Security audit and score
75 read-only checks, a score that shows its workings, and a plain-language explanation of every finding. Not ready for one yet? Snooze it for 7 or 30 days.
Free WordPress security plugin
Audit WordPress Security. Fix in One Click.
BetterShield runs 75 read-only checks on your website and explains every finding in plain language. Fix what you choose in one click, with a preview of each change first.
Security audit Example
Try it: press Review
Fixing the open finding takes you to 91 +5 points No open findings
Example audit: security score 86 out of 100, grade B. Two findings fixed, one waiting for review.
- The dashboard file editor is enabled Fixed Open
- Anyone can see your usernames Fixed Open
- Old remote publishing (XML-RPC) is turned on Fixed Open
Review a change
Turn off remote publishing (XML-RPC)
Six jobs, one plugin
BetterShield inside your dashboard, screen by screen.
Security score
58 Grade D
75 checks · 9 open findings
- A WordPress core update is available High
- The dashboard file editor is enabled Medium
- Old remote publishing (XML-RPC) is turned on Medium
- Your site doesn’t send some standard browser safety settings Low
1 of 6 · Audit
A score that shows its workings
75 read-only checks across access, exposure, updates, server and configuration. Each finding says what it is, why it matters and what acting on it could break. The score updates on its own after a fix.
Score and findings guideHardening
30 fixes · each previewed before it applies
- Block code in the uploads folder On
- Hide the WordPress version On
- Turn on browser protections On
- Turn off the file editor Turned on just now
Dashboard file editor disabled.
2 of 6 · Hardening
Fix it in one click
30 fixes, each previewed before anything changes. Switching one off removes what it wrote, and the two that cannot reach everything, new sign-in keys and a long HSTS setting, say so first.
Hardening guide- Pause after failed sign-ins
- Require two-factor for
- Passkeys
3 of 6 · Sign-in
Guessing stops at the door
By default, 5 failed sign-ins in 15 minutes pause that connection for 15 minutes. Two-factor works with any authenticator app, passkeys sign people in with a fingerprint, face or device PIN, and you can require two-factor by role. A card shows the networks and usernames tried most, and a tried name can be blocked in one press.
Login and access guideRecovery
Checked every day, ready when you need it
- Recovery link
- Pauses sign-in protections for
Printed recovery codes · 2 used
4 of 6 · Recovery
Locked out? Get back in.
A single-use recovery link by email, or a printed recovery code, pauses the sign-in protections for one hour while you put things right. No FTP, no call to your host.
Locked-out guideSite activity
Today · 4 events
- Sarah signed in with a passkey
- WooCommerce updated to 9.3.1
- Role changed: editor to author
- Yesterday sealed
5 of 6 · Activity
Who changed what
Sign-ins, accounts, roles, plugins, themes and core, with who and when, searchable and kept 30 days. Each finished day is sealed, so an edit or deletion shows up as a finding.
Activity log guideRequests
Changes an assistant has worked out, waiting for you
Change the sign-in address
- Read the security score
- Applied: Turn off remote publishing (XML-RPC)
6 of 6 · AI assistants
Your AI asks, you decide
Claude, ChatGPT or another assistant reads your site’s security over MCP. Fixes that switch off cleanly can apply straight away; anything heavier arrives as a plan you agree to.
Connect an AI assistantSecurity isn’t more alerts. It’s fewer open doors.
Most security plugins tell you whether your site is protected. BetterShield tells you what it checked and what it found, and fixes what it can, with your approval.
Already inside the free plugin
The audit, the fixes and everything around them. No account, no payment.
One-click hardening
30 fixes, each showing what it will change before you approve it.
Login protection
Repeated failed sign-ins pause that connection, with an allowlist, a blocklist and a hidden bot check on the forms.
Two-factor and passkeys
Any authenticator app with 10 single-use backup codes, and passkeys with a fingerprint, face or device PIN. Require them by role.
Lockout recovery
A single-use recovery link and printed recovery codes get you back in without FTP or a call to your host.
Activity log
Sign-ins, accounts, roles, plugins, themes and core, with who and when. Each finished day is sealed, so a later edit or deletion opens a finding.
File integrity
WordPress core and directory plugins compared with the copies WordPress.org publishes, showing exactly which lines changed. One click puts the official file back, and the replaced file is kept, never deleted.
Optional vulnerability checks
With your consent, compare installed versions with published advisories from BetterShield Hub. No account is needed. If data cannot be fetched, the screen says so instead of reporting a clean result.
Incidents
Related access and file changes are joined into one incident, with signs of an account takeover flagged. You review the response plan before anything changes.
Score trend · 30 days
Track every fix. Watch your score rise over time.
BetterShield keeps each day’s score for 30 days, or 90 with Ultra. The Overview shows what has changed since an earlier day: which checks opened, passed or changed severity, with your score then and now.
AI assistants
Ask your AI. You decide what it changes.
Turn on the built-in MCP server and Claude, ChatGPT, Cursor, Codex or another assistant can read your site’s security through 28 bounded, read-only abilities.
Changing is a second switch, off by default. With it on, an assistant can apply fixes, and every change is recorded in the activity log. A change to how people sign in, taking a protection off, updating a plugin, moving files into quarantine or changing an account waits for you to agree.
Never possible through a connection: creating accounts or credentials, changing recovery, two-factor or alert settings, lifting lockouts, or deleting log rows.
ClaudeChatGPTCursorCodex yoursite.com · changes allowed
What should I fix first?
Used Read the audit → score 58 · 9 open findings
Start with the dashboard file editor. Turning it off is a one-click fix that leaves sign-in alone, so I can do that now. Changing the sign-in address needs your agreement first.
Used Apply a fix → Turn off the file editor · applied
Change the sign-in address: waiting in Agents › Requests
BetterShield Hub
Look after every site from one screen
See your connected sites’ scores and findings in one free dashboard. Review fixes, compare sites with a shared baseline and bring alerts to your team. Schedule client reports and share a status page, all with the free plugin. Choose a weekly workspace summary or daily update emails.
Approve each connection on the WordPress site, read-only if you prefer. Hub shows a plan before applying a finding fix.
BetterShield Ultra
Keeps working when you log off
BetterShield Ultra adds premium features for the sites you manage: two-factor setup at sign-in, trusted devices, alert channels, client reports, temporary access and Cloudflare controls.
See what Ultra adds- wp-config.php changed on shop.example
- Temporary access ended on acme.example
- Sign-in lockout on blog.example
- Client report for Acme Dental
Start free. Take full control with BetterShield Ultra.
Go Ultra: one license with every Ultra feature. Just choose how many sites it covers: 1, 5, 25 or 100.
Free
From WordPress.org$0 No account, no payment
- 75-check audit and score
- 30 one-click security fixes
- Login protection, two-factor and passkeys
- Activity log and file integrity check
- Lockout recovery without FTP
- Incidents that group related events
- MCP server for AI assistants
Ultra PersonalBusinessAgencyAgency Plus
Everything in Free, plus$79 per year · 1 site
$139 per year · 5 sites
$299 per year · 25 sites
$599 per year · 100 sites
$199 paid once · 1 site
$399 paid once · 5 sites
$699 paid once · 25 sites
$1,199 paid once · 100 sites
Every Ultra feature, on one site.Every Ultra feature, on up to five sites.Every Ultra feature, on up to 25 sites.Every Ultra feature, on up to 100 sites.
- Two-factor setup at sign-in, passkey policy and trusted devices
- Chat, webhook, syslog and incident alert destinations, with rules by event type or person
- Scheduled client reports, and activity reports for one person or role
- Temporary access that ends on its own
- Cloudflare controls (WordPress 7.0 or newer)
- Up to 365 days of activity history
Get Ultra Personal, 1 site
Get Ultra Business, 5 sites
Get Ultra Agency, 25 sites
Get Ultra Agency Plus, 100 sites
Get Ultra Personal Lifetime, 1 site
Get Ultra Business Lifetime, 5 sites
Get Ultra Agency Lifetime, 25 sites
Get Ultra Agency Plus Lifetime, 100 sites
See what Ultra adds, and what is free
14-day money-back guarantee
Full refund within 14 days on any Ultra plan. A yearly plan renews at the same price until you cancel; a lifetime plan is paid once.
Start here
Where to begin with WordPress security
The guides and docs we would read first, from setting up to switching plugins.
- Guide
The WordPress security checklist: 75 checks, explained
What the audit looks at in each of its five areas, and what to do about every finding. - Docs
Install and set up
Install the free plugin and work through each Quick Setup step, with its choices and defaults. - Docs
Recommended setup
What to turn on after Quick Setup, in what order, and why. - Guide
WordPress hardening: 30 one-click fixes and what each changes
What each one-click fix changes, what it can affect, and which to watch with Monitor first. - Guide
WordPress two-factor authentication and passkeys: a setup guide
Authenticator apps and passkeys, requiring them by role, and helping someone who lost their phone. - Docs
Score and findings
What your score and grade mean, and how to fix, snooze or set aside each finding. - Docs
Locked out
Use your recovery link or a recovery code to pause protections for an hour and sign in again. - Guide
Unexpected WordPress admin activity: a first-hour response plan
Preserve evidence, review access and contain changes in the first hour after unexpected admin activity. - Guide
How to switch WordPress security plugins without lockouts
A way back in first, one job at a time, never two login limiters, and a check after every step. - Guide
WordPress MCP: connecting an AI assistant to your site safely
What an MCP connection lets an assistant read and change, and what to ask before you connect one.
FAQ
Frequently asked questions
Short answers to the questions we get asked most about BetterShield.
Is BetterShield free?
Yes. The audit, every plain-language explanation, all 30 fixes, two-factor authentication, passkeys, login protection, the recovery link, the activity log, incident response, the file check and the MCP server are free. There is no account and no payment. BetterShield Ultra adds premium features for the sites you manage.
Does it include a firewall or a malware scanner?
The free plugin does not include a general-purpose firewall and does not provide a general malware scan or automatic cleanup. It flags limited store-script and added-PHP signals for review; these cannot establish that a site is clean. Ultra adds optional request protection through a usable Hub link and applicable rules. It audits your configuration, hardens it with one-click fixes, secures logins, logs activity, groups suspicious changes into incidents, compares WordPress core and directory plugins with the official WordPress.org copies, and watches your theme and the files nobody publishes for changes.
Will the fixes break my site?
Every fix can show you what it will change before you apply it, and you can switch it off at any time. Where switching off cannot reach everything, the fix says so first: people signed out by a key change stay signed out, and browsers that already saw the HSTS header keep insisting on HTTPS until it expires.
What happens if I lock myself out?
Open your latest recovery link and press its one button. BetterShield’s sign-in protections pause for one hour and your settings stay exactly as they are. Using a link issues the next one straight away, on the page and by email, and printed recovery codes are a second way back in.
Can an AI assistant change my site?
Only if you let it. The MCP connection is off until you turn it on under Agents › Connect, and reading and changing are separate switches. With only reading on, an assistant can look and change nothing. With changing on, it can apply fixes and put a changed file back, and every change is recorded in the activity log. A change to how people sign in, taking a protection off, updating a plugin, moving files into quarantine or changing an account waits for you to agree to the plan it shows you. Creating accounts or credentials, changing your recovery options, two-factor or alert settings, lifting lockouts and deleting log rows are never possible through a connection.
Does BetterShield detect vulnerable plugins?
Vulnerability checks are optional. With consent in Settings, BetterShield asks BetterShield Hub for published advisories and matches versions on your site. No Hub account or paid license is required. A failed refresh is shown as unavailable or stale, never as a clean result.
Do I need an account?
No account is required for the free WordPress plugin. Create a Hub account only if you want its workspace for connected sites, team access and reports. Optional vulnerability checks need your consent but no Hub account.
Does BetterShield send my data anywhere?
File checks contact WordPress.org for core and directory plugins and the publisher for supported WPDeveloper paid-plugin checksums. Requests carry version numbers and plugin slugs, never your site address, email or username. Optional services require your choice: usage sharing (asked once in Quick Setup, where Skip sends nothing), the breached-password check, your own AI provider, and BetterShield Hub.
Close the open doors today
Install the free plugin. The first audit runs when you activate it, and all but one of the fixes wait for your choice.
Requires WordPress 6.7 or newer and PHP 8.0 or newer.