turns out to be locked.
Plan labels mark the lowest plan that includes the capability.
Every surface an attacker actually uses has its own sensor, its own threshold and its own off switch. This is the complete list the plugin ships with, in the plugin's own order. None of them needs the community network to work.
16Read the detail How the sensors work Inside the firewall
Detection is only half of it. What separates a security plugin you keep from one you uninstall is what it does to the visitor who tripped a sensor by accident.
9Read the detail Progressive IP blocking Hardening Mode Groups Tor blocking and real client IPs
WordPress ships with entrances most sites never walk through, and every scanner tries them first. Each switch below is off until you set it, and reversible from the same screen.
12Read the detail The hardening checklist Inside the firewall
Four second factors, three of them free and working offline. The reset flow is covered as well, because an attacker who owns a mailbox does not need the password.
14Read the detail The four methods Passkeys and WebAuthn YubiKey in practice WooCommerce 2FA Managed mail and SMS relay
Spam defence a visitor never notices. There is no puzzle to solve and no image to read. The plugin checks whether a browser actually rendered the form, and whether the address behind it is one the site would refuse a sign-in to.
9Read the detail Form honeypot Gravity Forms without a captcha Decoy paths WPForms and Forminator without a captcha
What the plugin gives the person who has to operate it, on one site or on fifty. Everything in this group is reachable from the command line as well as the screen.
14Read the detail Multisite hardening The quickstart
Hive runs fully offline if you want it to. The community network is a decision you make, not a default you discover later, and every field it sends is documented.
10Read the detail Privacy by default What the network shares
Default is fully offline. The community network is opt-in and never mandatory.
All 16 sensors and the full 2FA suite run locally on your own server. No external calls, no telemetry, no API key.
Default after install. Switch any time.
Pre-auth IP reputation lookups against the public database. Coordinated-attack detection across every site in the network. Anonymised reports flow back so every attack makes the network smarter.
Free account at reportedip.com required. Free forever.
A stolen mailbox should not be a master key to your WordPress site. Hive wraps the lost-password flow with the same 2FA gate as the login, and the recovery channel (email) is excluded from the eligible methods, because the reset link itself arrives by email.
Email excluded from reset 2FA
A compromised mailbox cannot double as the second factor. The reset link and the 2FA confirmation must arrive on different channels: TOTP, Passkey, SMS or a single-use recovery code.
Two-stage WordPress hook
Gated twice, once when the reset form loads, once at password_reset. A direct POST against the reset form without a verified token returns WP_Error immediately.
Bound to user + key + IP
The verified-reset transient is scoped to user ID, the hashed reset key and the hashed client IP. Consumed on first use, expires after 10 minutes.
No separate brute-force surface
Failed reset-challenge attempts feed the same IP throttle that already shields wp-login.php. Optional hard-block for accounts that only have email-2FA, admin notification included.
Most security plugins are licensed per single site. Hive is licensed per plan, so the more sites you run, the less each one costs. Every price includes 19 % VAT; Enterprise is quoted net (B2B).
| Plan | Price | Sites | € / domain | Highlights |
|---|---|---|---|---|
| Free | 0 € | 1 | 0 € | All 16 sensors incl. WAF + 2FA, Local Shield |
| Professional | 14.90 €/mo | 3 | 4.97 € | Managed mail/SMS relay, Hardening Mode |
| Business | 39 €/mo | 15 | 2.60 € | White-label, full WP-CLI, GDPR export |
| Enterprise | from 663 €/mo (net) | unlimited | – | Custom AVV, dedicated onboarding |
Every sensor and every 2FA method lives in the open-source core and stays free. Paid plans add managed mail/SMS delivery, multi-site licensing and higher API quotas, never the security itself. The relay runs on EU-only sub-processors under signed DPA. Annual billing saves 17 % (149 €/yr Professional, 389 €/yr Business).
Most competitors license per single site, so their price per domain never drops. List prices checked on 20 October 2026 on each vendor’s pricing page. Hive prices include 19 % VAT, the other vendors sell in US dollars.
| Plugin | Paid entry price | Sites per licence | SMS 2FA | Company based in |
|---|---|---|---|---|
| ReportedIP Hive Professional | 149 € a year | 3 | Included, 25/month | Germany |
| ReportedIP Hive Business | 389 € a year | 15 | Included, 75/month | Germany |
| Wordfence Premium | 149 US$ a year | 1 | Not offered | United States |
| Solid Security Pro | No standalone price | Included in Liquid Web hosting | Not listed | United States |
| MalCare Protect | 99 US$ a year | 1 | Not listed | India |
| Patchstack Developer | 69 US$ a month, billed yearly | Per plan | Not listed | Estonia |
Of these vendors only ReportedIP and Patchstack are EU companies. Hive stores and processes data in Germany under a signed DPA. Full comparisons: Wordfence, Solid Security, MalCare, Patchstack.
The core protection is identical on every tier. Paid plans add managed mail/SMS relay, multi-site licensing and higher API quotas, never the security itself. All prices incl. 19 % VAT.
The Hive plugin is free and open source forever, and the free tier already includes the public API with 1,000 checks a day. Paid plans add managed 2FA mail and SMS relay, multi-site management, and higher API quotas.
Local protection, free forever
Solo developers and small sites
14-day money-back guarantee. Cancel anytime.
Agencies, WooCommerce, white-label
14-day money-back guarantee. Cancel anytime.
Includes Contributor and Enterprise tiers plus the full feature comparison table.
Built for freelancers and agencies who secure more than one WordPress site.
No Composer, no build step, no external dependencies. The quickstart takes care of the rest.
In WordPress go to Plugins → Add New Plugin, search for „ReportedIP Hive“ and click Install Now.
Prefer the file? Download the ZIP and upload it via Upload Plugin.
Activate the plugin. The quickstart opens automatically.
Pick Local Shield or Community Network. Enable 2FA roles. Done. Updates arrive through WordPress.org like for any other plugin.
Specific to the WordPress plugin. For platform-wide questions see the general FAQ.
Yes. Hive activates network-wide and tracks attacks per-site, with optional global blocklist sharing across the network. Multi-site licence (Professional = 3 sites, Business = 15 sites) controls how many independent sites can use the managed mail/SMS relay.
The free plugin updates through WordPress.org and shows up in your WordPress dashboard like any other plugin. One click and you are up to date. The Hive Pro add-on of the paid plans checks reportedip.com every 12 hours with your Community Access Key.
No. Sensor counters use object cache (Redis when available) with millisecond lookups. Reputation API responses are cached locally with ETag support to save credits. The admin dashboard loads on demand, never on the front-end.
Yes. All plugin admin and login pages are excluded from page cache automatically. Reputation lookups happen server-side before WordPress renders, so cached pages are served untouched. We test against WP Rocket every release.
Yes. Every list table (Blocked IPs, Whitelist, Logs, API Queue, 2FA Grid) supports CSV and JSON export from the admin UI. WP-CLI commands cover the same operations for automation (full WP-CLI on Business+).
The protection is never paywalled: all sixteen sensors are in the open-source core and free forever, on every plan, along with TOTP, email and WebAuthn 2FA; SMS 2FA is delivered over the managed relay on Professional and up. Paid plans (Professional 14.90 €/mo, Business 39 €/mo) add the convenience layer, managed 2FA mail and SMS delivery, multi-site licensing (3 or 15 domains on one licence), higher API quotas, Hardening Mode, white-label and full WP-CLI. All prices incl. 19 % VAT.
You can run the free edition indefinitely. Paid plans come with a voluntary 14-day money-back guarantee (under § 12 of our Terms, excluding already-consumed SMS or mail bundle credits) and you can cancel any time from the dashboard.
Release notes, guides and reports, newest first.
Three sites for 14.90 €/mo, managed 2FA delivery, multi-site licensing and Hardening Mode. 14-day money-back, cancel any time.
