WPDeveloper<\/a>,<\/strong> a leading WordPress product company used and loved by 6 million users and businesses.<\/p>\n\nExternal services<\/h3>\n\n
BetterShield contacts seven outside addresses, BetterShield Hub only with the Hub link on; the hub reaches the site once you connect it. It contacts four addresses operated by WordPress.org, all to check that your files still match the official ones and to put an official file back if you ask. It contacts your own AI provider only if you have connected one, the Pwned Passwords service only if you switch on the breached-password check, and the usage service only if you choose to share usage data.<\/p>\n\n
api.wordpress.org<\/strong> \u2014 the published checksums for your WordPress version, when the file check runs on its schedule or when you start one; the request carries your WordPress version and language. Once a day it also asks whether the directory still lists a few of the plugins you installed from it; that request carries the plugin's slug only. Plugins you choose to install in the Quick Setup's optional last step are fetched by WordPress's own installer, from here and downloads.wordpress.org.<\/p>\n\ndownloads.wordpress.org<\/strong> \u2014 the published checksums for a directory plugin at the exact version you have, during the same check and whenever a plugin is installed or updated, including automatic updates. The request carries the plugin's slug and version.<\/p>\n\ncore.svn.wordpress.org<\/strong> and plugins.svn.wordpress.org<\/strong> \u2014 the official copy of one file, fetched only when you press Restore on a changed file. The request carries the version and the file's path, and the copy is checked against the published checksum before anything is written.<\/p>\n\napi.pwnedpasswords.com<\/strong> \u2014 the Pwned Passwords service by Have I Been Pwned, only if you switch on \u201cRefuse passwords found in known breaches\u201d, and only when someone signed in to your site sets or changes a password. The password is hashed on your server and only the first five characters of the hash are sent; the comparison happens on your server. No password, account name, email, site address or identifier is sent. Documentation: https:\/\/haveibeenpwned.com\/API\/v3#PwnedPasswords \u2014 terms of use: https:\/\/haveibeenpwned.com\/TermsOfUse \u2014 privacy policy: https:\/\/haveibeenpwned.com\/Privacy<\/p>\n\nsend.wpinsight.com<\/strong> \u2014 WPDeveloper's usage service, only if you choose to share usage data (Allow & Continue on the first Quick Setup step; Skip sends nothing). At most once a day, and once when you deactivate BetterShield, it sends your site address and title, administrator email, WordPress, PHP and web server versions, language settings, whether the site is multisite, the installed and active plugins, your theme and its version, BetterShield's version and folder name, and the report reference. Never anything about your visitors, users, sign-ins or findings. Turn it off under Settings > General. Terms and conditions: https:\/\/wpdeveloper.com\/terms-and-conditions \u2014 privacy policy: https:\/\/wpdeveloper.com\/privacy-policy<\/p>\n\nBetterShield Hub<\/strong> (hub.bettershield.ai, or the address you set under BetterShield > Hub), only if you connect the site and approve it on this site's own consent page. Pressing Connect sends your browser to the hub with this site's address, a return address, the access you chose and a single-use ticket. Once connected, it reads the score, findings, tools and the activity log, which names the account behind each change and its truncated networks, and checks the front page every few minutes. With the Hub link on, this site sends it security events every five minutes, accounts as digests and networks truncated, and a heartbeat of versions and digests, signed with a key kept here. Turning the link off stops it; Disconnect ends both. Terms of service: https:\/\/bettershield.ai\/terms \u2014 privacy policy: https:\/\/bettershield.ai\/privacy<\/p>\n\nYour own AI provider<\/strong>, only if you have connected one to WordPress and only when you ask for an explanation: of one finding, of your open findings with Explain my audit, or of an incident. WordPress sends the request through your connector under Settings > Connectors; BetterShield never sees, asks for or stores the key. For one finding it sends that finding's title, severity, description and recorded evidence. Explain my audit sends the titles, severities and recorded evidence of up to twelve open findings in one request. An incident's explanation sends what was recorded about it, with accounts and files named only as placeholders such as \"account-1\". Web and email addresses are stripped, and file contents, usernames, keys and your site's address are never sent.<\/p>\n\nNone of the WordPress.org requests carries anything about your site: no site address, email, username, IP address, keys, file contents or identifier. They happen on a schedule, when you press a button, or when a plugin is installed or updated, never while a visitor loads a page. If a service cannot be reached, the check says it could not run rather than reporting a file as unchanged.<\/p>\n\n
The four WordPress.org addresses are provided by the WordPress Foundation. Privacy policy: https:\/\/wordpress.org\/about\/privacy\/ \u2014 cookie policy: https:\/\/wordpress.org\/about\/privacy\/cookies\/<\/p>\n\n
Published vulnerability advisories<\/strong> \u2014 not contacted in this version. No data source is connected, and the Findings screen says so. When one is, this section will name it and say what is sent, and the check will stay off until you turn it on.<\/p>\n\nWhat it keeps about people<\/h3>\n\n
Everything BetterShield keeps about a person stays on your own server: activity log rows, sign-in attempts, passkeys and account records, with IP addresses truncated to a network before they are stored. The FAQ above describes each record. Tools > Export Personal Data and Tools > Erase Personal Data both support BetterShield, and Tools > Site Health > Info lists every record, why it is kept and for how long.<\/p>\n\n
Source code<\/h3>\n\n
Everything that runs is readable in the plugin folder. The PHP in src\/<\/code> is not generated, compiled or minified. The admin interface is compiled into assets\/build\/<\/code> (scripts, stylesheets and small generated PHP files that list each script's dependencies) from the sources in assets\/js\/<\/code> and assets\/css\/<\/code>, which ship next to it. To rebuild, run npm install<\/code> and then npm run build<\/code>, which uses @wordpress\/scripts from the included package.json<\/code>.<\/p>\n\n\n\n- In your dashboard, go to Plugins > Add Plugin, search for \"BetterShield\", then install and activate it. Or upload the folder to
\/wp-content\/plugins\/bettershield<\/code>.<\/li>\n- On activation, a read-only security audit runs, your recovery link is emailed to the site's admin address, and the Quick Setup opens.<\/li>\n
- Open BetterShield<\/strong> in the admin menu to see your score and findings.<\/li>\n<\/ol>\n\n
Apart from refusing requests to cloud-metadata addresses, no hardening fix, required two-factor or passkey-only sign-in is switched on until you choose it.<\/strong> A few protections start at activation, and each can be switched off:<\/p>\n\n\n- Refusing other plugins\u2019 requests to cloud-metadata addresses<\/li>\n
- Login attempt limits<\/li>\n
- A hidden bot check on the login, registration, WooCommerce account and comment forms<\/li>\n
- Limits on the comment, password reset and sign-up forms<\/li>\n
- Minimum password lengths<\/li>\n
- Weekly and instant email alerts<\/li>\n<\/ul>\n\n\n
\nIs BetterShield free?<\/h3><\/dt>\nYes. The audit, every plain-language explanation, all 17 fixes and their undo, two-factor authentication, passkeys, login protection, the recovery link, the activity log, incident response, the file check and the MCP server are free. There is no account and no payment. BetterShield Ultra, a separate paid add-on for agencies, adds extras such as two-factor setup at sign-in for the roles you choose, a scheduled client report and longer history: https:\/\/bettershield.ai\/ultra\/<\/p><\/dd>\n
Does BetterShield include a firewall or malware scanner?<\/h3><\/dt>\nNo. BetterShield does not include a firewall and does not scan for or remove malware. It audits your configuration, hardens it with fixes you can undo, secures logins, logs activity, groups suspicious changes into incidents, compares WordPress core and directory plugins with the official WordPress.org copies, and watches your theme and the files nobody publishes for changes.<\/p><\/dd>\n
Can my server\u2019s firewall block the networks BetterShield pauses?<\/h3><\/dt>\nYes, on a server that runs Fail2Ban. Turn on \u201cTell this server\u2019s firewall when a connection is paused\u201d under BetterShield > Login & access, or a host can turn it on for every site with the bettershield_host_ban_line<\/code> filter. Each pause then writes one line to the server\u2019s auth log naming the network (IPv4 \/24, IPv6 \/64), never an address or a username. A sample filter and jail ship in the plugin\u2019s fail2ban<\/code> folder. A network that holds an address on your allowed list writes no line.<\/p><\/dd>\nCan I use BetterShield alongside another security plugin?<\/h3><\/dt>\nYes, with care. If another security plugin is active, the Quick Setup asks which plugin should keep each shared job, such as login limits, so they are not both doing it. On the Hardening screen, a fix another plugin already covers says so. It does not catch every overlap, so check the other plugin's settings too, and avoid turning on login or two-factor features in both.<\/p><\/dd>\n
How do I switch from another security plugin?<\/h3><\/dt>\nInstall BetterShield and let the first audit run; it changes nothing. If you are coming from Kadence Security, All-In-One Security, Really Simple Security or Wordfence, Settings > General can bring over their protections and sign-in attempt limits. You see a preview first, it lists what it could not carry and why, the other plugin is only read, and the import can be undone. Then apply any other fixes you want one at a time and switch the old plugin's features off as you go.<\/p><\/dd>\n
Will the fixes break my site?<\/h3><\/dt>\nEvery fix can show you what it will change before you apply it, and each can be undone at any time. Where an undo cannot reach everything, the fix says so first: people signed out by a key change stay signed out, and browsers that already saw the HSTS header keep insisting on HTTPS until it expires.<\/p><\/dd>\n
What happens if I lock myself out?<\/h3><\/dt>\nOpen your latest recovery link and press its one button. BetterShield's sign-in protections pause for one hour and your settings stay exactly as they are. You can generate a fresh link from Protect > Recovery at any time; generating one stops the old one working. Using a link issues the next one straight away, on the page and by email. A link you never use stops working after 90 days, and BetterShield warns you in the last two weeks. Printed recovery codes are a second way back in.<\/p><\/dd>\n
Can two-factor authentication lock my users out?<\/h3><\/dt>\nNot by setting it up. Nothing is enforced until the app is proven to work and the backup codes are saved, and required two-factor comes with a grace period (14 days by default), with an email to the account three days before it ends. If someone loses their phone, a backup code signs them in, and an administrator can turn two-factor off for them. If you are the only administrator and have lost both, open your recovery link: while safe mode is on, your password turns two-factor off under Protect > Two-factor, and an alert goes out when it does.<\/p><\/dd>\n
Will it slow down my site?<\/h3><\/dt>\nThe Overview measures it and shows the number for your own site. For visitors, BetterShield runs the fixes you turned on, its login protection on sign-in, the limits on the comment, reset and sign-up forms, and a hidden bot check on the sign-in, registration and comment forms. Audits, file checks and emails never run inside a visitor's page view. On the WooCommerce cart and checkout, BetterShield adds no bot check, skips its sampling, checks and housekeeping, and only records security events.<\/p><\/dd>\n
Does it send my data anywhere? Do I need an account?<\/h3><\/dt>\nThere is no account. Out of the box, BetterShield contacts WordPress.org only, to check your files and plugins, and those requests carry version numbers and plugin slugs, never your site address, email or username. Everything else is off until you turn it on: usage sharing (the first Quick Setup step), the leaked-password check, your own AI provider, and BetterShield Hub. External services below lists exactly what each one sends.<\/p><\/dd>\n
What does BetterShield keep about people?<\/h3><\/dt>\nEverything is stored on your own server. The main records:<\/p>\n\n
\n- Activity log:<\/strong> what happened and who did it, with IP addresses truncated to a network before storage. Rows are removed after thirty days.<\/li>\n
- Sign-in attempts:<\/strong> the username tried, the outcome, the truncated network and a keyed digest of the IP address, used for lockout decisions and pruned aggressively.<\/li>\n
- Passkeys:<\/strong> the device name you gave, when it was added and when it was last used. Only the public half of the key is stored.<\/li>\n
- Account records:<\/strong> two-factor setup, backup codes, password-policy status, two-factor deadlines and last sign-in.<\/li>\n<\/ul>\n\n
Tools > Export Personal Data and Tools > Erase Personal Data both support BetterShield. A few security records are kept on purpose, and the erasure result says so: the date the account last signed in, lockout records, incident evidence and assistant activity. Tools > Site Health > Info lists every record, how long it is kept, and what erasure does to it.<\/p><\/dd>\n
Does BetterShield detect vulnerable plugins?<\/h3><\/dt>\nNot yet. The check against published vulnerability advisories is built, but no data source is connected in this version, and the Findings screen says so rather than showing an empty list as a clean result. Today BetterShield flags plugins the WordPress.org directory has closed or that have had no update for years, and its file check shows any core or directory plugin file that no longer matches the official copy.<\/p><\/dd>\n
Is the activity log tamper-proof?<\/h3><\/dt>\nNo, and it does not claim to be. It is tamper-evident: each finished day is sealed and chained to the day before. If a sealed day is later edited or deleted, the next daily check opens a high-severity finding.<\/p><\/dd>\n
Can an AI assistant change my site?<\/h3><\/dt>\nOnly if you let it. The MCP connection is off until you turn it on under Agents > Connect, and reading and changing are separate switches. With only reading on, an assistant can look and change nothing. With changing on, it can apply and undo fixes and put a changed file back, and every change has an undo and is recorded in the activity log. A connection can be issued read-only whatever the switches say. Creating accounts or credentials, changing your recovery options, two-factor or alert settings, lifting lockouts and deleting log rows are never possible through a connection. Agents > Surface shows which abilities on your site, from any plugin, can make changes.<\/p><\/dd>\n
Do I need BetterShield Hub?<\/h3><\/dt>\nNo. It is optional, and everything in the plugin works without it. The hub is for people who look after several sites and want their scores, findings and fixes in one place. You connect each site from its own BetterShield > Hub screen and approve it on that site. To end the connection, press Disconnect on the site: removing a site inside the hub does not end it.<\/p><\/dd>\n
What can BetterShield Hub see and change?<\/h3><\/dt>\nWhat you allow when you connect. Read-only lets it see the score, findings and a few security views, such as administrators by display name and role. Read-and-fix also lets it apply fixes that can be undone, and those take effect at once; changes to how people sign in, fixes that cannot be fully undone, and undoing a fix, which takes a protection off, show the site's own plan first and wait for a person to agree each time. Connecting turns on the plugin's assistant connection if it is off, and the consent page has \"Allow it to change this site\" ticked by default, so untick it if you want read-only. Every change the hub makes is recorded in the site's activity log. The hub reads the site every few hours; if you also turn on the Hub link under BetterShield > Hub, or tick it on the consent page, the site sends its security events and a heartbeat to the hub as they happen, so its alerts arrive in seconds. Turning the link off deletes the key it signs with.<\/p><\/dd>\n
Does it work with WooCommerce?<\/h3><\/dt>\nYes. Customers can set up two-factor, add passkeys and see where they are signed in from a Sign-in security tab on My Account. BetterShield adds nothing to the cart or checkout pages.<\/p><\/dd>\n
Does it work on multisite?<\/h3><\/dt>\nYes. Each site keeps its own findings, settings and fixes. The network admin gets every site's score and open findings in one table, 200 sites at a time, two-factor and passkey rules set once as a floor under every site, and a recovery link for the network.<\/p><\/dd>\n
What happens if I delete the plugin?<\/h3><\/dt>\nIts records stay by default, including the activity log, findings and undo history, so reinstalling picks up where you left off. Fixes it applied, including .htaccess rules, stay applied too, so undo anything you do not want to keep before you delete. Under Settings > General, \"If this plugin is ever deleted\" can instead remove this plugin's records, which also takes its server rules back off.<\/p>\n\n
Copies of files it replaced are kept in wp-content\/uploads\/bettershield-quarantine\/<\/code>, because the version that was there may be exactly what somebody put on your site, and deleting it on the way out is not a decision this plugin makes for you. Remove them one at a time from Activity > Files before you delete the plugin, or delete the folder yourself afterwards. A third setting does both for you: it packages the copies into one zip file inside wp-content\/uploads\/bettershield-quarantine\/<\/code>, takes the copies away only once that archive has been written, and then removes this plugin's records as above. Nothing serves that archive, since the folder it is written into refuses to hand anything out, so collect it the way you would any other file on the site, over SFTP or from your host's file manager.<\/p><\/dd>\n\n<\/dl>\n\n\n1.1.1 - 13\/10\/2026<\/h4>\n\n\n- Added: Hardening | Disable XML-RPC pingbacks without affecting Jetpack or mobile app access<\/li>\n
- Added: Login Protection | Block connections immediately when they use a blocked username<\/li>\n
- Added: Login Protection | Log blocked connections for Fail2Ban firewall integration<\/li>\n
- Added: Login Protection | Release all active login lockouts at once<\/li>\n
- Added: Security Audit | Detect conflicts with other plugins that limit login attempts<\/li>\n
- Added: WP-CLI | Manage lockouts, blocklists, and site lockdowns from the command line<\/li>\n
- Added: BetterShield Hub | Send security events and signed heartbeats to the Hub for faster alerts<\/li>\n
- Added: MCP Server | Access site security settings, updates, protection status, audit progress, and agent information through new read-only tools<\/li>\n
- Added: Two-Factor | Allow users to disable their own two-factor authentication with a valid code<\/li>\n
- Added: Settings | Show whether BetterShield is translated into the site's language<\/li>\n
- Added: Security Audit | Display audit progress and announce when audits start and finish<\/li>\n
- Added: Agents | Allow users to decline pending agent plans immediately<\/li>\n
- Added: Hardening | Refuse requests from plugins to cloud-metadata addresses and log requests into the server's own network. This seventeenth fix is on by default, including on sites that update, and has an undo<\/li>\n
- Added: Security Headers | Allow a source from the content policy reports, remove it again, or clear the report list, each with an undo<\/li>\n
- Added: Two-Factor | Allow users in safe mode to turn off their own two-factor with their password, and send a high alert when they do<\/li>\n
- Added: Two-Factor | Email users once, three days before their required two-factor deadline<\/li>\n
- Improved: Dashboard | Redesign all BetterShield screens with a collapsible sidebar while preserving existing settings and actions<\/li>\n
- Improved: Incidents | Make incident summaries, network incident management, and incident history available across all sites<\/li>\n
- Improved: Recorded Changes | Allow changes to be suspended and restored on every site without an add-on<\/li>\n
- Improved: Quick Setup | Clarify setup choices, track skipped steps, and provide controls for applied security fixes<\/li>\n
- Improved: Settings Import | Show before-and-after setting values and include the lockout allowlist in imports<\/li>\n
- Improved: Agents | Simplify agent connection setup, explain denied requests, and enforce individual hourly change limits<\/li>\n
- Improved: Agents | Detect reused assistant credentials and generate security alerts<\/li>\n
- Improved: BetterShield Hub | Display the last synchronization time, confirm disconnections, and explain failed connections<\/li>\n
- Improved: File Integrity | Provide clearer file change details, identify quarantined tools, and simplify incident timelines<\/li>\n
- Improved: File Integrity | Run file integrity checks in the background and process results in batches<\/li>\n
- Improved: Recovery | Display safe mode status across Protect tabs and clarify recovery email expiration<\/li>\n
- Improved: Sessions | Show device details clearly and provide responsive session management controls<\/li>\n
- Improved: Login Protection | Explain login delays caused by requests arriving too quickly after page load<\/li>\n
- Improved: Overview | Link existing findings to their settings and display incident and agent request counts<\/li>\n
- Improved: Activity Log | Display security evidence and automated update rollbacks in human-readable language<\/li>\n
- Improved: Accessibility | Improve keyboard navigation, screen reader announcements, dialog structure, and action labels<\/li>\n
- Improved: Right-to-left | Align navigation, arrows, and keyboard movement with right-to-left reading direction<\/li>\n
- Improved: Translations | Improve plural handling and provide complete, context-rich strings for translators<\/li>\n
- Improved: Add-ons | Allow add-ons to register activity events, read capabilities, and settings export sections<\/li>\n
- Improved: Alerts | Send an instant alert when a hardening fix is switched off by hand<\/li>\n
- Improved: Alerts | Send an instant alert when BetterShield or its add-on is deactivated, or when its records are set to be removed on deletion<\/li>\n
- Improved: Overview | Show sign-in protection, password policy, alert and decoy page changes in \"Since you last looked\", along with passkeys added, two-factor removed, or emails changed on privileged accounts<\/li>\n
- Improved: Activity Log | Keep older history for 30 days before removing it when a longer retention period ends<\/li>\n
- Fixed: Security | Tighten authentication and permission checks for application passwords, blocked usernames, passkeys, administrator two-factor changes, and network-level settings on multisite<\/li>\n
- Fixed: Two-Factor | Correct hourly code limits and preserve checkout redirects after two-factor authentication<\/li>\n
- Fixed: XML-RPC | Return consistent authentication responses for accounts using two-factor authentication or passkeys<\/li>\n
- Fixed: Lockdown | Extend lockdown protection to all sessions, assistant credentials, Hub credentials, and network sites<\/li>\n
- Fixed: Hardening | Prevent public user listing protections from exposing real accounts through password recovery and author sitemaps<\/li>\n
- Fixed: Hardening | Prevent alternative registration endpoints, password-protected posts, and archive paths from revealing the custom login URL<\/li>\n
- Fixed: Hardening | Hide the WordPress version on the login page when version publishing is disabled<\/li>\n
- Fixed: Passwords | Enforce password policies and breached-password checks for passwords with surrounding spaces, bulk-created customers, and all writing scripts<\/li>\n
- Fixed: Security Audit | Recognize leftover installers and search-and-replace scripts by reading them from disk, so the weekly check never runs them<\/li>\n
- Fixed: File Integrity | Detect added files in vendor, node_modules, and .git directories, as well as single-file plugins<\/li>\n
- Fixed: File Integrity | Prevent false tampering alerts during plugin updates and ZIP replacements, and clear missing-file records after plugin deletion<\/li>\n
- Fixed: Activity Log | Prevent personal-data erasure and stored reasons from incorrectly resealing failed audit days, and preserve log integrity after updates<\/li>\n
- Fixed: Activity Log | Preserve existing activity history during updates without shortening add-on retention periods<\/li>\n
- Fixed: AI Explanations | Exclude the site's domain from data sent to AI providers<\/li>\n
- Fixed: Decoy URL | Prevent query parameters from bypassing decoy URL protection<\/li>\n
- Fixed: BetterShield Hub | Revoke the previous Hub's access when its address changes and list all signed-in apps under Agents Connect<\/li>\n
- Fixed: Recovery | Print all recovery codes on a single page and restore printing functionality across other screens<\/li>\n
- Fixed: Security Audit | Improve detection accuracy for XML-RPC restrictions, SPF and DMARC records, private domains, HTTPS settings, file editing restrictions, backup plugins, themes, file permissions, and PHP errors<\/li>\n
- Fixed: Security Audit | Correct update-check results when cached update information becomes outdated<\/li>\n
- Fixed: Vulnerabilities | Display accurate fixed-version information, prevent duplicate notices, and remove notices after updates<\/li>\n
- Fixed: Security Headers | Prevent false warnings for server-provided headers, preserve embedded site posts, and restrict content policies to frontend requests<\/li>\n
- Fixed: Alerts | Ensure mute-all disables every email alert and deliver notifications using the correct language and updated administrator address<\/li>\n
- Fixed: Site Moves | Prevent false site-move warnings during atomic deployments and restore alerts, Hub connections, and usage data sharing (if allowed) after staging replacements<\/li>\n
- Fixed: WooCommerce | Record customer sign-outs and redirect paused password resets to the store's own page<\/li>\n
- Fixed: Right-to-left | Prevent honeypot fields from causing horizontal scrolling on comment forms and My Account pages<\/li>\n
- Fixed: Multisite | Preserve network passkeys, remove deleted-site data, restore policy grace periods, and maintain site-specific password policy settings<\/li>\n
- Fixed: WP-CLI | Correct dry-run options, identify sites in multisite CSV exports, produce valid JSON, and display timezone-aware timestamps<\/li>\n
- Fixed: Scheduled Tasks | Prevent failed scheduled tasks from breaking admin pages and remove all scheduled tasks during uninstall<\/li>\n
- Fixed: Settings | Reject security switch requests that do not clearly turn a setting on or off<\/li>\n<\/ul>\n\n
1.1.0 - 05\/10\/2026<\/h4>\n\n\n- Added: Usage Data | Optional usage data sharing, asked once in Quick Setup and switchable under Settings > General<\/li>\n
- Added: Overview | See which checks opened, passed, changed severity or were marked not applicable since an earlier day, with the score then and now<\/li>\n
- Added: Security Audit | Four new checks: unfiltered code below administrator, script uploads below administrator, this plugin's automatic updates switched off, and world-writable folders under wp-content<\/li>\n
- Added: Recovery | Checks that a recovery link or printed code works before any change to how people sign in, from the dashboard or
wp bettershield harden<\/code> (--force<\/code> to go ahead)<\/li>\n- Added: Incidents | An email change, a password change and a new application password on one privileged account within an hour are recorded together as one high signal<\/li>\n
- Added: Incident Response | Re-checks the site after a response runs and lists what is still open<\/li>\n
- Added: Overview | Notes when failed sign-ins or the scheduler's timing are far outside this site's last 30 days<\/li>\n
- Added: AI Explanations | Explain my audit summarizes the open findings in three short paragraphs that cite each finding<\/li>\n
- Added: Settings Import | Bring over protections and sign-in attempt limits from another security plugin, with a preview and an undo<\/li>\n
- Added: MCP Server | Connect Claude, ChatGPT or any MCP assistant to read the audit, activity and file check, apply fixes you can undo and restore changed files, with every call logged<\/li>\n
- Added: Agents | A new Agents section with Connect, Requests, Permissions and Surface tabs<\/li>\n
- Added: BetterShield Hub | Optional hub connection from BetterShield > Hub, Settings or the end of Quick Setup, approved once on the site's own consent page<\/li>\n
- Added: Overview | A storage card that names a missing database table or column and offers a Repair<\/li>\n
- Added: Uninstall | A third choice when deleting the plugin: pack the quarantined copies into one archive, then remove them<\/li>\n
- Added: Hardening | A sixteenth fix: refuse new passwords found in known breaches, off by default<\/li>\n
- Added: File Integrity | Reports a new .user.ini file that appears after the site's configuration was recorded<\/li>\n
- Added: Security Audit | Names PHP files and folders in the plugins folder that no installed plugin claims<\/li>\n
- Added: Security Audit | Flags directory plugins with no update for two years, with the last-updated date<\/li>\n
- Added: Form Protection | Comment bursts are held for moderation, and repeated password resets and sign-ups from one connection are paused<\/li>\n
- Added: WooCommerce | Customers manage two-factor, passkeys and signed-in devices from a Sign-in security tab on My Account<\/li>\n
- Added: Login Protection | Block a username from signing in<\/li>\n
- Added: Security Audit | Finds installer and database tools left in the web root, with quarantine from the finding<\/li>\n
- Added: Security Audit | Checks whether admin-ajax shares signed-in answers with other websites, and names where the policy was widened<\/li>\n
- Added: Security Audit | Detects a sign-in page served by a page cache or CDN<\/li>\n
- Added: Security Audit | Checks the domain's SPF, DMARC and CAA records once a day<\/li>\n
- Added: Security Audit | Warns when free disk space runs low<\/li>\n
- Added: Findings | Snooze a finding for 7 or 30 days, with its own Snoozed filter and
wp bettershield findings --status=snoozed<\/code><\/li>\n- Added: Plugins Screen | Add New shows whether a plugin is closed on WordPress.org or has had no update for two years<\/li>\n
- Added: Application Passwords | Limit an application password to its REST routes, its network, or both, from Agents > Surface<\/li>\n
- Added: Site Moves | When the site address or folder changes, the Overview asks whether it is a staging copy or a move, with one undo<\/li>\n
- Added: Incident Response | Ask a privileged account for a new password, with an undo<\/li>\n
- Improved: Quick Setup | Previews what each fix will do before applying it, leaves risky fixes unticked, and undoes the applied set in one step<\/li>\n
- Improved: Request Protection | Each public form has its own threshold, window and closing time, with a replay of the last two days before you save<\/li>\n
- Improved: Incidents | Evidence names each row's network and links to the activity log for the incident's days<\/li>\n
- Improved: Activity Log | Open everything from one person or one network from any log row, and narrow agent activity to one account<\/li>\n
- Improved: Multisite | The network overview shows how many sites it lists and loads more on request on networks of more than 200 sites<\/li>\n
- Improved: Privacy | Add-ons can declare a per-site personal data record so the privacy export finds it<\/li>\n
- Improved: Audit | Says how many checks could be evaluated when a run could not check them all, and marks findings kept from an earlier run<\/li>\n
- Improved: File Integrity | A changed file too long to compare whole shows the part that changed<\/li>\n
- Improved: File Integrity | A plugin copy you reviewed and adopted stays quiet until it changes again<\/li>\n
- Improved: Login Protection | Repeat lockouts within a day double in length, up to one day<\/li>\n
- Improved: Compatibility | Recognizes one more security plugin, so the same job is not done twice<\/li>\n
- Improved: Settings Import | Brings over sign-in attempt limits, allowed addresses, the breached-password check, username discovery block, version hiding and uploads protection from one more security plugin<\/li>\n
- Improved: Settings Export | Blocked usernames are included in an exported settings file<\/li>\n
- Improved: File Integrity | The Files screen groups changes by plugin and version, with Check again and Mark all expected (
wp bettershield integrity recheck<\/code> and expect<\/code>)<\/li>\n- Improved: Activity Log | Notes which code files an update to a plugin outside the directory added or changed<\/li>\n
- Improved: Alerts | Connecting an assistant, rotating its credential or approving an app sends an instant alert<\/li>\n
- Improved: Hardening | The usage preview on the XML-RPC and application password fixes looks back across the whole activity record<\/li>\n
- Improved: Admin Menu | The sidebar shows the BetterShield icon<\/li>\n
- Improved: Confirmations | Applying an incident response, disabling the decoy URL and withdrawing an agent's confirmation ask once more before acting<\/li>\n
- Improved: Agents | A credential connected while agents may not change the site is issued read-only<\/li>\n
- Fixed: Login Protection | Sign-in lockouts keep working right after an update, before the database is upgraded<\/li>\n
- Fixed: Login Protection | Lockouts stand down behind a proxy that forwards no visitor address, instead of locking all visitors out together<\/li>\n
- Fixed: Multisite | On installs with more than one network, the network dashboard and activity log show only that network's sites<\/li>\n
- Fixed: Hardening | A protection set to applied while safe mode is on is shown as paused<\/li>\n
- Fixed: WP-CLI | The agent-activity export carries every matching row, or says where it stopped<\/li>\n<\/ul>\n\n
1.0.0 - 13\/09\/2026<\/h4>\n\n\n- First public release<\/li>\n
- Added: Security Audit | 40 read-only checks, a score that shows its workings and a plain-language explanation of every finding<\/li>\n
- Added: Hardening | 15 one-click fixes, each showing what it will change first, each with an undo that never expires<\/li>\n
- Added: Two-Factor Authentication | Any authenticator app, 10 single-use backup codes, and passkeys<\/li>\n
- Added: Login Protection | Lockouts after repeated wrong passwords, an allowlist and a blocklist, session limits and an optional idle timeout<\/li>\n
- Added: Recovery | A recovery link, safe mode and printed offline codes, with daily readiness checks and optional weekly email tests<\/li>\n
- Added: Activity Log | Sign-ins, accounts, roles, plugins, themes and the plugin's own actions, with filters, search, CSV export and a daily seal<\/li>\n
- Added: File Integrity | Core and directory-plugin files compared with the copies WordPress.org publishes, with the difference shown and one click to restore a file<\/li>\n
- Added: Alerts | A weekly email summary that arrives on quiet weeks too, and high and critical events sent on their own<\/li>\n
- Added: Tools | WP-CLI commands, settings export and import, findings in Site Health, a dashboard widget, and a report of what connected agents can do<\/li>\n
- Added: Multisite | Every site's score in one table and rules a network can set once<\/li>\n<\/ul>","raw_excerpt":"Free WordPress security audit, seventeen one-click fixes you can undo, 2FA, passkeys, login protection and an activity log. No account needed.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/354246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=354246"}],"author":[{"embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/wpdevteam"}],"wp:attachment":[{"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=354246"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=354246"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=354246"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=354246"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=354246"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=354246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}