# Explain a WordPress security audit in plain language with AI

Use your own AI provider to explain one finding, a whole audit or an incident in plain language, see what is sent first, and keep your key out of the plugin.

By M Asif Rahman, Nov 3, 2026.

You can have a WordPress security audit explained in plain language by connecting an AI provider to WordPress and pressing one button in **BetterShield**: **Explain This in Plain Language** on a finding, **Explain My Audit** on the Overview, or **Explain This** on an incident. The explanation is read-only. It rewrites what the plugin already recorded, and your own provider sees the request, not BetterShield’s servers.

This guide shows where each button is, exactly what is sent, what it costs you and how to check it is working. If you have not run an audit yet, [what a 57-check security audit looks at](/blog/wordpress-security-audit/) comes first, and [what a WordPress security plugin sends off your site](/blog/what-wordpress-security-plugins-send/) covers the privacy side in full.

## Quick summary

- BetterShield can explain one finding, up to 12 open findings at once with **Explain My Audit**, or one incident, in plain language.
- It needs WordPress 7.0 or newer and an AI provider connected under **Settings › Connectors**. If no compatible provider is connected, the buttons do not appear.
- BetterShield never asks for, stores or sends your AI key. The request goes through the connector WordPress already holds.
- Nothing is sent until you press a button. An explanation does not change the audit, the incident or the site, so there is nothing to undo.
- An answer is reused until its evidence changes, and the free plugin allows up to 20 explanation requests per hour for each account.

## Why it matters

A finding is accurate but terse. It names a setting, a severity and a value, and a site owner who is not a developer still has to translate that into “should I do something, and what could it break?” An explanation turns the same recorded facts into sentences. It is a reading aid, in the same way a colleague might talk you through a report.

The risk is treating the reading aid as the report. An AI provider can word things loosely, so BetterShield keeps the original evidence one click away and tells you to decide from that. The explanation helps you start; the evidence settles the question. Nothing about the feature touches your settings, so using it cannot weaken the site.

## What the three buttons do

There are three places an explanation can start. Each one sends a different slice of what the plugin has already recorded.

| Where | Button | What is sent |
|---|---|---|
| A row on **BetterShield › Findings** | **Explain This in Plain Language** | That finding’s title, severity, description and recorded evidence |
| **BetterShield › Overview** | **Explain My Audit** | The titles, severities and recorded evidence of up to 12 open findings, in one request |
| An incident under **Activity › Incidents** | **Explain This** or **Draft a Summary for My Client** | What was recorded about that incident, with accounts and files named only as placeholders such as “account-1” |

In every case web and email addresses are removed, and file contents, usernames, keys and your site’s address are never sent. The full list is in [What BetterShield contacts](/docs/what-bettershield-contacts/), and the plugin’s own readme repeats it.

On the Overview, **Your audit, explained** returns three short paragraphs that cite the findings they used. For a single finding, the explanation sits beside the evidence you can read in [the evidence behind a finding](/docs/finding-details/): **Why it matters**, **What to know first**, **Effect on the score** and **Evidence**.

## Set it up

You do not install anything extra. The feature appears when WordPress has a provider to talk to.

1. Make sure the site runs WordPress 7.0 or newer.
2. Connect a compatible AI provider under **Settings › Connectors** in WordPress. This is where the key lives, in WordPress, not in BetterShield.
3. Open **BetterShield › Overview**. If you see **Explain My Audit**, a provider is available. If you do not, no compatible provider is connected yet.
4. Select **Explain My Audit** to ask about your open findings, or open a finding on **BetterShield › Findings** with **Explain** and select **Explain This in Plain Language**.
5. For an incident, open **BetterShield › Activity › Incidents**, select **Review Timeline**, and under **Explain this incident** choose **Review Exactly What Will Be Sent** before **Explain This** or **Draft a Summary for My Client**.

On an incident, use the preview whenever the evidence might include something you want to read first. Your provider can charge for each request, so check its pricing if you plan to use the buttons often. WordPress’s own notes on the AI work it is building into core are collected at [Make WordPress AI](https://make.wordpress.org/ai/).

### What an AI assistant can and cannot do here

These buttons are a separate path from connecting an assistant to your site. When you use **Explain My Audit**, your site calls your provider once and gets text back. It does not give a provider access to your dashboard. If you want an assistant that reads or changes the site through MCP, that has its own approvals, limits and undo, covered in [connecting an AI assistant safely](/blog/ai-assistant-wordpress-security/).

## What it can break, and how to undo

Very little. The request is read-only, so there is no setting to put back and no entry to undo. The trade-offs are the ones worth knowing before you press anything:

- **Evidence leaves the site.** The slice in the table above goes to your connected provider. Use the preview on incidents if you want to read it first.
- **Your provider can charge.** Each new request may use its quota or cost money. Repeat questions are cheaper, because an answer is reused until its evidence changes.
- **The wording can be wrong.** An explanation is a summary of recorded evidence, not a verdict on anyone’s intent. Check an important statement against the finding or the incident’s timeline before acting on it.
- **There is an hourly limit.** The free plugin allows up to 20 explanation requests per hour for each account. If you hit it, wait for the next hour.

To stop new requests, disconnect or disable the provider in WordPress. The buttons disappear, and the audit, the findings and every fix carry on as before.

## Check it is working

Open the usage row and watch the counts move.

1. Go to **BetterShield › Settings › General › Privacy & sharing › Plain-language explanations**. It shows whether explanations are available, how many requests were made to your provider this month and how many were answered from earlier requests.
2. Ask for one explanation. The monthly provider count should rise by one.
3. Ask for the same explanation again without changing anything. The reused count should rise instead, because the evidence is the same. [Review plain-language explanation usage](/docs/plain-language-explanations/) lists what the row shows.
4. For the audit summary, confirm the three paragraphs cite the findings they used. The card is described in [Request an audit explanation](/docs/explain-an-audit/).
5. For incidents, [read the explanation steps](/docs/explain-an-incident/) and compare the answer with the incident’s own timeline.

## Recommended settings

We recommend a few habits rather than settings, since the feature has no option of its own.

| Situation | What we recommend |
|---|---|
| A site with a strict privacy policy | Leave no AI provider connected, and the buttons stay out of reach |
| A site owner who is not technical | Use **Explain My Audit** first, then open the evidence on the one or two findings that matter |
| An agency preparing a client update | Use **Draft a Summary for My Client** on an incident, after **Review Exactly What Will Be Sent**, and edit the draft before sending it |
| A site that changes often | Expect fresh requests after each change, since a reused answer lasts only while the evidence is the same |

Whatever the situation, make the decision from the recorded evidence and the finding’s **What to know first** section, and treat the explanation as a way into them.

## Frequently asked questions

### Does BetterShield store my AI key?

No. BetterShield has no key field and never sees, asks for or stores your key. WordPress holds the connection under **Settings › Connectors**, and the request goes through it.

### What exactly is sent to the AI provider?

For one finding, its title, severity, description and recorded evidence. For **Explain My Audit**, the titles, severities and recorded evidence of up to 12 open findings. For an incident, what was recorded about it, with accounts and files replaced by placeholders. Web and email addresses are removed, and file contents, usernames, keys and your site’s address are never sent.

### Why can I not see Explain My Audit?

The button appears only when WordPress 7.0 or newer has a compatible AI provider connected. Connect one under **Settings › Connectors**, then reload the Overview.

### Does an explanation change my site or my score?

No. It is read-only. It does not apply a fix, change a setting, close a finding or move the score. Fixes have their own **Apply Fix** buttons and their own undo.

### Can I use the free plugin for this?

Yes. The explanations are part of the free plugin, with up to 20 requests per hour for each account. Your provider may charge for the requests it receives.

## Conclusion

Plain-language explanations turn a list of findings into a few readable paragraphs, using the AI provider you already control and nothing BetterShield stores. Press a button when you want one, check the recorded evidence before you act, and watch the usage row to see what was asked. BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/), and the step-by-step page for the audit summary is [Request an audit explanation](/docs/explain-an-audit/).