ReportedIP Hive: Firewall, Brute Force Protection, 2FA and Anti-Spam
| 开发者 | reportedip |
|---|---|
| 更新时间 | 2026年10月30日 18:24 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
- Request inspection with a bundled ruleset against SQL injection, cross-site scripting (XSS), path traversal, command injection and vulnerability scanners.
- Pre-WordPress firewall. An optional layer (
auto_prepend_file) applies the same rules, exceptions, whitelist and IP blocks before WordPress loads. A blocked request costs almost nothing. - 404 and scanner detection. Requests for bait paths such as
.env,.git/configorwp-config.php.bakblock the address at once. - Verified bot detection. Googlebot, Bingbot and other large crawlers are confirmed through their published address ranges or reverse DNS. A fake Googlebot is treated like any other visitor.
- REST API rate limit, firewall exceptions per rule, path or IP, and a report-only mode for testing.
- IP blocking and whitelist for single addresses and CIDR ranges, with incident reference codes on the block page.
- Limit login attempts. Failed sign-ins are counted per IP address. The default blocks an address after 5 failures in 15 minutes.
- Progressive IP blocking. Six steps from 5 minutes to 7 days. The ladder resets after 30 quiet days, so a typo never costs a day.
- Password spraying detection. Many usernames tried from one address are caught separately.
- Application password protection. Failed Basic Auth sign-ins count like failed logins, so the REST API is no way around the limit.
- Hide Login. Move wp-login.php to a custom login URL.
- User enumeration protection. Author archives, the users REST route, the user sitemap and login error messages no longer reveal usernames.
- Login anomaly detection. A sign-in from a new country is logged and asks for the second factor again.
- WooCommerce login protection. My Account sign-in and registration are counted like wp-login.php.
- Password policy with minimum length, character classes and an optional breach check (off by default).
- Authenticator apps (TOTP) such as Google Authenticator, Microsoft Authenticator, Authy or 1Password.
- Passkeys and hardware security keys (WebAuthn, FIDO2), for example a YubiKey, Face ID, Touch ID or Windows Hello. One key per account.
- E-mail codes.
- Recovery codes, ten single-use codes per user.
- 2FA enforcement per user role, an enrolment wizard, trusted devices for 30 days and a password-reset gate that a stolen mailbox cannot bypass.
- WP-CLI commands to enable, reset and audit 2FA per user.
- Invisible execution proof. A hidden decoy field and a short script prove that a real browser filled in the form. A bot that fills the decoy is blocked on the first try and, in the Community Network, reported. The check carries nothing request-specific, so cached pages keep working.
- Comment spam filter. Scores links in the text and the website field, link density, the number of domains, disposable addresses, throwaway top-level domains, a domain in the author name, foreign script and text without content. Spam goes to the spam folder or is rejected.
- Comment honeypot.
- Registration spam protection for WordPress, WooCommerce and multisite sign-ups: prohibited usernames, e-mail allow and block rules, a sign-up rate limit and an optional block for sign-ins with unknown usernames. Ten entries per list.
- Disposable e-mail blocking on registrations and forms.
- Password reset spam protection. The lost-password form carries the same proof.
- Contact Form 7 spam protection with the same invisible check.
- IP reputation on forms. In the Community Network, comment, registration and password-reset submissions from known attacking addresses are refused.
- XML-RPC and pingbacks off with one switch.
- REST API for signed-in users or chosen roles only.
- Feeds, wp-admin for guests, PHP execution in the uploads folder and software version fingerprints, each a switch.
- Security headers: X-Content-Type-Options, X-Frame-Options and Referrer-Policy, with an example and a plain explanation for each, a generated nginx and Apache configuration and a check that shows which headers really reach a visitor, cached pages included.
- Protection score and a readiness check that lists what still needs attention.
- Security activity log with filters by event type, severity and date, CSV and JSON export.
- A daily summary of blocked attacks and instant alerts when something got through, such as a new administrator.
- Settings import and export.
- WP-CLI:
wp reportedip block,unblock,whitelist,lookup,statusand2fa. - Works behind Cloudflare and other reverse proxies with a trusted proxy list.
- Compatible with WP Rocket, W3 Total Cache, WP Super Cache and LiteSpeed Cache.
- Network-activated, one set of tables, IP blocks and whitelist shared by every site.
- Site admins see the activity of their own site; protection is managed by the network admin.
- MainWP dashboards read status counts and push settings through the MainWP Child plugin, with no extra child plugin.
- Local Shield is the default. The plugin makes no outbound request.
- Community Network is opt-in. With a free Community Access Key from reportedip.com the plugin checks the IP reputation of attacking addresses during sign-in and on forms, shares the addresses it blocks with the community IP blocklist and receives signed firewall, bot and disposable-domain rulesets.
- Minimal logging, retention of 30 days by default, addresses anonymised after 7 days.
- Usernames, passwords and form content never leave the site.
- A suggested text for your privacy policy is added under Settings, Privacy.
- Made in Germany.
- Managed 2FA mail relay (500 mails per month) and SMS two-factor authentication through an EU SMS gateway (25 SMS per month).
- WooCommerce two-factor authentication on My Account, the classic checkout and the WooCommerce Blocks login, inside the shop theme.
- Adaptive 2FA policies per role: ask again on a new device, IP address, network or country, every N days or sign-ins, or above a session limit.
- Hardening mode that tightens thresholds for one hour during a coordinated attack.
- Advanced security headers: Content Security Policy (CSP) builder, HSTS with preload, Permissions-Policy and Cross-Origin headers.
- Computation proof on forms, a proof of work the browser solves in the background, as a CAPTCHA alternative that a script cannot copy.
- Tor exit node blocking.
- Unlimited registration rules with regular expressions and sign-ups restricted to allowlisted IP addresses.
- Group ban lists: one block list and whitelist shared by all sites of a group.
- Spam protection for further form plugins: WPForms, Gravity Forms, Elementor Forms, Formidable Forms, Forminator, Ultimate Member and the withdrawal form of EU Order Withdrawal Button (also bundled in Germanized).
- Audit trail (activity log for changes): who changed which setting, plugin, theme, page, menu, file or user account, with old and new values and export.
- User account blocking and session management: block accounts, end sessions and review active sessions.
- Multiple security keys per account with model detection.
- Cloud fleet management of many sites from the reportedip.com dashboard.
- Higher mail and SMS quotas (2,500 mails and 75 SMS per month).
安装:
- Install the plugin from the WordPress plugin directory and activate it. On a multisite network, install it in the Network Admin and click Network Activate.
- The quickstart opens after activation, on a multisite network in the Network Admin. It lets you pick Local Shield or the Community Network and applies the recommended settings with one click. You find it again under ReportedIP Hive, System Status, Open quickstart.
- Enrol your own second factor on your profile page.
屏幕截图:
常见问题:
What is ReportedIP Hive?
ReportedIP Hive is a WordPress security plugin that combines a firewall, brute force protection with limited login attempts, two-factor authentication with passkeys and anti-spam protection for comments and forms. It runs on your own server and works without an account.
Is ReportedIP Hive free, and do I need an account?
Yes, the plugin is free under the GPL and works without any account. A free account at reportedip.com adds the community IP reputation check and synced firewall rulesets.
Does ReportedIP Hive replace a CAPTCHA or reCAPTCHA?
For most sites, yes. The invisible execution proof stops scripted submissions on comments, registrations, password resets and Contact Form 7 without a puzzle for your visitors and without loading a third-party service.
How does it stop comment spam?
Three layers: the invisible execution proof refuses bots that do not run a browser, the honeypot catches bots that fill every field, and the comment spam filter scores links, domains, disposable addresses and text without content. Spam goes to the spam folder or is rejected.
Is it GDPR compliant?
The plugin is built for GDPR compliance: logging is minimal, retention is configurable (30 days by default), addresses are anonymised after 7 days and the Community Network is opt-in. In Local Shield mode no data leaves the site.
Which data leaves my site in the Community Network?
Only the attacking IP address, the event category, the time, your site name and address, the attempt count and the plugin version. Usernames, passwords and form content never leave the site.
Does it work with WooCommerce?
Yes. The WooCommerce sign-in and registration forms get the same login attempt limits, registration rules and disposable e-mail blocking. Two-factor authentication on the storefront is part of the Pro add-on.
Does it support passkeys and YubiKeys?
Yes. Any FIDO2 or WebAuthn authenticator works as a second factor, including YubiKey hardware keys and platform passkeys such as Face ID, Touch ID and Windows Hello.
Will it slow down my site?
On an anonymous page view the plugin runs five database queries of its own. A request from a blocked address is refused by the pre-WordPress firewall in about 1.5 ms. Both figures come from a test site with 500,000 log entries and 5,000 blocked addresses. Community reports are sent in the background by WP-Cron.
How is it different from Wordfence?
Wordfence includes a malware scanner and file integrity checks; ReportedIP Hive does not. ReportedIP Hive focuses on the firewall, login security, two-factor authentication and form spam protection without CAPTCHA, sends no data in its default mode and offers an optional community IP blocklist. Many sites run a scanner next to it.
Can I use it together with another security plugin?
Yes, but switch off overlapping features. Two plugins that both limit login attempts or both ask for a second factor will lock users out twice, so keep one of each.
How is it different from a cloud firewall?
A cloud firewall filters traffic before it reaches your server, while ReportedIP Hive runs inside WordPress and sees what a cloud firewall cannot: failed sign-ins, usernames tried, form submissions and user roles. Both work well together; set the proxy header so the plugin sees the real visitor address.
Does it work behind Cloudflare or a reverse proxy?
Yes. Choose the header that carries the visitor address (CF-Connecting-IP, X-Forwarded-For, X-Real-IP, Client-IP, True-Client-IP or X-Cluster-Client-IP) and list the trusted proxy ranges.
Does it work on WordPress multisite?
Yes. The plugin is activated network-wide and keeps one set of tables for the whole network. Blocks and the whitelist apply to every site, and each site admin sees the activity of their own site.
What is in the Pro add-on?
The add-on adds SMS 2FA and a managed mail relay, WooCommerce storefront 2FA, adaptive 2FA policies, hardening mode, advanced security headers, a computation proof on forms, Tor blocking, group ban lists, protection for further form plugins, an audit trail, account blocking and fleet management. The list per plan is in the description above.
I still run version 1.3 of this plugin. What happens on the update?
Version 3.0.0 arrives like any other update from the plugin directory. Your whitelist, blocks, counters and settings are carried over, including ranges, permanent whitelist entries and the True-Client-IP or X-Cluster-Client-IP proxy header. On a multisite network where the plugin ran site by site, the data of every site moves into the network tables. Open the quickstart afterwards to pick Local Shield or the Community Network.
What if I lock myself out?
Use a recovery code, or run wp reportedip 2fa reset <user_id> and wp reportedip unblock <ip> with WP-CLI. Adding your own address to the whitelist prevents blocks in the first place.
更新日志:
- Security: the firewall blocks requests for PHP files in the core updater's staging folders (WordPress updater race fixed in 7.1.4) and bans the source on the first hit.
- On Apache the root .htaccess routes these requests to WordPress, so they are blocked even during an update; nginx snippets carry the matching lines.
- Security headers: a header check shows per header whether it arrives, is missing on cached pages or arrives twice.
- nginx and Apache configuration for the configured headers next to the settings, with copy buttons.
- With Extended protection on, pages a caching plugin delivers through PHP carry the security headers too.
- Every security header explains what it protects against, the recommended value and what it can break, with an example.
- Protection Settings sections sit in framed blocks; notices keep their text in one column.
- Next steps suggest the advanced security headers where the plan includes them and name cached pages without headers.
- Clearer page names: Protection Settings, Server & Maintenance (always in the menu) and Community & Key with the Community Access Key on its first tab.
- Protection Settings keeps label and switch together on wide screens and lists the sections of each tab.
- Dashboard: each score shows its items below it; next steps show at most four suggestions, now also for two-factor, firewall, security headers and the password policy.
- A next-step card disappears as soon as its setting is on, and the scores no longer count a firewall in test mode or two-factor roles while two-factor is off.
- Blocked attacks arrive as one daily summary instead of one mail per threshold; the setting "Blocked attacks" switches back to single mails or off.
- Instant alerts when something got through: a new administrator, an administrator signing in from a new place, or protection that failed.
- A new plan counts within the same request, and a key check without a plan no longer counts as a downgrade to Free.
- Translations no longer recurse until the memory runs out when Loco Translate or another plugin loads its own catalog on load_textdomain.
- Network activation on Multisite opens the quickstart in the Network Admin.
- A plan upgrade applies the recommended settings of the new plan also without the Pro add-on.
- The password policy and breach check also cover the WooCommerce and Ultimate Member account and registration forms; padding lines of the breach service no longer count as a hit.
- "Apply the password policy to every role" now covers every user, also next to the roles that must use two-factor; the score item is called "Password policy".
- The quickstart applies the same settings as version 2.1.74, and a form plugin installed later is protected on the next admin visit.
- The pre-WordPress firewall is rewritten after every update, and the settings hash stays stable after the update from 2.1.74.
- The firewall queue import can no longer run twice at the same time.
- German, Austrian and Swiss German translations are complete, in both the informal and the formal form.
- Every link to reportedip.com carries its campaign tag.
- The plugin now comes from the WordPress plugin directory. The former GitHub update checker is gone.
- Paid features moved to the separate ReportedIP Hive Pro add-on.
- The breach check for new passwords is off until you switch it on.
- .htaccess blocks are written after an operator action (quickstart, saving the switch, import, WP-CLI), never at activation. A site updating from 2.x with a completed quickstart keeps its blocks.
- Local Shield sends no request to reportedip.com, even with a key stored. The news feed loads only in Community Network mode.
- The footer badge stays off until you tick it in the quickstart; the dashboard no longer suggests it.
- Notices can be closed and return after an hour or a day; a critical queue or readiness problem stays until it is fixed.
- Update path from version 1.3.9: permanent and range whitelist entries, attempt counters and the proxy header are kept.
- Networks that ran version 1.3.9 per site keep the blocks, whitelist entries, counters and pending reports of every site.
- Database schema 25.