Patrick Schlesinger

<p>ReportedIP Hive Light protects WordPress logins against brute-force and password-spray attacks. It is intentionally focused: a per-IP attempt counter, a progressive block ladder, and an optional community lookup. No bloat, no dashboards, no upsell.</p>
<p><strong>Two operating modes</strong></p>
<ul>
<li><strong>Local Shield (default).</strong> Counts failed logins per IP and blocks attackers based on configurable thresholds. The plugin makes zero outbound network requests in this mode — all data stays on your server.</li>
<li><strong>Community Network (optional).</strong> When you enter a free Community Access Key from reportedip.de, the plugin additionally checks the source IP against the reportedip.de community database during login attempts and shares blocked IPs back to the community. Both calls are clearly disclosed in the settings UI.</li>
</ul>
<p><strong>How it works</strong></p>
<ul>
<li><code>wp_login_failed</code> increments a per-IP counter using an atomic upsert (no race conditions under concurrent attacks).</li>
<li>When the counter exceeds your threshold, the IP is blocked for a duration drawn from a progressive ladder (5 min <span aria-hidden="true" class="wp-exclude-emoji">→</span> 15 min <span aria-hidden="true" class="wp-exclude-emoji">→</span> 30 min <span aria-hidden="true" class="wp-exclude-emoji">→</span> 24 h <span aria-hidden="true" class="wp-exclude-emoji">→</span> 48 h <span aria-hidden="true" class="wp-exclude-emoji">→</span> 7 days).</li>
<li><code>wp_authenticate_user</code> short-circuits known-bad IPs before the WordPress core authentication runs.</li>
<li>Cache plugins (WP Rocket, W3 Total Cache, WP Super Cache, LiteSpeed) are honoured via the HTTP 403 status plus explicit <code>Cache-Control: no-store, no-cache, must-revalidate, max-age=0</code> and <code>Pragma: no-cache</code> headers on the block page.</li>
</ul>
<p><strong>Privacy</strong></p>
<ul>
<li>IP addresses are processed for the legitimate purpose of network security (GDPR Art. 6(1)(f)).</li>
<li>Usernames are stored only as a SHA-256 hash, salted with <code>wp_salt()</code>. Plain-text usernames are never persisted or transmitted.</li>
<li>In Local Shield mode, no data leaves your server. In Community Network mode, only the IP, hashed username, event type, and timestamp are sent — no domain, no contact details, no traffic data.</li>
</ul>
<p><strong>For developers</strong></p>
<ul>
<li>Filters: <code>reportedip_hive_is_whitelisted</code>, <code>reportedip_hive_get_client_ip</code>, <code>reportedip_hive_event_category_map</code>, <code>reportedip_hive_api_endpoint</code>.</li>
<li>Actions: <code>reportedip_hive_log</code>, <code>reportedip_hive_ip_blocked</code>, <code>reportedip_hive_report_queued</code>.</li>
</ul>
<p>A free Community Access Key is available at reportedip.de. The plugin works without one in Local Shield mode.</p>
<h3>External services</h3>
<p>This plugin can connect to the ReportedIP API at <code>https://reportedip.de</code>. All<br />
external requests are <strong>opt-in only</strong> — they are made exclusively when (a) a<br />
“Community Access Key” has been entered in the plugin settings and (b) the<br />
“Operation Mode” is set to “Community Network”. The default mode is “Local<br />
Shield”, which performs zero external requests.</p>
<h4>Endpoint 1: IP-reputation lookup</h4>
<ul>
<li>URL: <code>https://reportedip.de/wp-json/reportedip/v2/check?ip={ip}</code></li>
<li>HTTP verb: GET</li>
<li>Auth header: <code>X-Key: {your-access-key}</code></li>
<li>Trigger: a login attempt reaches <code>wp_authenticate_user</code></li>
<li>Timeout: 2 seconds (fail-open — login proceeds when the API does not respond)</li>
<li>Data sent: only the source IP address of the current login attempt</li>
<li>Data NOT sent: usernames, passwords, cookies, server identifiers, domain name</li>
</ul>
<h4>Endpoint 2: Blocked-IP report</h4>
<ul>
<li>URL: <code>https://reportedip.de/wp-json/reportedip/v2/report</code></li>
<li>HTTP verb: POST (JSON body)</li>
<li>Auth header: <code>X-Key: {your-access-key}</code></li>
<li>Trigger: a brute-force / spray threshold has been exceeded; the report is<br />
queued in the database and dispatched by a 15-minute cron job</li>
<li>Data sent: the offending IP, an integer category ID for the threat type,<br />
and a short human-readable comment (e.g. “5 failed logins in 15 minutes”)</li>
<li>Data NOT sent: usernames in plain text, passwords, full request bodies,<br />
domain name, contact information</li>
</ul>
<h4>Endpoint 3: Access-key verification</h4>
<ul>
<li>URL: <code>https://reportedip.de/wp-json/reportedip/v2/verify-key</code></li>
<li>HTTP verb: GET</li>
<li>Auth header: <code>X-Key: {entered-key}</code></li>
<li>Trigger: an administrator clicks “Test connection” in the plugin settings</li>
<li>Data sent: only the access key under verification</li>
</ul>
<h4>Hashing of submitted usernames</h4>
<p>When a brute-force attempt is detected and the failing username is recorded<br />
locally, the plugin stores <code>sha256( username + wp_salt() )</code> only — never the<br />
plain text. The salted hash is also what would be transmitted with a report,<br />
preventing recipients from recovering the original username.</p>
<h4>Service provider</h4>
<ul>
<li>Operator: Patrick Schlesinger, Germany</li>
<li>Service URL: <a href="https://reportedip.de" rel="nofollow ugc">reportedip.de</a></li>
<li>Legal notice (Impressum): <a href="https://reportedip.de/impressum/" rel="nofollow ugc">reportedip.de/impressum</a></li>
<li>Terms of use: <a href="https://reportedip.de/nutzungsbedingungen/" rel="nofollow ugc">reportedip.de/nutzungsbedingungen</a></li>
<li>Privacy policy: <a href="https://reportedip.de/datenschutzerklaerung/" rel="nofollow ugc">reportedip.de/datenschutzerklaerung</a></li>
<li>Source code: <a href="https://github.com/reportedip/reportedip-hive-light" rel="nofollow ugc">github.com/reportedip/reportedip-hive-light</a></li>
<li>Contact: <a href="mailto:1@reportedip.de" rel="nofollow ugc">1@reportedip.de</a></li>
</ul>
<p>You can switch back to Local Shield mode at any time in <em>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> ReportedIP<br />
Hive <span aria-hidden="true" class="wp-exclude-emoji">→</span> Connection</em>. Doing so stops all external traffic immediately.</p>
<h3>Bundled assets</h3>
<p>This plugin ships every stylesheet and script it needs inside the plugin<br />
folder. <strong>No CDN, no Google Fonts, no remote stylesheets, no remote scripts<br />
are loaded</strong> — every asset URL begins with the plugin’s own<br />
    wp-content/plugins/reportedip-hive/ path.</p>
<p>The full list of bundled, locally-served assets:</p>
<ul>
<li><code>assets/css/design-system.css</code> — design tokens and components used on<br />
every plugin admin page.</li>
<li><code>assets/css/admin.css</code> — admin-page overrides on top of the design<br />
system.</li>
<li><code>assets/css/wizard.css</code> — standalone styles for the first-run setup<br />
wizard.</li>
<li><code>assets/js/admin.js</code> — handles tab switching and the AJAX<br />
“Test connection” button. Its only network call is <code>fetch()</code> against<br />
WordPress’ own <code>admin-ajax.php</code> (same origin); no third-party endpoint<br />
is contacted.</li>
<li>Inline SVG icons (the shield logo, the menu icon, and trust-badge<br />
glyphs) are emitted from PHP via <code>wp_kses()</code> with an explicit allow-list<br />
— no <code><img></code> element points at an external host.</li>
</ul>
<p>The complete list of files distributed in the WordPress.org ZIP is<br />
visible at <em>Plugins <span aria-hidden="true" class="wp-exclude-emoji">→</span> Plugin File Editor</em> once the plugin is installed.</p>
<h3>Third-party services and licences</h3>
<ul>
<li><strong>GPLv2 (or later) licence text</strong> is bundled with the plugin in the<br />
  LICENSE file at the plugin root and is also referenced from the<br />
plugin header (<code>License URI: https://www.gnu.org/licenses/gpl-2.0.html</code>).</li>
<li><strong>No third-party PHP, JavaScript, or CSS libraries are bundled</strong> with<br />
the plugin. There is no Composer <code>vendor/</code> directory, no jQuery copy,<br />
no minified third-party bundle. WordPress itself supplies any global<br />
scripts (<code>jquery</code>, <code>wp-list-table</code>, etc.) and the plugin only depends<br />
on WordPress core APIs.</li>
<li>The only external HTTP service the plugin can talk to is the<br />
  https://reportedip.de/wp-json/reportedip/v2/ API, and only when the<br />
administrator has explicitly enabled Community Network mode — see<br />
the “External services” section above for the full data flow.</li>
</ul>
<h3>Privacy</h3>
<ul>
<li>IP addresses are processed under GDPR Art. 6(1)(f) (legitimate interest in network security).</li>
<li>Usernames are stored as a salted SHA-256 hash; plain-text values are never persisted or transmitted.</li>
<li>In Local Shield mode (default) no data leaves your server.</li>
<li>In Community Network mode the data listed above is sent to reportedip.de.</li>
<li>Data retention is configurable in <em>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Privacy</em>. The default attempt window is 15 minutes; the API queue retention is 7 days.</li>
<li>Activate “Delete all data on uninstall” in <em>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Privacy</em> to remove all plugin tables and options when the plugin is deleted.</li>
</ul>
<h3>Disclaimer</h3>
<p>ReportedIP Hive Light is provided “as is”, without warranty of any kind, express or<br />
implied, including but not limited to warranties of merchantability, fitness<br />
for a particular purpose, and non-infringement. The author shall not be liable<br />
for any claim, damages, or other liability arising from the use of this<br />
software (this is the standard GPLv2-or-later disclaimer; see the LICENSE<br />
file for the full text).</p>
<p>The plugin provides defense-in-depth against brute-force and password-spray<br />
login attacks. It does <strong>not</strong> replace strong passwords, two-factor<br />
authentication, server-level firewalls, or web-application firewalls. No<br />
single security measure offers a 100 % guarantee against compromise. You<br />
remain responsible for the overall security posture of your WordPress site.</p>
<p>The optional Community Network mode forwards data to the third-party service<br />
operated at https://reportedip.de — see the “External services” section<br />
above for the full data flow. Site operators that enable Community Network<br />
mode are responsible for assessing the lawful basis under their applicable<br />
data-protection regime (in the EU, GDPR Art. 6(1)(f) — legitimate interest<br />
in network security — typically applies) and for updating their own privacy<br />
policy accordingly.</p>


ReportedIP Hive Light

Lightweight brute-force login protection with optional community-powered IP reputation checks.

miniOrange

miniorangesecurity

<p>A firewall security is a network security application that monitors and filters incoming and outgoing network traffic (IP Address). A firewall security, is a barrier that sits between a private internal network and the public Internet.</p>
<h4>FEATURE-RICH, EASY TO USE, STABLE, SECURE AND WELL SUPPORTED WORDPRESS FIREWALL SECURITY PLUGIN</h4>
<p>Firewall reduces security risk by checking for vulnerabilities, and by implementing and enforcing the latest recommended WordPress security practices and techniques.<br />
Our security and firewall rules are categorized into “essential(basic)” and “advanced”. This way you can apply the firewall rules progressively without breaking your site’s functionality.<br />
Easy way to block country and to block IP. Using firewall security plugin admin can protect the website from unwanted traffic, and bad bots. The firewall protects your website from different kinds of attacks. And provides a security layer on your website.<br />
<em>GDPR Compliant</em></p>
<p>What does a Web Application Firewall (WAF) exactly do?</p>
<p>A WAF/firewall keeps a track of the HTTP traffic that comes to your website/web application. Basically, it monitors all the requests that are coming to your web application/website. If the WAF feels that the incoming requests are suspicious i.e. if the incoming request can harm your website (eg. the request may contain some code that can make some changes to your database or an unauthorized person/hacker would be able to gain access to your web application) WAF blocks those requests and prevents your website from unwanted attacks. Basically WAF filters and blocks suspicious or unwanted HTTP traffic to and from a web application.</p>
<p>The following is a list of the security and firewall features provided by miniorange firewall security plugin:</p>
<h4>User Login Security</h4>
<ul>
<li>The login locked out  protects against “Brute Force Login Attacks.” Users with a specific IP address or range will be locked out of the system for a predetermined period of time-based on the configuration settings, and you can also opt to be notified via email whenever someone is locked out due to too many login attempts.</li>
<li>As the administrator, you can view a list of all locked out users in an easily readable and navigable table, as well as unblock individual or bulk IP addresses with the click of a button.</li>
<li>Monitor/view failed login attempts, which include the user’s IP address, User ID/Username, and the date and time of the failed login attempt.</li>
<li>Keep track of the username, IP address, login date/time, and logout date/time for all user accounts on your system to monitor/view their account activity.</li>
<li>Allows you to add one or more IP addresses to a whitelist.</li>
<li>Add Google reCaptcha to your WP Login form and forget password form.</li>
</ul>
<h4>File System Security</h4>
<ul>
<li>Identify files or folders with insecure permission settings and, change the permissions to the recommended secure values.</li>
<li>Protect your PHP code by disabling file editing and prevent people from accessing the readme.html, license.txt, and wp-config.php files of your WordPress site.</li>
</ul>
<h4>htaccess and wp-config.php File Backup and Restore</h4>
<ul>
<li>Easily backup your original .htaccess and wp-config.php files in case you need to use them to restore broken functionality and also you can modify the contents of the current htaccess or wp-config.php file.</li>
</ul>
<h4>Blacklist Functionality</h4>
<ul>
<li>Users can be blocked by specifying their user agents or IP addresses  by using a wildcard to specify IP ranges.</li>
</ul>
<h4>Firewall Functionality</h4>
<ul>
<li>This plugin makes it simple to add a lot of firewall protection to your site via the htaccess file. Your web server processes a htaccess file before loading any other code on your site.</li>
<li>Access control facility.</li>
<li>Instantly activate a selection of firewall settings ranging from basic, intermediate, and advanced.</li>
<li>Deny bad or malicious query strings.</li>
<li>Protect against Cross-Site Scripting and more.</li>
</ul>
<h4>Brute force login attack prevention</h4>
<ul>
<li>This firewall feature will prevent all login attempts from humans and bots.  It is possible to hide the admin login page. Change the URL of your WordPress login page so that bots and hackers cannot access your actual WordPress login URL. You can use this feature to change the default login page (wp-login.php) to something you specify.</li>
</ul>
<h4>Security Scanner</h4>
<ul>
<li>If any files in your WordPress system have changed, the file change detection scanner will notify you. You can then investigate to see if the change was legitimate or if malicious code was injected.</li>
</ul>
<h4>Comment SPAM Security</h4>
<ul>
<li>Monitor the most active IP addresses which persistently produce the most SPAM comments using google reCaptcha and instantly block them with the click of a button.</li>
</ul>
<h4>Regular updates and additions of new security features</h4>
<ul>
<li>WordPress security is a living thing that changes over time. Our Firewall Security will regularly update with new security features, so you can be confident that your site will be up to the mark of security protection techniques.</li>
</ul>
<h4>FREE Plugin Feature</h4>
<ul>
<li><strong>Plugin Level Waf:</strong> IPs blocked by admin will be blocked on WordPress site load. It is less secure than htaccess level WAF.</li>
<li><strong>Rate Limiting:</strong> It helps to prevent DoS attacks on your site. You can set hit/min for each IP.</li>
<li>** SQL Attack Detection and Blocking:** Cyber attacks and suspicious activities will be detected and access to the site for that IP will be blocked.</li>
</ul>
<h4>htaccess and wp-config.php File Backup and Restore</h4>
<ul>
<li>Easily backup your original .htaccess and wp-config.php files in case you will need to use them to restore broken functionality.</li>
<li>Modify the contents of the currently active .htaccess or wp-config.php files from the admin dashboard with only a few clicks</li>
<li><strong>Email Notification:</strong> Admin can get a notification on email for any suspicious activity detected on site.</li>
<li><strong>Report:</strong> Admin can see the login failed/success, attacks report in the report.</li>
<li><strong>reCaptcha Protection</strong> Google services are used to provide ReCaptcha protection.</li>
</ul>
<h4>Premium Plugin Feature</h4>
<ul>
<li><strong>htaccess Level WAF:</strong> IPs blocked by admin will be blocked on the server only. These IPs won’t able to access the site.</li>
<li><strong>Real-Time IP Blocking:</strong> This firewall feature protects your site from those IPs which are marked as spam by miniOrange WAF.</li>
<li><strong>Rate Limiting for Crawler:</strong> Web crawler crawls your Website to increase your ranking in the search engine. But sometimes they can make so many requests to the server that the service can get damaged. By enabling this feature you can provide a limit at which a crawler can visit your site.</li>
<li><strong>Advance Blocking:</strong> You can block particular country, IP range, Single IP, browser, and HTTP referrers from gaining access to your site.</li>
<li><strong>Fake Web Crawler Protection:</strong> Web Crawlers are used for scanning the Website and indexing it. Google, Bing, etc. are the top crawlers that increase your site’s indexing in the search engine. There are several fake crawlers that can damage your site.</li>
<li><strong>Whitelist Crawler:</strong> You can whitelist the top crawler which increases the indexing of your website in the search engine. By enabling this feature the whitelisted crawler will not get throttled/blocked by rate-limiting.</li>
<li><strong>BotNet Protection:</strong> BotNet is a network of robots or an army of robots. The BotNet is used for Distributed denial of service attacks. The attacker sends too many requests from multiple IPs to a service so that the legitimate traffic can not get the service.</li>
<li><strong>Remote File Inclusion Protection:</strong> It protects from adding files from a remote server to your server.</li>
<li><strong>Remote Code Execution Protection:</strong> It Protects from executing malicious commands on your server.</li>
<li><strong>Bot Detection</strong> detect bots with malicious intent and stop them from accessing and affecting your site.</li>
<li><strong>Live Monitoring and Auditing</strong> Tracking activity all the requests realtime can help you check activities on your sites on important events</li>
</ul>
<h4>Plugin Support</h4>
<ul>
<li>If you have a question or problem with the Web Application Firewall Security plugin, post it on the support forum and we will help you.<br />
Customized solutions and Active support are available. Email us at 2fasupport@xecurify.com or call us at +1 9786589387.</li>
</ul>
<p>Check the following page for F.A.Q (see the FAQ section):<br />
https://security.miniorange.com/</p>
<h3>Privacy Policy</h3>
<p>This firewall security plugin may collect IP addresses for security reasons such as mitigating brute force login threats and malicious activity, the collected information is stored on your server. No information is transmitted to third parties or remote server locations via firewall security.</p>


Web Application Firewall – website security

Web Application Firewall allows you to easily and secure firewall protection to your site via htaccess file. Although it can be installed and configur …

ReportedIP Hive Light vs Web Application Firewall – website security