-
WordPress Abilities API: see what AI agents can reach and do
See which WordPress abilities AI agents can call, which change your site, who can call them, and what agents actually did, door by door.
-
Unexpected WordPress admin activity: a first-hour response plan
Unexpected administrator activity in WordPress? Preserve evidence, review access, contain suspicious changes and verify what remains in the first hour.
-
Fail2Ban alternative for WordPress: why choose BetterShield
Looking for a Fail2Ban alternative for WordPress? BetterShield adds login limits, recovery, 2FA and passkeys without server setup or an account.
-
Content Security Policy in WordPress: report first, then decide
Content Security Policy in WordPress without breaking pages: why inline scripts and embeds trip it, why report-only comes first, and how to read reports.
-
How to switch WordPress security plugins without lockouts
How to switch WordPress security plugins safely: a way back in first, one job at a time, never two login limiters, and a check after every step.
-
WordPress 2FA backup codes vs recovery codes: what to keep where
WordPress 2FA backup codes and the site's printed recovery codes do different jobs. How each works, how to store them, and what to do when they run out.
-
WordPress application passwords: find, limit and revoke them
WordPress application passwords sign tools in without a second factor. How to find unused ones, revoke an application password, and limit the rest.
-
WordPress hardening: 30 one-click fixes and what each changes
A practical WordPress hardening checklist: what each of BetterShield’s 30 fixes changes, what it can affect, and which to watch with Monitor first.
-
WordPress user enumeration: what it reveals and how to stop it
WordPress user enumeration explained: where usernames leak, why they matter less than you think, and how to stop user enumeration without breaking your site.
-
WordPress user roles security: least privilege without guesswork
WordPress user roles security in practice: the audit checks for risky accounts and roles, two-factor by role, and alerts when an account gains more power.
-
Introducing BetterShield: a free WordPress security plugin
BetterShield is a free WordPress security plugin that runs 71 checks, explains what it finds, and closes the gaps with one-click fixes you approve.
-
WordPress MCP: connecting an AI assistant to your site safely
What a WordPress MCP connection lets an AI assistant read and change, six questions to ask before you connect one, and how BetterShield answers them.
-
Change WordPress login URL: quieter logs, not a stronger door
How to change the WordPress login URL with BetterShield, what moving wp-login.php really stops, and why limits, two-factor and passkeys still matter.
-
Limit login attempts in WordPress without locking yourself out
How to limit login attempts in WordPress: sensible numbers, pauses that never lock the account, proxy and Cloudflare checks, and a way back in.
-
Locked out of WordPress? How to get back in without FTP
Locked out of WordPress? Use BetterShield’s recovery link, printed codes, unlock email or WP-CLI, and identify when the problem needs your host instead.
-
WordPress file integrity check: compare with the official copies
A WordPress file integrity check compares core and plugin files with the copies WordPress.org publishes. How BetterShield runs one, and what to do next.
-
The WordPress security checklist: 71 checks, explained
A practical WordPress security checklist: the five areas BetterShield audits, the checks that matter most in each, and what to do about every finding.
-
WordPress security headers, explained: what each one does
WordPress security headers in plain words: what each one tells the browser, what it could affect, and how to add HSTS and a content policy safely.
-
WordPress two-factor authentication and passkeys: a setup guide
Set up WordPress two-factor authentication with any authenticator app, add passkeys, set role requirements, and help someone who lost their phone.
-
Disable file editing in WordPress with or without DISALLOW_FILE_EDIT
Why to disable file editing in WordPress, how DISALLOW_FILE_EDIT and BetterShield’s one-click fix each do it, what it can affect, and how to put it back.
-
HSTS in WordPress: five minutes first, then six months
HSTS in WordPress, explained: what the header does, why to prove it at five minutes, what undo cannot reach, and how it works behind a proxy.
-
WordPress activity log: what it records and what to look for
A WordPress activity log records account actions and times. What BetterShield’s audit log records, how its sealed days work, and what to look for in it.
-
WordPress breached password check: what leaves your site
How BetterShield’s WordPress breached password check uses Pwned Passwords: what leaves your site, which passwords it checks, and what happens to old ones.
-
WordPress password policy: length, breach lists and sign-ups
Set a WordPress password policy that favors length, refuses breached and obvious passwords, and test the forms where those rules apply.
-
Should you disable XML-RPC in WordPress? How to decide and do it
Should you disable XML-RPC in WordPress? What xmlrpc.php does, what still uses it, and how to preview, watch, apply and undo the change.
-
Enforce 2FA in WordPress: pilot, recovery and rollout
How to enforce 2FA in WordPress for editors and administrators: which roles, a grace period, recovery first, telling your team, and what happens after.
-
WordPress force logout all users: what each option ends
WordPress force logout all users, one account or idle sessions: what each option ends, what it leaves, and how to see WordPress active sessions first.
-
How to add passkeys to WordPress, and when to go passwordless
How to add passkeys to WordPress: what the site needs, setup for you and your team, the sign-in button, and when passwordless login is worth it.