ReportedIP Hive Light

Descrizione

ReportedIP Hive Light is a free WordPress plugin that limits login attempts and blocks brute-force and password-spray attacks on wp-login.php. It counts failed logins per IP address, locks attackers out for a growing period of time and, if you want, checks every login attempt against the reportedip.com community blocklist. It works out of the box, needs no account and sends no data anywhere unless you switch that on.

The plugin is deliberately focused on one job: keeping attackers away from your login form. No bloat, no tracking, no nag screens.

Why site owners choose ReportedIP Hive Light

• Works in 60 seconds. Activate it, and the default settings protect your login right away. A four-step setup wizard explains every choice.
• Free and complete. Every feature in this plugin is free. Nothing is locked, there is no trial and no account is needed.
• Privacy by default. In the default Local Shield mode the plugin makes zero outbound network requests. All data stays in your own database.
• GDPR-friendly by design. Usernames are only stored as a salted SHA-256 hash and never leave your server. IP processing is based on GDPR Art. 6(1)(f). A ready-made text for your privacy policy is added to Settings → Privacy.
• Lightweight. Nine core classes, no third-party libraries, no CDN, no Google Fonts, no remote scripts. The check runs only on login requests, so front-end page speed is not affected.
• Stops password spraying, not only brute force. Attackers who try many different usernames from one IP are detected separately from classic password guessing.
• Escalating blocks. Repeat offenders are locked out for longer each time: 5 min → 15 min → 30 min → 24 h → 48 h → 7 days.
• Optional community protection. With a free Community Access Key, an IP that already attacked other sites can be refused before its first password attempt on yours.
• Never locks out real users by accident. Community lookups have a two-second timeout and fail open, and a whitelist protects your own office or agency IPs.
• Made in Germany. Developed and operated by Patrick Schlesinger in Germany, open source under GPLv2.

Features at a glance

• Limit login attempts per IP with a configurable threshold and time window (default: 5 failed logins in 15 minutes)
• Password-spray detection with its own threshold and time window (default: 5 usernames in 10 minutes)
• Progressive block ladder with configurable steps; the ladder starts over once an IP has not been blocked for 30 days
• Report-only mode that detects and reports attacks without blocking, useful for staging sites
• IP whitelist for single IPv4 and IPv6 addresses and IPv4 CIDR ranges, with an optional expiry date
• Blocked IPs list with bulk unblock
• Dashboard with active blocks, attempts and blocks in the last 24 hours, defended attacks for 24 h, 7 days, 30 days and all time, and a list of recent activity
• Real client IP detection behind Cloudflare, load balancers and reverse proxies (CF-Connecting-IP, X-Forwarded-For, X-Real-IP, True-Client-IP)
• Optional Community Network mode: IP reputation lookup at login plus an asynchronous report queue with deduplication, retry and a configurable hourly API limit
• Block page with HTTP 403 and no-cache headers, so cache plugins never store it
• Clean uninstall: optionally removes all tables and options, also on multisite
• Translation ready, with German, French and Spanish translations

Two operating modes

• Local Shield (default). Counts failed logins per IP and blocks attackers based on your thresholds. The plugin makes zero outbound network requests in this mode, all data stays on your server.
• Community Network (optional). When you enter a free Community Access Key from reportedip.com, the plugin also checks the source IP against the reportedip.com community database during login attempts and shares blocked IPs back to the community. Both calls are clearly disclosed in the settings and in the “External services” section below.

How it works

• wp_login_failed increments a per-IP counter with an atomic upsert, so there are no race conditions under concurrent attacks.
• When the counter exceeds your threshold, the IP is blocked for the next duration on the progressive ladder.
• wp_authenticate_user stops known-bad IPs before WordPress core checks the password.
• The block response is an HTTP 403 with Cache-Control: no-store, no-cache, must-revalidate, max-age=0 and Pragma: no-cache, which WP Rocket, W3 Total Cache, WP Super Cache and LiteSpeed Cache respect.

Compatibility

• WordPress 6.1 to 7.1, PHP 8.1 or newer
• WooCommerce “My Account” logins and every other login form that uses the standard wp_login_failed action
• Cache plugins: WP Rocket, W3 Total Cache, WP Super Cache, LiteSpeed Cache
• Cloudflare and other reverse proxies via the trusted proxy header setting

For developers

• Filters: reportedip_hive_is_whitelisted, reportedip_hive_get_client_ip, reportedip_hive_api_endpoint.
• Actions: reportedip_hive_log, reportedip_hive_ip_blocked, reportedip_hive_report_queued.
• Source code and issue tracker: github.com/reportedip/reportedip-hive-light

Looking for more? ReportedIP Hive Full Edition and Hive PRO

Hive Light is complete on its own and stays free, nothing in this plugin is locked or limited. If you need more than login protection, the separate Full Edition (also free and GPL-2.0, distributed via GitHub) adds 16 attack sensors including a Web Application Firewall, four 2FA methods (authenticator app, e-mail, SMS, passkeys) and multisite support. The optional Hive PRO subscription on top of the Full Edition connects your sites to a managed, EU-hosted 2FA relay for SMS and e-mail codes (no Twilio account needed) and covers three domains with one licence.

External services

This plugin can connect to the ReportedIP API at https://reportedip.com. All external requests are opt-in only. They are made exclusively when (a) a “Community Access Key” has been entered in the plugin settings and (b) the “Operation Mode” is set to “Community Network”. The default mode is “Local Shield”, which performs zero external requests.

Endpoint 1: IP-reputation lookup

• URL: https://reportedip.com/wp-json/reportedip/v2/check?ip={ip}
• HTTP verb: GET
• Auth header: X-Key: {your-access-key}
• Trigger: a login attempt reaches wp_authenticate_user
• Timeout: 2 seconds (fail-open, the login proceeds when the API does not respond)
• Data sent: only the source IP address of the current login attempt
• Data NOT sent: usernames, passwords, cookies, server identifiers, domain name

Endpoint 2: Blocked-IP report

• URL: https://reportedip.com/wp-json/reportedip/v2/report
• HTTP verb: POST (JSON body)
• Auth header: X-Key: {your-access-key}
• Trigger: a brute-force or spray threshold has been exceeded; the report is queued in the database and sent by a 15-minute cron job
• Data sent: the offending IP, an integer category ID for the threat type and a short comment (e.g. “5 failed logins in 15 minutes”)
• Data NOT sent: usernames, passwords, request bodies, domain name, contact information

Endpoint 3: Access-key verification

• URL: https://reportedip.com/wp-json/reportedip/v2/verify-key
• HTTP verb: GET
• Auth header: X-Key: {entered-key}
• Trigger: an administrator clicks “Test connection” in the plugin settings
• Data sent: only the access key under verification

Hashing of submitted usernames

When a failed login is recorded locally, the plugin stores sha256( username + wp_salt() ) only, never the plain text. The hash stays on your server; reports do not contain it.

Service provider

• Operator: Patrick Schlesinger, Germany
• Service URL: reportedip.com
• Legal notice (Impressum): reportedip.com/impressum
• Terms of use: reportedip.com/nutzungsbedingungen
• Privacy policy: reportedip.com/datenschutzerklaerung
• Source code: github.com/reportedip/reportedip-hive-light
• Contact: 1@reportedip.com

You can switch back to Local Shield mode at any time in ReportedIP Hive Light → Settings → Connection. This stops all external traffic immediately.

Bundled assets and licences

Every stylesheet and script ships inside the plugin folder: assets/css/design-system.css, assets/css/admin.css, assets/css/wizard.css and assets/js/admin.js (tab switching and the “Test connection” button, which only calls WordPress’ own admin-ajax.php). Icons are inline SVG. No CDN, no Google Fonts, no remote stylesheets or scripts are loaded, and no third-party PHP, JavaScript or CSS library is bundled. The GPLv2 licence text is included in the LICENSE file.

Privacy

• IP addresses are processed under GDPR Art. 6(1)(f) (legitimate interest in network security).
• Usernames are stored locally as a salted SHA-256 hash and are never transmitted, neither in plain text nor hashed.
• In Local Shield mode (default) no data leaves your server.
• In Community Network mode the data listed under “External services” is sent to reportedip.com.
• Data retention is configurable in Settings → Privacy. The default attempt window is 15 minutes; the API queue retention is 7 days.
• Activate “Delete all data on uninstall” in Settings → Privacy to remove all plugin tables and options when the plugin is deleted.

Disclaimer

ReportedIP Hive Light is provided “as is”, without warranty of any kind (see the LICENSE file for the full GPLv2 text). It adds a layer of defence against brute-force and password-spray login attacks but does not replace strong passwords, two-factor authentication or server-level firewalls. No single security measure is a 100 % guarantee. Site operators who enable Community Network mode are responsible for assessing the lawful basis under their data-protection regime and for updating their privacy policy.