# WordPress security plugin: six questions to ask before you choose

How to choose a WordPress security plugin: six questions about findings, undo, data, speed, recovery and limits, each answered for BetterShield.

By M Asif Rahman, Oct 15, 2026. Updated Nov 2, 2026.

To choose a WordPress security plugin, ask six questions of any candidate: does it show what it found, can every change be undone, what leaves the site, what does it slow down, can you get back in, and what does it not do. This guide answers all six for **BetterShield**, from its own documentation, so you can hold any plugin to the same list.

If you would rather start from the checks themselves, [The WordPress security checklist](/blog/wordpress-security-checklist/) walks through all 71. This post is the step before it: how to decide what kind of plugin you want, and what to expect from the one you pick.

## Quick summary

- A security plugin is worth keeping when it shows its evidence, so each finding says what it is, why it matters and what could break if you act on it.
- Every change should be reversible. BetterShield’s 30 one-click fixes each show a preview first, and each undo never expires.
- Core and directory plugins use WordPress.org for file checks; supported WPDeveloper paid plugins also use publisher checksums. These checks need no account. Usage sharing, the leaked-password check, your own AI provider and BetterShield Hub are each off until you turn them on.
- A plugin should tell you what it costs your visitors, and it should keep a way back in that needs no password.
- BetterShield is not a firewall and does not scan for or remove malware. A plugin that is honest about its limits is easier to trust.

## Why the questions matter more than the feature list

Most security plugins publish a long list of features. A list tells you what a plugin can do on a good day. It does not tell you what happens when a setting locks you out, when a check cannot run, or when you want to move to something else.

The six questions below are about those days. They are plain enough to ask of any plugin, free or paid, and each one has an answer you can verify in the plugin’s own screens. We answer them for BetterShield with its exact labels so you can check each one yourself on a test site.

[OWASP](https://owasp.org/www-project-top-ten/) publishes a widely used list of the most common web application security risks. It is a useful outside reference for what a security review should cover.

## 1. Does it show what it found, and how sure it is?

A score without evidence is a number to trust or distrust. A better plugin shows its work.

The score combines 60 points for setup essentials and 40 for site health. Setup findings use their own item weights; other findings reduce site health by severity. Any open critical finding caps the total at 74. A snoozed finding still counts; a finding marked not applicable does not.

| Severity | Points off while open |
|---|---|
| **Critical** | 25 |
| **High** | 12 |
| **Medium** | 7 |
| **Low** | 3 |
| **Info** | 0 |

The grade runs from A (90 to 100) down to F (below 45). **BetterShield › Overview** shows the score and what to do first, and **BetterShield › Findings** lists every finding. **Explain** on a finding opens **Why it matters**, **Before you act**, **Effect on the score** and **Evidence**, with when it was last checked.

Three details show how seriously a plugin takes honesty:

- **A check that could not run is never counted as a pass.** The Overview says how many checks ran and how many could not, with **See which ones**.
- **A snoozed finding still counts.** **Remind me later** moves it aside for 7 or 30 days without improving the score.
- **A finding marked Not applicable does not count**, and **Put back in the report** returns it. That is your decision, recorded, not a way to hide a problem.

Ask the same of any plugin you test: when something cannot be checked, does it say so, or does it show green?

## 2. Can every change be undone?

A security plugin changes your site. That is its job, and it is also the risk. The question is whether the way back is as easy as the way in.

BetterShield has 30 one-click fixes, listed in [Hardening](/docs/hardening/). One is on from the start, **Server detail protection**. The other 29 start off, and nothing changes until you turn one on. Every fix follows the same steps:

1. Press **Preview the change**. It lists what applying would do and changes nothing.
2. Turn the switch on. The row shows **On since** and **Undo never expires**.
3. To undo, turn the switch off. Files a fix wrote are put back as they were.

Five fixes also offer **Monitor first**, which watches real requests for 1 hour, 24 hours or 7 days without blocking anything, so you see what the fix would have refused. Even then, a match is not proof that something would break, and no matches is not proof that nothing will.

A trustworthy plugin also says where undo stops. In BetterShield, **Sign everyone out on demand** ends sessions that stay ended, and a browser that has seen the HSTS header keeps insisting on HTTPS until it expires. The fix tells you before you apply it. Look for that candour in any plugin: a promise of “undo everything” with no exceptions is rarely the whole story.

Every apply and undo is recorded in the [activity log](/docs/activity-log/), so you can see who changed what, and when.

## 3. What leaves the site?

Security plugins sit close to your data. Find out what they send, to whom, and whether you chose it.

BetterShield contacts WordPress.org for core and directory-plugin file checks. Supported WPDeveloper paid plugins also use publisher checksums, without an account. Those requests carry version numbers and plugin slugs, never your site address, email or username. There is no account to create.

Four things are off until you turn them on:

| Service | What it is |
|---|---|
| Usage sharing | Offered in the first Quick Setup step |
| The leaked-password check | Only with **Leaked password check** on |
| Your own AI provider | Only when you press an **Explain** button |
| BetterShield Hub | Only after you connect a site |

[What BetterShield contacts, and when](/docs/what-bettershield-contacts/) lists each outside address, when it is contacted, exactly what is sent and how to turn it off. We recommend reading that page, or the equivalent for any plugin you are weighing, before you install it. If a plugin cannot tell you this on one page, that is an answer too. The post [what a WordPress security plugin sends off your site](/blog/what-wordpress-security-plugins-send/) walks through that page row by row.

## 4. What does it slow down?

A security plugin that makes visitors wait has a cost, and the owner should be able to see it.

BetterShield’s answer is a number for your own site. The Overview’s **What this plugin costs your visitors** card shows what it adds to page views, measured on one view in 20. For visitors, it runs the fixes you turned on, its login protection on sign-in, the limits on the comment, reset and sign-up forms, and a hidden bot check on the sign-in, registration and comment forms.

Audits, file checks and emails never run inside a visitor’s page view. On the WooCommerce cart and checkout, BetterShield adds no bot check, skips its sampling, checks and housekeeping, and only records security events.

If you run a shop, that last point matters most: ask any plugin what it does on the checkout path, and prefer one that does nothing there. Whatever you install, measure your own site before and after.

## 5. Can you get back in?

The most common security-plugin disaster is a locked-out owner. A good plugin plans for it before you need it.

BetterShield gives you two ways back in that need no password, both set up under **BetterShield › Protection › Recovery**:

- **The recovery link** is a private address for the site. It works once, stops working 90 days after it was issued, and is emailed to the administration address when you activate BetterShield.
- **Printed recovery codes** are eight single-use codes for the day email is the problem.

Either one starts safe mode for an hour, so a BetterShield setting can never keep you out for good. **Recovery readiness** checks both every day without using either. Applying a fix that changes how people sign in also checks first that you have a working way back, and says so if you do not.

Two-factor works the same way. Nothing is enforced until the authenticator app is proven to work and the backup codes are saved, and required two-factor comes with a 14-day grace period by default. [Set up recovery](/docs/set-up-recovery/) and [Locked out](/docs/locked-out/) cover the steps, and the post [Locked out of WordPress](/blog/locked-out-of-wordpress/) shows what a recovery looks like.

## 6. What does it not do?

This question separates marketing from documentation. Every plugin has limits, and the honest ones list them.

BetterShield is plain about its own:

- **The free plugin does not include a general-purpose firewall.** Ultra separately offers [targeted request protection](/docs/request-protection/) through Hub. On a server that runs Fail2Ban, it can tell the server’s firewall when a connection is paused, which is a separate switch.
- **It does not scan for or remove malware.** It audits your configuration ([what the 71 checks look at](/blog/wordpress-security-audit/)), and it compares WordPress core and directory plugin files with the official WordPress.org copies, showing which lines changed and keeping the replaced file rather than deleting it.
- Vulnerability checks are optional. With consent in Settings, BetterShield asks BetterShield Hub for published advisories using Wordfence Intelligence data and matches versions on your site. No Hub account or paid license is required. A failed refresh is shown as unavailable or stale, never as a clean result.
- **The activity log is tamper-evident, not tamper-proof.** Each finished day is sealed, and an edit or deletion opens a high-severity finding.

Whichever plugin you choose, work out which of these jobs you still need to cover, and whether another tool should do them. BetterShield can run beside another security plugin: Quick Setup asks which one keeps each shared job, and [Run BetterShield alongside another security plugin](/docs/alongside-another-security-plugin/) explains the split. If you decide to move, [How to switch WordPress security plugins without lockouts](/blog/switch-wordpress-security-plugins/) is the order we recommend.

## How it compares with other plugins

A side-by-side belongs on a page that can be kept up to date and checked. The [comparison](/compare/) sets BetterShield beside eight other security plugins in one table, with prices and notes on how every cell was checked. We recommend reading it with the six questions in hand, because a table of features answers “what does it have” and the questions answer “what happens when I use it”.

## What is free, and what is not

The audit, every plain-language explanation, all 30 fixes and their undo, two-factor, passkeys, login protection, the recovery link, the activity log, incident response, the file check and the MCP server are free. There is no account and no payment.

BetterShield Ultra is a separate paid add-on for people who look after sites for others. It needs BetterShield active on the same site, and its details are on the [Ultra page](/ultra/). Nothing in a warning or a finding ever carries an upgrade prompt.

## Recommended settings

We recommend a simple order for a new site:

1. Install BetterShield and let the first audit run. It only reads.
2. Look at **BetterShield › Overview** and work through **Worth doing first**.
3. Check that your recovery link arrived, and print the recovery codes.
4. Apply the five fixes Quick Setup offers, because none of them can lock anyone out, then add the rest one at a time, with **Monitor first** where it is offered.
5. Run the same six questions against any other plugin you are weighing, on a test copy of the site first.

## Frequently asked questions

### What is the best WordPress security plugin?

It depends on the job you need done. We recommend deciding which jobs matter to you, such as an audit, hardening, sign-in protection, an activity log or a firewall, and choosing a plugin that does them and says plainly what it leaves out. The six questions above are a way to test that, and the [comparison](/compare/) lays eight other plugins beside BetterShield.

### Is there a free WordPress security plugin worth using?

Yes. BetterShield’s audit, 30 fixes with undo, two-factor, passkeys, login protection, activity log and file check are all free, with no account. The paid add-on, BetterShield Ultra, is for agencies and adds extras such as a scheduled client report.

### Do I need a firewall plugin as well?

BetterShield does not include a firewall, so if you want one, add it from a source you trust, or ask your host what the server already provides. BetterShield can tell a server running Fail2Ban when it pauses a connection.

### Will a security plugin slow my site down?

Any plugin does some work. BetterShield measures its own cost and shows it on the Overview, runs audits and file checks outside visitors’ page views, and adds nothing to the WooCommerce cart or checkout pages.

### Can I run two security plugins at once?

Yes, with care. Quick Setup asks which plugin keeps each shared job, such as login limits, so they are not both doing it. It does not catch every overlap, so check the other plugin’s settings too, and avoid turning on login or two-factor features in both.

## Conclusion

Choosing a WordPress security plugin comes down to evidence, reversibility, privacy, cost, a way back in and honesty about limits. Ask each question of every candidate, test on a copy of your site, and keep the plugin that answers plainly. For BetterShield, every answer is written down in the docs.

BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). Start with [Score and findings](/docs/score-and-findings/) to see what the first audit tells you, and keep the [checklist](/checklist/) open beside it.