Patrick Schlesinger

<p>ReportedIP Hive Light protects WordPress logins against brute-force and password-spray attacks. It is intentionally focused: a per-IP attempt counter, a progressive block ladder, and an optional community lookup. No bloat, no dashboards, no upsell.</p>
<p><strong>Two operating modes</strong></p>
<ul>
<li><strong>Local Shield (default).</strong> Counts failed logins per IP and blocks attackers based on configurable thresholds. The plugin makes zero outbound network requests in this mode — all data stays on your server.</li>
<li><strong>Community Network (optional).</strong> When you enter a free Community Access Key from reportedip.de, the plugin additionally checks the source IP against the reportedip.de community database during login attempts and shares blocked IPs back to the community. Both calls are clearly disclosed in the settings UI.</li>
</ul>
<p><strong>How it works</strong></p>
<ul>
<li><code>wp_login_failed</code> increments a per-IP counter using an atomic upsert (no race conditions under concurrent attacks).</li>
<li>When the counter exceeds your threshold, the IP is blocked for a duration drawn from a progressive ladder (5 min <span aria-hidden="true" class="wp-exclude-emoji">→</span> 15 min <span aria-hidden="true" class="wp-exclude-emoji">→</span> 30 min <span aria-hidden="true" class="wp-exclude-emoji">→</span> 24 h <span aria-hidden="true" class="wp-exclude-emoji">→</span> 48 h <span aria-hidden="true" class="wp-exclude-emoji">→</span> 7 days).</li>
<li><code>wp_authenticate_user</code> short-circuits known-bad IPs before the WordPress core authentication runs.</li>
<li>Cache plugins (WP Rocket, W3 Total Cache, WP Super Cache, LiteSpeed) are honoured via the HTTP 403 status plus explicit <code>Cache-Control: no-store, no-cache, must-revalidate, max-age=0</code> and <code>Pragma: no-cache</code> headers on the block page.</li>
</ul>
<p><strong>Privacy</strong></p>
<ul>
<li>IP addresses are processed for the legitimate purpose of network security (GDPR Art. 6(1)(f)).</li>
<li>Usernames are stored only as a SHA-256 hash, salted with <code>wp_salt()</code>. Plain-text usernames are never persisted or transmitted.</li>
<li>In Local Shield mode, no data leaves your server. In Community Network mode, only the IP, hashed username, event type, and timestamp are sent — no domain, no contact details, no traffic data.</li>
</ul>
<p><strong>For developers</strong></p>
<ul>
<li>Filters: <code>reportedip_hive_is_whitelisted</code>, <code>reportedip_hive_get_client_ip</code>, <code>reportedip_hive_event_category_map</code>, <code>reportedip_hive_api_endpoint</code>.</li>
<li>Actions: <code>reportedip_hive_log</code>, <code>reportedip_hive_ip_blocked</code>, <code>reportedip_hive_report_queued</code>.</li>
</ul>
<p>A free Community Access Key is available at reportedip.de. The plugin works without one in Local Shield mode.</p>
<h3>External services</h3>
<p>This plugin can connect to the ReportedIP API at <code>https://reportedip.de</code>. All<br />
external requests are <strong>opt-in only</strong> — they are made exclusively when (a) a<br />
“Community Access Key” has been entered in the plugin settings and (b) the<br />
“Operation Mode” is set to “Community Network”. The default mode is “Local<br />
Shield”, which performs zero external requests.</p>
<h4>Endpoint 1: IP-reputation lookup</h4>
<ul>
<li>URL: <code>https://reportedip.de/wp-json/reportedip/v2/check?ip={ip}</code></li>
<li>HTTP verb: GET</li>
<li>Auth header: <code>X-Key: {your-access-key}</code></li>
<li>Trigger: a login attempt reaches <code>wp_authenticate_user</code></li>
<li>Timeout: 2 seconds (fail-open — login proceeds when the API does not respond)</li>
<li>Data sent: only the source IP address of the current login attempt</li>
<li>Data NOT sent: usernames, passwords, cookies, server identifiers, domain name</li>
</ul>
<h4>Endpoint 2: Blocked-IP report</h4>
<ul>
<li>URL: <code>https://reportedip.de/wp-json/reportedip/v2/report</code></li>
<li>HTTP verb: POST (JSON body)</li>
<li>Auth header: <code>X-Key: {your-access-key}</code></li>
<li>Trigger: a brute-force / spray threshold has been exceeded; the report is<br />
queued in the database and dispatched by a 15-minute cron job</li>
<li>Data sent: the offending IP, an integer category ID for the threat type,<br />
and a short human-readable comment (e.g. “5 failed logins in 15 minutes”)</li>
<li>Data NOT sent: usernames in plain text, passwords, full request bodies,<br />
domain name, contact information</li>
</ul>
<h4>Endpoint 3: Access-key verification</h4>
<ul>
<li>URL: <code>https://reportedip.de/wp-json/reportedip/v2/verify-key</code></li>
<li>HTTP verb: GET</li>
<li>Auth header: <code>X-Key: {entered-key}</code></li>
<li>Trigger: an administrator clicks “Test connection” in the plugin settings</li>
<li>Data sent: only the access key under verification</li>
</ul>
<h4>Hashing of submitted usernames</h4>
<p>When a brute-force attempt is detected and the failing username is recorded<br />
locally, the plugin stores <code>sha256( username + wp_salt() )</code> only — never the<br />
plain text. The salted hash is also what would be transmitted with a report,<br />
preventing recipients from recovering the original username.</p>
<h4>Service provider</h4>
<ul>
<li>Operator: Patrick Schlesinger, Germany</li>
<li>Service URL: <a href="https://reportedip.de" rel="nofollow ugc">reportedip.de</a></li>
<li>Legal notice (Impressum): <a href="https://reportedip.de/impressum/" rel="nofollow ugc">reportedip.de/impressum</a></li>
<li>Terms of use: <a href="https://reportedip.de/nutzungsbedingungen/" rel="nofollow ugc">reportedip.de/nutzungsbedingungen</a></li>
<li>Privacy policy: <a href="https://reportedip.de/datenschutzerklaerung/" rel="nofollow ugc">reportedip.de/datenschutzerklaerung</a></li>
<li>Source code: <a href="https://github.com/reportedip/reportedip-hive-light" rel="nofollow ugc">github.com/reportedip/reportedip-hive-light</a></li>
<li>Contact: <a href="mailto:1@reportedip.de" rel="nofollow ugc">1@reportedip.de</a></li>
</ul>
<p>You can switch back to Local Shield mode at any time in <em>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> ReportedIP<br />
Hive <span aria-hidden="true" class="wp-exclude-emoji">→</span> Connection</em>. Doing so stops all external traffic immediately.</p>
<h3>Bundled assets</h3>
<p>This plugin ships every stylesheet and script it needs inside the plugin<br />
folder. <strong>No CDN, no Google Fonts, no remote stylesheets, no remote scripts<br />
are loaded</strong> — every asset URL begins with the plugin’s own<br />
    wp-content/plugins/reportedip-hive/ path.</p>
<p>The full list of bundled, locally-served assets:</p>
<ul>
<li><code>assets/css/design-system.css</code> — design tokens and components used on<br />
every plugin admin page.</li>
<li><code>assets/css/admin.css</code> — admin-page overrides on top of the design<br />
system.</li>
<li><code>assets/css/wizard.css</code> — standalone styles for the first-run setup<br />
wizard.</li>
<li><code>assets/js/admin.js</code> — handles tab switching and the AJAX<br />
“Test connection” button. Its only network call is <code>fetch()</code> against<br />
WordPress’ own <code>admin-ajax.php</code> (same origin); no third-party endpoint<br />
is contacted.</li>
<li>Inline SVG icons (the shield logo, the menu icon, and trust-badge<br />
glyphs) are emitted from PHP via <code>wp_kses()</code> with an explicit allow-list<br />
— no <code><img></code> element points at an external host.</li>
</ul>
<p>The complete list of files distributed in the WordPress.org ZIP is<br />
visible at <em>Plugins <span aria-hidden="true" class="wp-exclude-emoji">→</span> Plugin File Editor</em> once the plugin is installed.</p>
<h3>Third-party services and licences</h3>
<ul>
<li><strong>GPLv2 (or later) licence text</strong> is bundled with the plugin in the<br />
  LICENSE file at the plugin root and is also referenced from the<br />
plugin header (<code>License URI: https://www.gnu.org/licenses/gpl-2.0.html</code>).</li>
<li><strong>No third-party PHP, JavaScript, or CSS libraries are bundled</strong> with<br />
the plugin. There is no Composer <code>vendor/</code> directory, no jQuery copy,<br />
no minified third-party bundle. WordPress itself supplies any global<br />
scripts (<code>jquery</code>, <code>wp-list-table</code>, etc.) and the plugin only depends<br />
on WordPress core APIs.</li>
<li>The only external HTTP service the plugin can talk to is the<br />
  https://reportedip.de/wp-json/reportedip/v2/ API, and only when the<br />
administrator has explicitly enabled Community Network mode — see<br />
the “External services” section above for the full data flow.</li>
</ul>
<h3>Privacy</h3>
<ul>
<li>IP addresses are processed under GDPR Art. 6(1)(f) (legitimate interest in network security).</li>
<li>Usernames are stored as a salted SHA-256 hash; plain-text values are never persisted or transmitted.</li>
<li>In Local Shield mode (default) no data leaves your server.</li>
<li>In Community Network mode the data listed above is sent to reportedip.de.</li>
<li>Data retention is configurable in <em>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Privacy</em>. The default attempt window is 15 minutes; the API queue retention is 7 days.</li>
<li>Activate “Delete all data on uninstall” in <em>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Privacy</em> to remove all plugin tables and options when the plugin is deleted.</li>
</ul>
<h3>Disclaimer</h3>
<p>ReportedIP Hive Light is provided “as is”, without warranty of any kind, express or<br />
implied, including but not limited to warranties of merchantability, fitness<br />
for a particular purpose, and non-infringement. The author shall not be liable<br />
for any claim, damages, or other liability arising from the use of this<br />
software (this is the standard GPLv2-or-later disclaimer; see the LICENSE<br />
file for the full text).</p>
<p>The plugin provides defense-in-depth against brute-force and password-spray<br />
login attacks. It does <strong>not</strong> replace strong passwords, two-factor<br />
authentication, server-level firewalls, or web-application firewalls. No<br />
single security measure offers a 100 % guarantee against compromise. You<br />
remain responsible for the overall security posture of your WordPress site.</p>
<p>The optional Community Network mode forwards data to the third-party service<br />
operated at https://reportedip.de — see the “External services” section<br />
above for the full data flow. Site operators that enable Community Network<br />
mode are responsible for assessing the lawful basis under their applicable<br />
data-protection regime (in the EU, GDPR Art. 6(1)(f) — legitimate interest<br />
in network security — typically applies) and for updating their own privacy<br />
policy accordingly.</p>


ReportedIP Hive Light

Lightweight brute-force login protection with optional community-powered IP reputation checks.

NeeB Plugins

<p>Access Guard is a comprehensive WordPress plugin that enhances access protection, controls user permissions, and provides IP banning functionality. With Access Guard, you can safeguard your website from malicious users, protect sensitive content, and strengthen overall security measures.</p>
<h3>Free Features</h3>
<ul>
<li>IP Blocking: Easily ban specific IP addresses or IP ranges to prevent unwanted traffic and protect your website from malicious users.</li>
<li>Customizable Ban Messages: Personalize the messages displayed to blocked users, providing instructions or redirecting them to alternative content.</li>
<li>User Role-Based Access Control: Define access permissions for different user roles, restricting content visibility or interaction based on user roles.</li>
</ul>
<h3>Coming Soon</h3>
<ul>
<li>Password Protection: Add password protection to specific pages or posts, granting access only to those who enter the correct password.</li>
<li>Time-Based Access Control: Set time-based restrictions to make content available for a limited period, perfect for time-sensitive promotions or temporary exclusivity.</li>
<li>IP Whitelisting: Whitelist specific IP addresses or IP ranges, allowing access only to designated users or regions.</li>
<li>Activity Logging: Keep track of user activities, including IP ban events and access attempts, to monitor website security.</li>
<li>Basic Brute Force Protection: Implement basic protection against brute force attacks by limiting login attempts.</li>
</ul>
<h3>Paid Features ( Coming Soon )</h3>
<ul>
<li>Advanced Brute Force Protection: Enhance login security with advanced measures like CAPTCHA verification, two-factor authentication, and login attempt limiting.</li>
<li>Advanced IP Blocking: Unlock advanced IP blocking options, such as blocking entire countries or regions based on IP geolocation data.</li>
<li>Advanced Access Control Rules: Create complex access control rules based on user roles, specific conditions, or custom criteria.</li>
<li>Advanced Activity Logging and Notifications: Receive detailed email notifications for critical events, and access comprehensive activity logs with advanced filtering and search options.</li>
<li>Multisite Support: Extend Access Guard’s capabilities to WordPress multisite installations, managing access and IP blocking across multiple sites.</li>
<li>Developer API: Utilize a developer-friendly API to extend Access Guard’s functionality or integrate it with other plugins or custom solutions.</li>
<li>Priority Support: Access premium support channels, including priority email support and dedicated assistance from the plugin developers.</li>
</ul>
<h3>License</h3>
<p>This plugin is licensed under the GPLv2 or later. For more details, see the License URI mentioned above.</p>
<h3>Support</h3>
<p>For any support inquiries or feature requests, please email <a href="mailto:neebplugins@gmail.com" rel="nofollow ugc">neebplugins@gmail.com</a> or contact <a href="https://neebplugins.com/support-desk/" rel="nofollow ugc">Support Desk</a></p>


Access Guard


I was looking for a lightweight plugin solution just to secure account  and Access Guard is exactly what I was looking for. It is super helpful, the plugin is great, and if I could give 6 stars I would.


Excellent Plugin & Service

Access Guard enhances security by managing user permissions and banning IPs to protect sensitive content.

ReportedIP Hive Light vs Access Guard