WPDeveloper<\/a>,<\/strong> a leading WordPress product company used and loved by 6 million users and businesses.<\/p>\n\nExternal services<\/h3>\n\n
BetterShield contacts six outside addresses, and a seventh, BetterShield Hub, reaches it only if you connect the site to the hub. It contacts four addresses operated by WordPress.org, all to check that your files still match the official ones and to put an official file back if you ask. It contacts your own AI provider only if you have connected one, the Pwned Passwords service only if you switch on the breached-password check, and the usage service only if you choose to share usage data.<\/p>\n\n
api.wordpress.org<\/strong> \u2014 the published checksums for your WordPress version, when the file check runs on its schedule or when you start one; the request carries your WordPress version and language. Once a day it also asks whether the directory still lists a few of the plugins you installed from it; that request carries the plugin's slug only. Plugins you choose to install in the Quick Setup's optional last step are fetched by WordPress's own installer, from here and downloads.wordpress.org.<\/p>\n\ndownloads.wordpress.org<\/strong> \u2014 the published checksums for a directory plugin at the exact version you have, during the same check and whenever a plugin is installed or updated, including automatic updates. The request carries the plugin's slug and version.<\/p>\n\ncore.svn.wordpress.org<\/strong> and plugins.svn.wordpress.org<\/strong> \u2014 the official copy of one file, fetched only when you press Restore on a changed file. The request carries the version and the file's path, and the copy is checked against the published checksum before anything is written.<\/p>\n\napi.pwnedpasswords.com<\/strong> \u2014 the Pwned Passwords service by Have I Been Pwned, only if you switch on \u201cRefuse passwords found in known breaches\u201d, and only when someone signed in to your site sets or changes a password. The password is hashed on your server and only the first five characters of the hash are sent; the comparison happens on your server. No password, account name, email, site address or identifier is sent. Documentation: https:\/\/haveibeenpwned.com\/API\/v3#PwnedPasswords \u2014 privacy policy: https:\/\/haveibeenpwned.com\/Privacy<\/p>\n\nsend.wpinsight.com<\/strong> \u2014 WPDeveloper's usage service, only if you choose to share usage data (Get Started on the first Quick Setup step; Skip sends nothing). At most once a day, and once when you deactivate BetterShield, it sends your site address and title, administrator email, WordPress, PHP and web server versions, language settings, whether the site is multisite, the installed and active plugins, your theme and its version, BetterShield's version and folder name, and the report reference. Never anything about your visitors, users, sign-ins or findings. Turn it off under Settings > General. Privacy policy: https:\/\/wpdeveloper.com\/privacy-policy<\/p>\n\nBetterShield Hub<\/strong> (hub.bettershield.ai, or the address you set under BetterShield > Hub), only if you connect the site and approve it on this site's own consent page. The hub then reads the score, findings and available tools, and applies or removes a protection when you ask, under the same rules as an AI assistant. This site does not contact the hub; the hub contacts the site and checks every few minutes that its front page answers. Disconnect ends it at once.<\/p>\n\nYour own AI provider<\/strong>, only if you have connected one to WordPress and only when you ask for an explanation. WordPress sends the request through your connector under Settings > Connectors; BetterShield never sees, asks for or stores the key. It sends the finding's title, severity, description and recorded evidence, with web and email addresses stripped, and never file contents, usernames, keys or your site's address.<\/p>\n\nNone of the WordPress.org requests carries anything about your site: no site address, email, username, IP address, keys, file contents or identifier. They happen on a schedule, when you press a button, or when a plugin is installed or updated, never while a visitor loads a page. If a service cannot be reached, the check says it could not run rather than reporting a file as unchanged.<\/p>\n\n
The four WordPress.org addresses are provided by the WordPress Foundation. Terms of use: https:\/\/wordpress.org\/about\/privacy\/ and https:\/\/wordpress.org\/about\/privacy\/cookies\/<\/p>\n\n
Published vulnerability advisories<\/strong> \u2014 not contacted in this version. No data source is connected, and the Findings screen says so. When one is, this section will name it and say what is sent, and the check will stay off until you turn it on.<\/p>\n\nWhat it keeps about people<\/h3>\n\n
Everything BetterShield keeps about a person stays on your own server: activity log rows, sign-in attempts, passkeys and account records, with IP addresses truncated to a network before they are stored. The FAQ above describes each record. Tools > Export Personal Data and Tools > Erase Personal Data both support BetterShield, and Tools > Site Health > Info lists every record, why it is kept and for how long.<\/p>\n\n
Source code<\/h3>\n\n
Everything that runs is readable in the plugin folder. The PHP in src\/<\/code> is not generated, compiled or minified. The admin interface is compiled into assets\/build\/<\/code> (scripts, stylesheets and small generated PHP files that list each script's dependencies) from the sources in assets\/js\/<\/code> and assets\/css\/<\/code>, which ship next to it. To rebuild, run npm install<\/code> and then npm run build<\/code>, which uses @wordpress\/scripts from the included package.json<\/code>.<\/p>\n\n\n\n- In your dashboard, go to Plugins > Add Plugin, search for \"BetterShield\", then install and activate it. Or upload the folder to
\/wp-content\/plugins\/bettershield<\/code>.<\/li>\n- On activation, a read-only security audit runs, your recovery link is emailed to the site's admin address, and the Quick Setup opens.<\/li>\n
- Open BetterShield<\/strong> in the admin menu to see your score and findings.<\/li>\n<\/ol>\n\n
No hardening fix, required two-factor or passkey-only sign-in is switched on until you choose it.<\/strong> A few protections start at activation, and each can be switched off:<\/p>\n\n\n- Login attempt limits<\/li>\n
- A hidden bot check on the login, registration, WooCommerce account and comment forms<\/li>\n
- Limits on the comment, password reset and sign-up forms<\/li>\n
- Minimum password lengths<\/li>\n
- Weekly and instant email alerts<\/li>\n<\/ul>\n\n\n
\nIs BetterShield free?<\/h3><\/dt>\nYes. The audit, every plain-language explanation, all 16 fixes and their undo, two-factor authentication, passkeys, login protection, the recovery link, the activity log, incident response, the file check and the MCP server are free. There is no account and no payment. BetterShield Ultra, a separate add-on for agencies, is coming soon and adds extras such as AI client drafts, a network-wide Incidents tab and longer history.<\/p><\/dd>\n
Does BetterShield include a firewall or malware scanner?<\/h3><\/dt>\nNo. BetterShield does not include a firewall and does not scan for or remove malware. It audits your configuration, hardens it with fixes you can undo, secures logins, logs activity, groups suspicious changes into incidents, compares WordPress core and directory plugins with the official WordPress.org copies, and watches your theme and the files nobody publishes for changes.<\/p><\/dd>\n
Can I use BetterShield alongside another security plugin?<\/h3><\/dt>\nYes, with care. If another security plugin is active, the Quick Setup asks which plugin should keep each shared job, such as login limits, so they are not both doing it. On the Hardening screen, a fix another plugin already covers says so. It does not catch every overlap, so check the other plugin's settings too, and avoid turning on login or two-factor features in both.<\/p><\/dd>\n
How do I switch from another security plugin?<\/h3><\/dt>\nInstall BetterShield and let the first audit run; it changes nothing. If you are coming from Kadence Security, All-In-One Security, Really Simple Security or Wordfence, Settings > General can bring over their protections and sign-in attempt limits. You see a preview first, it lists what it could not carry and why, the other plugin is only read, and the import can be undone. Then apply any other fixes you want one at a time and switch the old plugin's features off as you go.<\/p><\/dd>\n
Will the fixes break my site?<\/h3><\/dt>\nEvery fix can show you what it will change before you apply it, and each can be undone at any time. Where an undo cannot reach everything, the fix says so first: people signed out by a key change stay signed out, and browsers that already saw the HSTS header keep insisting on HTTPS until it expires.<\/p><\/dd>\n
What happens if I lock myself out?<\/h3><\/dt>\nOpen your latest recovery link and press its one button. BetterShield's sign-in protections pause for one hour and your settings stay exactly as they are. You can generate a fresh link from Protect > Recovery at any time; generating one stops the old one working. Using a link issues the next one straight away, on the page and by email. A link you never use stops working after 90 days, and BetterShield warns you in the last two weeks. Printed recovery codes are a second way back in.<\/p><\/dd>\n
Can two-factor authentication lock my users out?<\/h3><\/dt>\nNot by setting it up. Nothing is enforced until the app is proven to work and the backup codes are saved, and required two-factor comes with a grace period (14 days by default). If someone loses their phone, a backup code signs them in, and an administrator can turn two-factor off for them.<\/p><\/dd>\n
Will it slow down my site?<\/h3><\/dt>\nThe Overview measures it and shows the number for your own site. For visitors, BetterShield runs the fixes you turned on, its login protection on sign-in, the limits on the comment, reset and sign-up forms, and a hidden bot check on the sign-in, registration and comment forms. Audits, file checks and emails never run inside a visitor's page view. On the WooCommerce cart and checkout, BetterShield adds no bot check, skips its sampling, checks and housekeeping, and only records security events.<\/p><\/dd>\n
Does it send my data anywhere? Do I need an account?<\/h3><\/dt>\nThere is no account. Out of the box, BetterShield contacts WordPress.org only, to check your files and plugins, and those requests carry version numbers and plugin slugs, never your site address, email or username. Everything else is off until you turn it on: usage sharing (the first Quick Setup step), the leaked-password check, your own AI provider, and BetterShield Hub. External services below lists exactly what each one sends.<\/p><\/dd>\n
What does BetterShield keep about people?<\/h3><\/dt>\nEverything is stored on your own server. The main records:<\/p>\n\n
\n- Activity log:<\/strong> what happened and who did it, with IP addresses truncated to a network before storage. Rows are removed after thirty days.<\/li>\n
- Sign-in attempts:<\/strong> the username tried, the outcome, the truncated network and a keyed digest of the IP address, used for lockout decisions and pruned aggressively.<\/li>\n
- Passkeys:<\/strong> the device name you gave, when it was added and when it was last used. Only the public half of the key is stored.<\/li>\n
- Account records:<\/strong> two-factor setup, backup codes, password-policy status, two-factor deadlines and last sign-in.<\/li>\n<\/ul>\n\n
Tools > Export Personal Data and Tools > Erase Personal Data both support BetterShield. A few security records are kept on purpose, and the erasure result says so: the date the account last signed in, lockout records, incident evidence and assistant activity. Tools > Site Health > Info lists every record, how long it is kept, and what erasure does to it.<\/p><\/dd>\n
Does BetterShield detect vulnerable plugins?<\/h3><\/dt>\nNot yet. The check against published vulnerability advisories is built, but no data source is connected in this version, and the Findings screen says so rather than showing an empty list as a clean result. Today BetterShield flags plugins the WordPress.org directory has closed or that have had no update for years, and its file check shows any core or directory plugin file that no longer matches the official copy.<\/p><\/dd>\n
Is the activity log tamper-proof?<\/h3><\/dt>\nNo, and it does not claim to be. It is tamper-evident: each finished day is sealed and chained to the day before. If a sealed day is later edited or deleted, the next daily check opens a high-severity finding.<\/p><\/dd>\n
Can an AI assistant change my site?<\/h3><\/dt>\nOnly if you let it. The MCP connection is off until you turn it on under Agents > Connect, and reading and changing are separate switches. With only reading on, an assistant can look and change nothing. With changing on, it can apply and undo fixes and put a changed file back, and every change has an undo and is recorded in the activity log. A connection can be issued read-only whatever the switches say. Creating accounts or credentials, changing your recovery options, two-factor or alert settings, lifting lockouts and deleting log rows are never possible through a connection. Agents > Surface shows which abilities on your site, from any plugin, can make changes.<\/p><\/dd>\n
Do I need BetterShield Hub?<\/h3><\/dt>\nNo. It is optional, and everything in the plugin works without it. The hub is for people who look after several sites and want their scores, findings and fixes in one place. You connect each site from its own BetterShield > Hub screen and approve it on that site. To end the connection, press Disconnect on the site: removing a site inside the hub does not end it.<\/p><\/dd>\n
What can BetterShield Hub see and change?<\/h3><\/dt>\nWhat you allow when you connect. Read-only lets it see the score, findings and a few security views, such as administrators by display name and role. Read-and-fix also lets it apply and undo fixes; each change shows the site's own plan first and waits for someone in your hub team to agree. Connecting turns on the plugin's assistant connection if it is off, and the consent page has \"Allow it to change this site\" ticked by default, so untick it if you want read-only. Every change the hub makes is recorded in the site's activity log.<\/p><\/dd>\n
Does it work with WooCommerce?<\/h3><\/dt>\nYes. Customers can set up two-factor, add passkeys and see where they are signed in from a Sign-in security tab on My Account. BetterShield adds nothing to the cart or checkout pages.<\/p><\/dd>\n
Does it work on multisite?<\/h3><\/dt>\nYes. Each site keeps its own findings, settings and fixes. The network admin gets every site's score and open findings in one table, 200 sites at a time, two-factor and passkey rules set once as a floor under every site, and a recovery link for the network.<\/p><\/dd>\n
What happens if I delete the plugin?<\/h3><\/dt>\nIts records stay by default, including the activity log, findings and undo history, so reinstalling picks up where you left off. Fixes it applied, including .htaccess rules, stay applied too, so undo anything you do not want to keep before you delete. Under Settings > General, \"If this plugin is ever deleted\" can instead remove this plugin's records, which also takes its server rules back off.<\/p>\n\n
Copies of files it replaced are kept in wp-content\/uploads\/bettershield-quarantine\/<\/code>, because the version that was there may be exactly what somebody put on your site, and deleting it on the way out is not a decision this plugin makes for you. Remove them one at a time from Activity > Files before you delete the plugin, or delete the folder yourself afterwards. A third setting does both for you: it packages the copies into one zip file inside wp-content\/uploads\/bettershield-quarantine\/<\/code>, takes the copies away only once that archive has been written, and then removes this plugin's records as above. Nothing serves that archive, since the folder it is written into refuses to hand anything out, so collect it the way you would any other file on the site, over SFTP or from your host's file manager.<\/p><\/dd>\n\n<\/dl>\n\n\n1.1.0 - 05\/10\/2026<\/h4>\n\n\n- Added: Usage Data | Optional usage data sharing, asked once in Quick Setup and switchable under Settings > General<\/li>\n
- Added: Overview | See which checks opened, passed, changed severity or were marked not applicable since an earlier day, with the score then and now<\/li>\n
- Added: Security Audit | Four new checks: unfiltered code below administrator, script uploads below administrator, this plugin's automatic updates switched off, and world-writable folders under wp-content<\/li>\n
- Added: Recovery | Checks that a recovery link or printed code works before any change to how people sign in, from the dashboard or
wp bettershield harden<\/code> (--force<\/code> to go ahead)<\/li>\n- Added: Incidents | An email change, a password change and a new application password on one privileged account within an hour are recorded together as one high signal<\/li>\n
- Added: Incident Response | Re-checks the site after a response runs and lists what is still open<\/li>\n
- Added: Overview | Notes when failed sign-ins or the scheduler's timing are far outside this site's last 30 days<\/li>\n
- Added: AI Explanations | Explain my audit summarizes the open findings in three short paragraphs that cite each finding<\/li>\n
- Added: Settings Import | Bring over protections and sign-in attempt limits from another security plugin, with a preview and an undo<\/li>\n
- Added: MCP Server | Connect Claude, ChatGPT or any MCP assistant to read the audit, activity and file check, apply fixes you can undo and restore changed files, with every call logged<\/li>\n
- Added: Agents | A new Agents section with Connect, Requests, Permissions and Surface tabs<\/li>\n
- Added: BetterShield Hub | Optional hub connection from BetterShield > Hub, Settings or the end of Quick Setup, approved once on the site's own consent page<\/li>\n
- Added: Overview | A storage card that names a missing database table or column and offers a Repair<\/li>\n
- Added: Uninstall | A third choice when deleting the plugin: pack the quarantined copies into one archive, then remove them<\/li>\n
- Added: Hardening | A sixteenth fix: refuse new passwords found in known breaches, off by default<\/li>\n
- Added: File Integrity | Reports a new .user.ini file that appears after the site's configuration was recorded<\/li>\n
- Added: Security Audit | Names PHP files and folders in the plugins folder that no installed plugin claims<\/li>\n
- Added: Security Audit | Flags directory plugins with no update for two years, with the last-updated date<\/li>\n
- Added: Form Protection | Comment bursts are held for moderation, and repeated password resets and sign-ups from one connection are paused<\/li>\n
- Added: WooCommerce | Customers manage two-factor, passkeys and signed-in devices from a Sign-in security tab on My Account<\/li>\n
- Added: Login Protection | Block a username from signing in<\/li>\n
- Added: Security Audit | Finds installer and database tools left in the web root, with quarantine from the finding<\/li>\n
- Added: Security Audit | Checks whether admin-ajax shares signed-in answers with other websites, and names where the policy was widened<\/li>\n
- Added: Security Audit | Detects a sign-in page served by a page cache or CDN<\/li>\n
- Added: Security Audit | Checks the domain's SPF, DMARC and CAA records once a day<\/li>\n
- Added: Security Audit | Warns when free disk space runs low<\/li>\n
- Added: Findings | Snooze a finding for 7 or 30 days, with its own Snoozed filter and
wp bettershield findings --status=snoozed<\/code><\/li>\n- Added: Plugins Screen | Add New shows whether a plugin is closed on WordPress.org or has had no update for two years<\/li>\n
- Added: Application Passwords | Limit an application password to its REST routes, its network, or both, from Agents > Surface<\/li>\n
- Added: Site Moves | When the site address or folder changes, the Overview asks whether it is a staging copy or a move, with one undo<\/li>\n
- Added: Incident Response | Ask a privileged account for a new password, with an undo<\/li>\n
- Improved: Quick Setup | Previews what each fix will do before applying it, leaves risky fixes unticked, and undoes the applied set in one step<\/li>\n
- Improved: Request Protection | Each public form has its own threshold, window and closing time, with a replay of the last two days before you save<\/li>\n
- Improved: Incidents | Evidence names each row's network and links to the activity log for the incident's days<\/li>\n
- Improved: Activity Log | Open everything from one person or one network from any log row, and narrow agent activity to one account<\/li>\n
- Improved: Multisite | The network overview shows how many sites it lists and loads more on request on networks of more than 200 sites<\/li>\n
- Improved: Privacy | Add-ons can declare a per-site personal data record so the privacy export finds it<\/li>\n
- Improved: Audit | Says how many checks could be evaluated when a run could not check them all, and marks findings kept from an earlier run<\/li>\n
- Improved: File Integrity | A changed file too long to compare whole shows the part that changed<\/li>\n
- Improved: File Integrity | A plugin copy you reviewed and adopted stays quiet until it changes again<\/li>\n
- Improved: Login Protection | Repeat lockouts within a day double in length, up to one day<\/li>\n
- Improved: Compatibility | Recognizes one more security plugin, so the same job is not done twice<\/li>\n
- Improved: Settings Import | Brings over sign-in attempt limits, allowed addresses, the breached-password check, username discovery block, version hiding and uploads protection from one more security plugin<\/li>\n
- Improved: Settings Export | Blocked usernames are included in an exported settings file<\/li>\n
- Improved: File Integrity | The Files screen groups changes by plugin and version, with Check again and Mark all expected (
wp bettershield integrity recheck<\/code> and expect<\/code>)<\/li>\n- Improved: Activity Log | Notes which code files an update to a plugin outside the directory added or changed<\/li>\n
- Improved: Alerts | Connecting an assistant, rotating its credential or approving an app sends an instant alert<\/li>\n
- Improved: Hardening | The usage preview on the XML-RPC and application password fixes looks back across the whole activity record<\/li>\n
- Improved: Admin Menu | The sidebar shows the BetterShield icon<\/li>\n
- Improved: Confirmations | Applying an incident response, disabling the decoy URL and withdrawing an agent's confirmation ask once more before acting<\/li>\n
- Improved: Agents | A credential connected while agents may not change the site is issued read-only<\/li>\n
- Fixed: Login Protection | Sign-in lockouts keep working right after an update, before the database is upgraded<\/li>\n
- Fixed: Login Protection | Lockouts stand down behind a proxy that forwards no visitor address, instead of locking all visitors out together<\/li>\n
- Fixed: Multisite | On installs with more than one network, the network dashboard and activity log show only that network's sites<\/li>\n
- Fixed: Hardening | A protection set to applied while safe mode is on is shown as paused<\/li>\n
- Fixed: WP-CLI | The agent-activity export carries every matching row, or says where it stopped<\/li>\n<\/ul>\n\n
1.0.0 - 13\/09\/2026<\/h4>\n\n\n- First public release<\/li>\n
- Added: Security Audit | 40 read-only checks, a score that shows its workings and a plain-language explanation of every finding<\/li>\n
- Added: Hardening | 15 one-click fixes, each showing what it will change first, each with an undo that never expires<\/li>\n
- Added: Two-Factor Authentication | Any authenticator app, 10 single-use backup codes, and passkeys<\/li>\n
- Added: Login Protection | Lockouts after repeated wrong passwords, an allowlist and a blocklist, session limits and an optional idle timeout<\/li>\n
- Added: Recovery | A recovery link, safe mode and printed offline codes, with daily readiness checks and optional weekly email tests<\/li>\n
- Added: Activity Log | Sign-ins, accounts, roles, plugins, themes and the plugin's own actions, with filters, search, CSV export and a daily seal<\/li>\n
- Added: File Integrity | Core and directory-plugin files compared with the copies WordPress.org publishes, with the difference shown and one click to restore a file<\/li>\n
- Added: Alerts | A weekly email summary that arrives on quiet weeks too, and high and critical events sent on their own<\/li>\n
- Added: Tools | WP-CLI commands, settings export and import, findings in Site Health, a dashboard widget, and a report of what connected agents can do<\/li>\n
- Added: Multisite | Every site's score in one table and rules a network can set once<\/li>\n<\/ul>","raw_excerpt":"Free WordPress security audit, sixteen one-click fixes you can undo, 2FA, passkeys, login protection and an activity log. No account needed.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/354246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=354246"}],"author":[{"embeddable":true,"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/wpdevteam"}],"wp:attachment":[{"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=354246"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=354246"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=354246"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=354246"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=354246"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/lmo.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=354246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}