Manage security across many WordPress sites from one hub

To manage security across many WordPress sites, connect each one to BetterShield Hub, the free dashboard that lists every site’s score and findings in one place. Each site still works out its own score and keeps its own record, so the free plugin needs no Hub account. This guide covers connecting a site, reading the list, sending clients a report, and handing a site back when the work ends, with what each step can change and how to undo it.

If you are choosing a setup for your own portfolio, the agencies page shows how the pieces fit, and WordPress security from the command line covers the scripted side. This post is the route from the first site to the handover.

Quick summary

• BetterShield Hub is free and optional. It works with the free plugin from WordPress.org. The free plugin needs no Hub account; optional vulnerability checks use Hub’s advisory service with separate consent.
• You connect a site from its own BetterShield › Hub screen and approve it on that site’s consent page. The hub never connects a site by address alone.
• You choose what the hub may do: Read this site only, or Read this site and apply fixes that can be undone.
• Hub workspace client reports, shared alert destinations and status pages are free. BetterShield Ultra, the separate paid WordPress add-on, has its own on-site report plus temporary access and handover.
• Disconnect on the site ends the connection at once. Removing a site inside the hub does not.

Why many sites need one view

One site is easy to keep in your head. Ten are not. Each has its own dashboard and its own sign-in, so the sites you check least are the ones that drift. A set-up that was careful in March can look different by October, because different people changed it at different times.

Two things help. A single list that shows which site needs you first, and a way to keep sites on the same footing. The hub does the first. Settings export, WP-CLI and the hub together do the second. None of it replaces the per-site record: the activity log on each site still says who changed what.

Connect a site to the hub

Do this on each site, with an account allowed to manage BetterShield there. The Connect a site to BetterShield Hub doc has the full detail.

1. Go to BetterShield › Hub.
2. Under What the hub may do, choose Read this site and apply fixes that can be undone or Read this site only.
3. Press Connect to BetterShield Hub.
4. Sign in to the hub if asked. It brings you back to the site’s own Connect an assistant consent page.
5. Check the Site, Signed in as and Sends you back to lines, then press Connect.

You can also start from the hub: Add a site takes a site address and opens that site’s BetterShield › Hub screen. The site still has to approve.

The connection flow expires after 15 minutes. If the consent page says it is no longer valid, start again.

We recommend Read this site only for a site you only monitor, and read-and-fix for a site you look after actively. Turn on the Hub link where you want alerts sooner.

Read the list and run a check

The hub’s Sites screen shows each site’s score, grade, findings and connection state, with the sites that need attention first. The Show views include Critical or high, Down or unreachable, Not checked yet, Open incident and Disconnected on the site. You can also filter by grade, tag and BetterShield version, which helps before an update round.

Run a check asks up to 50 eligible sites to run the same operation. The choices are Security audit, File check, Recovery check, Incident evidence refresh, Vulnerability check and Scheduled work, run now. Scheduled work runs due site tasks; it is not just a read. These operations do not apply or remove protections. Each site reports Checked, Refused, Failed or another state as it answers.

Two small habits keep the list honest:

• Check Last read on a site before you act on its result. A site that has not reported recently shows old figures.
• Use tags for clients or maintenance groups, and Snooze alerts only for a known maintenance window. Snoozing pauses the hub’s alerts for that site, not the site’s own protection or email settings.

Reading and filtering change no site. Clear the filters and choose All to return to the default view.

Send clients a report

People who pay for a site rarely sign in to it. There are two ways to keep them informed, and they differ in where they live.

In the free Hub workspace, Client reports under Settings › Workspace sends a report for one site or every site with a tag. You choose Weekly (Mondays, for the week before) or Monthly (the 1st, for the month before), tick the members who get it, and add up to 20 client addresses. A client address must confirm before it receives anything. Preview the report, then use Send now if you want to see it arrive; that does not move the schedule.

On a single site, BetterShield › Ultra › Client report is part of BetterShield Ultra. It prepares a plain-language report of the score, open items, work completed and recorded activity. The schedule is off by default. Turn on Send this report, choose How often, add up to five addresses under Send it to, and press Save. Read it shows the report as it will arrive, and Send one now sends a confirmed copy.

What can go wrong is the same for both: a mistyped or out-of-date address. Preview before the first send, then check the recipient list. To stop reports, turn off Send this report or pause the hub report. A report that has been sent cannot be recalled.

Give someone access for a limited time

Contractors and freelancers come and go. Temporary access in BetterShield Ultra adds one WordPress role to an account for a fixed period, from 1 hour to 30 days, then takes that role back and signs the account out. Open BetterShield › Ultra › Temporary access, search under Who, choose a Role and a duration under For how long, then press the button beginning with Grant.

The role grants everything WordPress assigns to it (the WordPress roles and capabilities documentation lists what each one can do), so choose the narrowest one that covers the work. What they did opens the account’s activity since the grant began, and End now removes the role and ends every session on the account. Ultra does not remove the role at expiry if that would leave the site without an administrator, and the card explains that it remains active. Our post on temporary access for a developer goes through the screen, the free alternative and the undo.

Hand a site back

When an engagement ends, the question is what access is still out there. BetterShield › Ultra › Agency handover, also part of BetterShield Ultra, gathers the access an agency’s accounts still hold and lets the client review each item before anything changes. Run it from the client’s own account.

1. Under The agency’s accounts, select up to 20 accounts.
2. Press Preview the handover. Nothing changes yet.
3. Review each step and change its ticks if needed.
4. Press Hand over, read the action count, then press Yes, do it.

The steps cover downloading the settings first, temporary access, assistant connections, application passwords, the accounts themselves and a client report receipt. We recommend downloading the settings and the activity record before you confirm, and suspending agency accounts rather than deleting them, so their content stays attributed.

Know the undo before you press the button. A suspended account can be restored with Let back in from the receipt, and its role and content remain. A revoked application password or assistant connection cannot be restored: whoever used it creates a new password or connects again. If the preview changes before you confirm, Ultra stops and asks you to preview again.

Keep sites on the same footing

Use a Hub baseline to compare connected sites against a shared standard and review plans for supported changes. On a site you have finished, Export settings under Settings › General writes a file. On the next site, Import a settings file shows a plan first, and each setting it changes can be put back. Two-factor enrollments, sessions, the recovery link and alert recipients stay behind, and the file describes your block lists and sign-in address, so keep it private. The move settings between sites doc has the steps.

From a script, wp bettershield audit --fail-under=80 --fail-on=high exits non-zero when a site’s score is under 80 or a high or critical finding is open, so a maintenance run can flag the site that slipped. The WP-CLI commands doc lists the rest. If your sites share a multisite network, WordPress multisite security shows the network table and the rules you set once.

What it can break, and how to undo

• A read-and-fix connection can change the site, within the permission you approved. Choose read-only if the hub should never make changes. Hub’s browser interface shows a plan before applying or undoing a finding fix. Connected assistants follow the site’s tool rules: small reversible fixes may run directly, while sensitive changes require an approval plan.
• Ending the connection: press Disconnect on BetterShield › Hub, then Yes, do it, or use Revoke under Agents › Connect. Removing a site inside the hub does not end the connection on WordPress.
• Disconnecting does not switch off the assistant switches the connection turned on. Review Agents › Connect if nothing else uses them.
• Client reports can reach a wrong address. Preview, check the list, and turn the schedule off to stop.
• Handover revokes application passwords and assistant connections for good. Read the preview.

Every change the hub makes appears in the site’s activity log, so there is always a record on the site itself.

Check it is working

• On the site, the BetterShield › Hub card shows the connected state and when the hub last read it.
• In the hub, the site appears under Sites with a score, findings and a recent Last read.
• A fix applied from the hub shows under Changes made from hub and in the site’s activity log.
• After a client report, the Ultra card shows when it was sent, and the log records Alert sent without the addresses.

Recommended settings

We recommend starting small. Connect two or three sites read-only, learn the Sites screen, and tag them by client. Add read-and-fix only on the sites you look after day to day. Send a client report to yourself first. Use temporary access instead of a shared login whenever someone needs a role for a short job, and keep the handover for the end of an engagement, after you have downloaded the settings.

Frequently asked questions

Conclusion

Managing many sites comes down to three habits: one list you actually open, reports that reach the people who pay, and a clean way out when the work ends. The Hub workspace and settings tools are free. Ultra adds site-specific controls, reporting, temporary access and handover. BetterShield is free on WordPress.org, and the full steps for the first connection are in Connect a site to BetterShield Hub. The Client report and Handover docs cover the Ultra steps, and the BetterShield Hub page shows the dashboard.