-
See who saved a file in the WordPress theme and plugin editor
BetterShield records each file editor save in WordPress as High, naming who saved which file and never its contents. Here is how to read the row.
-
WordPress MCP permissions: limit each AI app’s tools
Choose which security tools each connected AI app may use on your WordPress site, and watch other plugins’ MCP endpoints and ability changes.
-
Require sign-in for a WordPress REST API route, after a week
Close one public REST API route to signed-out visitors, but only after a week of watching who uses it, with Undo if a form or app stops working.
-
Limit Login Attempts Reloaded alternative: switch to BetterShield
Moving from Limit Login Attempts Reloaded to BetterShield? See what the import carries, what to check behind a proxy, and the order that avoids a lockout.
-
Pause WordPress security alerts for maintenance, keep protection on
Choose between Mute all alerts, a planned maintenance window and holding one event type, and see what each one keeps running while you work on your site.
-
WordPress security plugin setup: Quick Setup and what to check
How to set up a WordPress security plugin in your first hour: what BetterShield's Quick Setup does at each step, and what to check after it finishes.
-
Ask for your password before anyone removes a WordPress protection
Turn on BetterShield’s password check so removing a protection needs the administrator’s password first. What it covers, what it skips, and how to undo it.
-
Elementor security: add-ons, code editors and file changes
Elementor security for page-builder sites: compare directory add-ons with official copies, watch premium add-ons and the theme, and switch the code editors off.
-
WordPress 2FA remember device: trust a browser for up to 90 days
Let a browser skip the WordPress two-factor code screen for 1 to 90 days, see which browsers are trusted, and forget them when a laptop is lost.
-
Explain a WordPress security audit in plain language with AI
Use your own AI provider to explain one finding, a whole audit or an incident in plain language, see what is sent first, and keep your key out of the plugin.
-
WordPress login security: the layers in order, lockouts to passkeys
Secure the WordPress login in a sensible order: recovery first, then lockouts, the bot check, two-factor, passkeys and an optional new sign-in address.
-
Temporary WordPress access for a developer, with an end date
Give a developer or support person a WordPress role for one hour to 30 days, see what they did, and let the access end on its own, without a shared login.
-
WordPress blog security: authors, editors, comments and visitors
Secure a multi-author WordPress blog: two-factor for writers, limits on comments, and what to stop showing visitors, step by step with BetterShield.
-
Hide the WordPress version without breaking caches
Remove the WordPress version from pages, feeds and script addresses, see what it does and does not change, and why caches still refresh after every update.
-
WordPress MCP write access: approvals, limits and undo
How to let an AI assistant change your WordPress site: which fixes apply at once, which wait for your yes, the hourly limits, and how each change is undone.
-
WordPress new sign-in email: tell people when they sign in elsewhere
Email each account holder when their account signs in from a network it has not used before. See what the email says, what it never does and how to turn it on.
-
WordPress security monitoring: what to look at each week
A weekly WordPress security monitoring routine built from what BetterShield records: the summary email, the Overview, audit comparisons and unusual activity.
-
Passkey-only sign-in in WordPress: turn passwords off by role
Passkey-only sign-in stops passwords signing in the roles you pick. See every safeguard, what refused people see and how password sign-in comes back.
-
Membership site security: members, instructors and shared logins
Membership and LMS site security for WordPress: keep sign-up quiet, require two-factor of staff, cap sessions, and keep members out of the dashboard.
-
WordPress site lockdown: sign others out and freeze changes
How to lock down a WordPress site in one step: who is signed out, what is frozen, what visitors see, how to lift it and how to check it worked.
-
Switch from Kadence Security to BetterShield: what carries over
Moving from Kadence Security to BetterShield? See what the import carries over, what it holds back and why, and the order that avoids a lockout.
-
Refuse cloud-metadata requests in WordPress: the fix that starts on
How to refuse plugin requests to cloud-metadata addresses in WordPress, let your own services through, check it is working, and undo it.
-
Manage security across many WordPress sites from one hub
Connect each client site to the free BetterShield Hub, review scores in one list, send client reports and hand a site back cleanly, with the undo for each step.
-
WordPress recovery mode vs a recovery link: which gets you back in
WordPress recovery mode handles a crashed plugin; BetterShield’s recovery link handles a sign-in rule that blocks you. What each covers and how to set up both.
-
Two-factor for WooCommerce customers: passkeys and codes
How WooCommerce customers set up two-factor and passkeys on My Account › Sign-in security with BetterShield, what you can ask of staff, and what you can’t.
-
WordPress security plugin privacy: what leaves your site
What a WordPress security plugin sends off your site: what BetterShield contacts out of the box, what each optional service gets, and how to check.
-
Switch from All-In-One Security to BetterShield: what carries over
Moving from All-In-One Security to BetterShield? See what the import carries over, what it holds back and why, and the order that avoids a lockout.
-
WordPress behind Cloudflare or a proxy: get the visitor's real IP
How BetterShield tells visitors apart behind Cloudflare, a load balancer or a proxy, so sign-in pauses follow one person and never everyone at once.
-
How to secure a WordPress site: what to turn on, in order
A calm order for securing a WordPress site with BetterShield: your way back in, sign-in, the fixes, alerts, the log and file check, then assistants.
-
Switch from Really Simple Security to BetterShield: what carries over
Moving from Really Simple Security to BetterShield? See what the import carries over, what it holds back and why, and the order that avoids a lockout.
-
WordPress multisite security: one score table, rules set once
How to see every site’s score in one table and set two-factor and passkey rules once for a WordPress multisite network, with recovery and the undo.
-
WordPress security from the command line: WP-CLI commands
Run a WordPress security audit, preview hardening fixes, read the activity log and release lockouts from the terminal with BetterShield’s WP-CLI commands.
-
WooCommerce security: protect customer and staff sign-ins
WooCommerce security for the accounts behind your store: what to set for customers and for staff, and why BetterShield leaves the cart and checkout alone.
-
WordPress security email alerts: a weekly summary and instant mail
Set up WordPress security email alerts that stay useful: a weekly summary, instant mail for high and critical events, recipients, maintenance and mute.
-
WordPress security audit: what 71 checks look at, and what they miss
What a WordPress security audit checks, how the score and grade are worked out, what snooze and not applicable do, how often it runs, and what it is not.
-
MCP security best practices for a WordPress site
Six rules for letting an AI assistant near your WordPress site: read first, narrowest access, your yes on heavy changes, a full log and a way to cut it off.
-
WordPress IP allowlist and blocklist without locking yourself out
How to keep your office addresses from ever being paused and refuse sign-in to chosen addresses, usernames or browsers in WordPress, with the undo.
-
Limit comment spam and password resets in WordPress
How to hold comment bursts, slow repeated password reset requests and cap sign-ups per connection in WordPress, preview new numbers and undo it.
-
Keep subscribers and customers out of wp-admin in WordPress
How to send subscribers and store customers from wp-admin to the front page, keep their profile, trial it first, and undo it, with BetterShield.
-
Switch from Wordfence to BetterShield: what carries over
Moving from Wordfence to BetterShield? See what the import carries over, what it leaves behind and why, and the order that avoids a lockout.
-
WordPress security plugin: six questions to ask before you choose
How to choose a WordPress security plugin: six questions about findings, undo, data, speed, recovery and limits, each answered for BetterShield.
-
Hide sensitive files in WordPress: backups, logs and wp-config copies
How to stop visitors fetching wp-config backups, debug logs, database dumps and .env files in WordPress: what the fix hides, what it can break, how to check.
-
How to rotate WordPress security keys and salts, and when to
What WordPress security keys and salts do, how to strengthen and rotate them without editing wp-config.php, who gets signed out, and when to rotate.
-
WordPress login CAPTCHA alternative: a hidden bot check
A WordPress login CAPTCHA alternative that asks visitors for nothing: how BetterShield’s hidden bot check works, what it misses and how to check it.
-
WordPress uploads folder security: stop PHP and folder listings
How to secure the WordPress uploads folder: stop PHP files there from running, stop folders listing their files, what each can break, and how to check.
