Explain a WordPress security audit in plain language with AI
You can have a WordPress security audit explained in plain language by connecting an AI provider to WordPress and pressing one button in BetterShield: Explain This in Plain Language on a finding, Explain My Audit on the Overview, or Explain This on an incident. The explanation is read-only. It rewrites what the plugin already recorded, and your own provider sees the request, not BetterShield’s servers.
This guide shows where each button is, exactly what is sent, what it costs you and how to check it is working. If you have not run an audit yet, what a 57-check security audit looks at comes first, and what a WordPress security plugin sends off your site covers the privacy side in full.
Quick summary
- BetterShield can explain one finding, up to 12 open findings at once with Explain My Audit, or one incident, in plain language.
- It needs WordPress 7.0 or newer and an AI provider connected under Settings › Connectors. If no compatible provider is connected, the buttons do not appear.
- BetterShield never asks for, stores or sends your AI key. The request goes through the connector WordPress already holds.
- Nothing is sent until you press a button. An explanation does not change the audit, the incident or the site, so there is nothing to undo.
- An answer is reused until its evidence changes, and the free plugin allows up to 20 explanation requests per hour for each account.
Why it matters
A finding is accurate but terse. It names a setting, a severity and a value, and a site owner who is not a developer still has to translate that into “should I do something, and what could it break?” An explanation turns the same recorded facts into sentences. It is a reading aid, in the same way a colleague might talk you through a report.
The risk is treating the reading aid as the report. An AI provider can word things loosely, so BetterShield keeps the original evidence one click away and tells you to decide from that. The explanation helps you start; the evidence settles the question. Nothing about the feature touches your settings, so using it cannot weaken the site.
What the three buttons do
There are three places an explanation can start. Each one sends a different slice of what the plugin has already recorded.
| Where | Button | What is sent |
|---|---|---|
| A row on BetterShield › Findings | Explain This in Plain Language | That finding’s title, severity, description and recorded evidence |
| BetterShield › Overview | Explain My Audit | The titles, severities and recorded evidence of up to 12 open findings, in one request |
| An incident under Activity › Incidents | Explain This or Draft a Summary for My Client | What was recorded about that incident, with accounts and files named only as placeholders such as “account-1” |
In every case web and email addresses are removed, and file contents, usernames, keys and your site’s address are never sent. The full list is in What BetterShield contacts, and the plugin’s own readme repeats it.
On the Overview, Your audit, explained returns three short paragraphs that cite the findings they used. For a single finding, the explanation sits beside the evidence you can read in the evidence behind a finding: Why it matters, What to know first, Effect on the score and Evidence.
Set it up
You do not install anything extra. The feature appears when WordPress has a provider to talk to.
- Make sure the site runs WordPress 7.0 or newer.
- Connect a compatible AI provider under Settings › Connectors in WordPress. This is where the key lives, in WordPress, not in BetterShield.
- Open BetterShield › Overview. If you see Explain My Audit, a provider is available. If you do not, no compatible provider is connected yet.
- Select Explain My Audit to ask about your open findings, or open a finding on BetterShield › Findings with Explain and select Explain This in Plain Language.
- For an incident, open BetterShield › Activity › Incidents, select Review Timeline, and under Explain this incident choose Review Exactly What Will Be Sent before Explain This or Draft a Summary for My Client.
On an incident, use the preview whenever the evidence might include something you want to read first. Your provider can charge for each request, so check its pricing if you plan to use the buttons often. WordPress’s own notes on the AI work it is building into core are collected at Make WordPress AI.
What an AI assistant can and cannot do here
These buttons are a separate path from connecting an assistant to your site. When you use Explain My Audit, your site calls your provider once and gets text back. It does not give a provider access to your dashboard. If you want an assistant that reads or changes the site through MCP, that has its own approvals, limits and undo, covered in connecting an AI assistant safely.
What it can break, and how to undo
Very little. The request is read-only, so there is no setting to put back and no entry to undo. The trade-offs are the ones worth knowing before you press anything:
- Evidence leaves the site. The slice in the table above goes to your connected provider. Use the preview on incidents if you want to read it first.
- Your provider can charge. Each new request may use its quota or cost money. Repeat questions are cheaper, because an answer is reused until its evidence changes.
- The wording can be wrong. An explanation is a summary of recorded evidence, not a verdict on anyone’s intent. Check an important statement against the finding or the incident’s timeline before acting on it.
- There is an hourly limit. The free plugin allows up to 20 explanation requests per hour for each account. If you hit it, wait for the next hour.
To stop new requests, disconnect or disable the provider in WordPress. The buttons disappear, and the audit, the findings and every fix carry on as before.
Check it is working
Open the usage row and watch the counts move.
- Go to BetterShield › Settings › General › Privacy & sharing › Plain-language explanations. It shows whether explanations are available, how many requests were made to your provider this month and how many were answered from earlier requests.
- Ask for one explanation. The monthly provider count should rise by one.
- Ask for the same explanation again without changing anything. The reused count should rise instead, because the evidence is the same. Review plain-language explanation usage lists what the row shows.
- For the audit summary, confirm the three paragraphs cite the findings they used. The card is described in Request an audit explanation.
- For incidents, read the explanation steps and compare the answer with the incident’s own timeline.
Recommended settings
We recommend a few habits rather than settings, since the feature has no option of its own.
| Situation | What we recommend |
|---|---|
| A site with a strict privacy policy | Leave no AI provider connected, and the buttons stay out of reach |
| A site owner who is not technical | Use Explain My Audit first, then open the evidence on the one or two findings that matter |
| An agency preparing a client update | Use Draft a Summary for My Client on an incident, after Review Exactly What Will Be Sent, and edit the draft before sending it |
| A site that changes often | Expect fresh requests after each change, since a reused answer lasts only while the evidence is the same |
Whatever the situation, make the decision from the recorded evidence and the finding’s What to know first section, and treat the explanation as a way into them.
Frequently asked questions
Does BetterShield store my AI key?
No. BetterShield has no key field and never sees, asks for or stores your key. WordPress holds the connection under Settings › Connectors, and the request goes through it.
What exactly is sent to the AI provider?
For one finding, its title, severity, description and recorded evidence. For Explain My Audit, the titles, severities and recorded evidence of up to 12 open findings. For an incident, what was recorded about it, with accounts and files replaced by placeholders. Web and email addresses are removed, and file contents, usernames, keys and your site’s address are never sent.
Why can I not see Explain My Audit?
The button appears only when WordPress 7.0 or newer has a compatible AI provider connected. Connect one under Settings › Connectors, then reload the Overview.
Does an explanation change my site or my score?
No. It is read-only. It does not apply a fix, change a setting, close a finding or move the score. Fixes have their own Apply Fix buttons and their own undo.
Can I use the free plugin for this?
Yes. The explanations are part of the free plugin, with up to 20 requests per hour for each account. Your provider may charge for the requests it receives.
Conclusion
Plain-language explanations turn a list of findings into a few readable paragraphs, using the AI provider you already control and nothing BetterShield stores. Press a button when you want one, check the recorded evidence before you act, and watch the usage row to see what was asked. BetterShield is free on WordPress.org, and the step-by-step page for the audit summary is Request an audit explanation.