ReportedIP Hive is a free WordPress security plugin with a web application firewall (WAF), brute force protection, two-factor authentication (2FA) and anti-spam protection for comments, registrations and contact forms. It is built for site owners, agencies and WooCommerce shops that want login security and spam protection in one plugin, without a CAPTCHA and without sending data anywhere by default.

The plugin blocks attacking IP addresses on your own server. It needs no account. Sixteen sensors watch the sign-in form, XML-RPC, the REST API, the comment, registration and password-reset forms and every request. An optional community IP blocklist shares and checks attacking addresses with other sites.

Everything described here up to the add-on section is free and complete: no trial, no locked switch, no time limit.

Web application firewall (WAF)

Request inspection with a bundled ruleset against SQL injection, cross-site scripting (XSS), path traversal, command injection and vulnerability scanners.
Pre-WordPress firewall. An optional layer (auto_prepend_file) applies the same rules, exceptions, whitelist and IP blocks before WordPress loads. A blocked request costs almost nothing.
404 and scanner detection. Requests for bait paths such as .env, .git/config or wp-config.php.bak block the address at once.
Verified bot detection. Googlebot, Bingbot and other large crawlers are confirmed through their published address ranges or reverse DNS. A fake Googlebot is treated like any other visitor.
REST API rate limit, firewall exceptions per rule, path or IP, and a report-only mode for testing.
IP blocking and whitelist for single addresses and CIDR ranges, with incident reference codes on the block page.

Login security and brute force protection

Limit login attempts. Failed sign-ins are counted per IP address. The default blocks an address after 5 failures in 15 minutes.
Progressive IP blocking. Six steps from 5 minutes to 7 days. The ladder resets after 30 quiet days, so a typo never costs a day.
Password spraying detection. Many usernames tried from one address are caught separately.
Application password protection. Failed Basic Auth sign-ins count like failed logins, so the REST API is no way around the limit.
Hide Login. Move wp-login.php to a custom login URL.
User enumeration protection. Author archives, the users REST route, the user sitemap and login error messages no longer reveal usernames.
Login anomaly detection. A sign-in from a new country is logged and asks for the second factor again.
WooCommerce login protection. My Account sign-in and registration are counted like wp-login.php.
Password policy with minimum length, character classes and an optional breach check (off by default).

Two-factor authentication (2FA)

Authenticator apps (TOTP) such as Google Authenticator, Microsoft Authenticator, Authy or 1Password.
Passkeys and hardware security keys (WebAuthn, FIDO2), for example a YubiKey, Face ID, Touch ID or Windows Hello. One key per account.
E-mail codes.
Recovery codes, ten single-use codes per user.
2FA enforcement per user role, an enrolment wizard, trusted devices for 30 days and a password-reset gate that a stolen mailbox cannot bypass.
WP-CLI commands to enable, reset and audit 2FA per user.

Anti-spam and form protection without CAPTCHA

ReportedIP Hive replaces a CAPTCHA with checks the visitor never sees. No puzzle, no checkbox, no Google reCAPTCHA or other third-party script.

Invisible execution proof. A hidden decoy field and a short script prove that a real browser filled in the form. A bot that fills the decoy is blocked on the first try and, in the Community Network, reported. The check carries nothing request-specific, so cached pages keep working.
Comment spam filter. Scores links in the text and the website field, link density, the number of domains, disposable addresses, throwaway top-level domains, a domain in the author name, foreign script and text without content. Spam goes to the spam folder or is rejected.
Comment honeypot.
Registration spam protection for WordPress, WooCommerce and multisite sign-ups: prohibited usernames, e-mail allow and block rules, a sign-up rate limit and an optional block for sign-ins with unknown usernames. Ten entries per list.
Disposable e-mail blocking on registrations and forms.
Password reset spam protection. The lost-password form carries the same proof.
Contact Form 7 spam protection with the same invisible check.
IP reputation on forms. In the Community Network, comment, registration and password-reset submissions from known attacking addresses are refused.

Hardening and attack surface

XML-RPC and pingbacks off with one switch.
REST API for signed-in users or chosen roles only.
Feeds, wp-admin for guests, PHP execution in the uploads folder and software version fingerprints, each a switch.
Security headers: X-Content-Type-Options, X-Frame-Options and Referrer-Policy, with an example and a plain explanation for each, a generated nginx and Apache configuration and a check that shows which headers really reach a visitor, cached pages included.
Protection score and a readiness check that lists what still needs attention.

Activity log and operations

Security activity log with filters by event type, severity and date, CSV and JSON export.
A daily summary of blocked attacks and instant alerts when something got through, such as a new administrator.
Settings import and export.
WP-CLI: wp reportedip block, unblock, whitelist, lookup, status and 2fa.
Works behind Cloudflare and other reverse proxies with a trusted proxy list.
Compatible with WP Rocket, W3 Total Cache, WP Super Cache and LiteSpeed Cache.

WordPress multisite and MainWP

Network-activated, one set of tables, IP blocks and whitelist shared by every site.
Site admins see the activity of their own site; protection is managed by the network admin.
MainWP dashboards read status counts and push settings through the MainWP Child plugin, with no extra child plugin.

Community threat intelligence (optional)

Local Shield is the default. The plugin makes no outbound request.
Community Network is opt-in. With a free Community Access Key from reportedip.com the plugin checks the IP reputation of attacking addresses during sign-in and on forms, shares the addresses it blocks with the community IP blocklist and receives signed firewall, bot and disposable-domain rulesets.

Privacy and GDPR

Minimal logging, retention of 30 days by default, addresses anonymised after 7 days.
Usernames, passwords and form content never leave the site.
A suggested text for your privacy policy is added under Settings, Privacy.
Made in Germany.

What it does not do

ReportedIP Hive does not scan files for malware and does not monitor file integrity. Run a malware scanner next to it if your site needs one.

ReportedIP Hive Pro add-on

ReportedIP Hive Pro is a separate add-on for paid plans. It is not hosted on wordpress.org and adds new features on top of this plugin; nothing in the free plugin is held back for it.

Professional plan:

Managed 2FA mail relay (500 mails per month) and SMS two-factor authentication through an EU SMS gateway (25 SMS per month).
WooCommerce two-factor authentication on My Account, the classic checkout and the WooCommerce Blocks login, inside the shop theme.
Adaptive 2FA policies per role: ask again on a new device, IP address, network or country, every N days or sign-ins, or above a session limit.
Hardening mode that tightens thresholds for one hour during a coordinated attack.
Advanced security headers: Content Security Policy (CSP) builder, HSTS with preload, Permissions-Policy and Cross-Origin headers.
Computation proof on forms, a proof of work the browser solves in the background, as a CAPTCHA alternative that a script cannot copy.
Tor exit node blocking.
Unlimited registration rules with regular expressions and sign-ups restricted to allowlisted IP addresses.
Group ban lists: one block list and whitelist shared by all sites of a group.

Business plan, in addition:

Spam protection for further form plugins: WPForms, Gravity Forms, Elementor Forms, Formidable Forms, Forminator, Ultimate Member and the withdrawal form of EU Order Withdrawal Button (also bundled in Germanized).
Audit trail (activity log for changes): who changed which setting, plugin, theme, page, menu, file or user account, with old and new values and export.
User account blocking and session management: block accounts, end sessions and review active sessions.
Multiple security keys per account with model detection.
Cloud fleet management of many sites from the reportedip.com dashboard.
Higher mail and SMS quotas (2,500 mails and 75 SMS per month).

Paid plans also receive fresher and deeper rulesets through the Community Network. Plans and prices: reportedip.com pricing.

Documentation: ReportedIP Hive guide.

Privacy Policy

The plugin stores the addresses of failed sign-ins, blocked requests and security events in its own database tables for the retention period you configure (30 days by default), together with the event type and, when detailed logging is on, the user agent. Addresses are anonymised after seven days by default. A ready-made text for your privacy policy is added under Settings, Privacy. Processing is based on Art. 6(1)(f) GDPR (protection of the site).

Verified bot detection resolves the host name of visitors that claim to be a search engine crawler through your server’s DNS resolver, which means the visitor address is sent to that resolver. Results are cached for up to 24 hours.

External Services

reportedip.com. In Local Shield (the default) the plugin contacts no external service, even with a key stored; only a click on “Check” in the quickstart or on “Test Connection” sends one key check. With the Community Network switched on and a Community Access Key entered, the plugin talks to https://reportedip.com/wp-json/reportedip/v2/. It checks the key every six hours, looks up attacking addresses during sign-ins and on forms, reports addresses it blocked (address, event category, attempt count, site name), sends addresses you whitelist as feedback, and downloads signed firewall, bot and disposable-domain rulesets every six hours. With “Sync alert recipients” on, it also sends the alert recipient addresses. Every request carries the key, the site address and the plugin and WordPress version. The dashboard shows the reportedip.com news feed (https://reportedip.com/feed/?post_type=news), cached for twelve hours. If the Pro add-on is installed, it checks reportedip.com for its own updates with your key. Terms of use: https://reportedip.com/nutzungsbedingungen/. Privacy policy: https://reportedip.com/datenschutzerklaerung/.

api.pwnedpasswords.com. Only with the breach check switched on: when a user sets a new password (also on the WooCommerce and Ultimate Member account and registration forms), the first five characters of its SHA-1 hash are sent to https://api.pwnedpasswords.com/range/; the password never leaves the site. Service by Have I Been Pwned, privacy: https://haveibeenpwned.com/Privacy.

Credits

Chart.js 4.4.1 (MIT) renders the dashboard charts. Source: https://github.com/chartjs/Chart.js
qrcode-generator 1.4.4 (MIT) draws the TOTP QR code. Source: https://github.com/kazuhikoarase/qrcode-generator

Both libraries ship inside the plugin, nothing is loaded from a CDN.

ReportedIP Hive: Firewall, Brute Force Protection, 2FA and Anti-Spam

About this plugin