Switch from All-In-One Security to BetterShield: what carries over

Q: Can I undo the import?

Yes, one change at a time. Switch a carried fix off on Protection › Hardening, or press Put it back on the Login protection row under Put a settings change back.

To switch from All-In-One Security to BetterShield, install BetterShield beside it, preview the import, apply the changes it can match, check the result, then deactivate All-In-One Security. BetterShield reads the settings the old plugin left on the site and turns the ones it can match into its own. All-In-One Security is only read, never changed or switched off.

This post is for someone who has already decided to move. If you are still weighing it, how to switch WordPress security plugins without lockouts covers the general order, and the comparison sets BetterShield beside eight other plugins. The same move from another plugin has its own guides, such as switching from Really Simple Security, switching from Kadence Security and switching from Wordfence. Here we stay with one move and say exactly what carries over, what does not and why.

Quick summary

The import carries what is switched on in All-In-One Security: its login lockdown numbers, its allowed IP addresses and five matching hardening settings.
A preview comes first and changes nothing. Under Not carried over from, it lists each setting that cannot move, with the reason.
Two-factor enrollments from All-In-One Security do not move in this import, so each person sets it up again.
BetterShield does not run a firewall and does not scan for malware, so those jobs do not move.
No single step reverses the whole import, but each change has its own undo, and All-In-One Security itself is never changed.

Why the order matters

For a while, two security plugins are active on the same site. If both count failed sign-ins, a person can be paused by either one, and a lockout can feel like a mystery. The order below keeps one plugin in charge of each job at every moment.

Before you start, make sure you can get back in without the dashboard. Locked out of WordPress? shows what the recovery route looks like, and Set up recovery covers the steps. We recommend checking your way back in before you change anything else.

What carries over

Only what is switched on in All-In-One Security is carried. The first two rows land on Protection › Login & Access, the rest on Protection › Hardening.

In All-In-One Security	In BetterShield
Login lockdown on, with its maximum login attempts, retry time period and lockout time length	Sign-in attempt limits, with Failures allowed, Counted within (minutes) and Pause lasts (minutes)
Its login lockdown’s allowed IP addresses, while that list is switched on	Always allowed, each noted “Brought over from another security plugin”
Disabling file editing	File editor lock
Preventing user enumeration	Username privacy
Removing the WordPress generator meta information	WordPress version privacy
Disabling index views	Folder listing protection
Its pingback firewall for XML-RPC	Remote publishing block (XML-RPC)

Two details are worth knowing before you press anything:

The numbers must fit BetterShield’s range: 3 to 100 attempts, and 1 to 1440 minutes for each time.
The import only turns protections on, never off.

If a row is unfamiliar, the docs explain each one: Hardening describes the protections, and Login & Access the sign-in limit. For background on one of them, XML-RPC is the remote-call interface that Remote publishing block (XML-RPC) switches off.

What does not carry over, and why

The preview lists each setting that is switched on in All-In-One Security but cannot move, under Not carried over from, with the reason:

Turning off only XML-RPC pingbacks. Not carried in this version. Choose Pingbacks only on Remote publishing block (XML-RPC) under Protection › Hardening, which does the same.
A changed sign-in address. Not carried in this version. Set it with Custom sign-in address on Protection › Login & Access, where BetterShield first checks for a working way back in, checked within the last day.
Some allowed addresses. Only single addresses and CIDR ranges are carried. The rest are named for you to add by hand.
Sign-in attempt limits. They are held back while All-In-One Security is active and its login lockdown is on, so two plugins never count the same attempts. They are also listed when the numbers fall outside BetterShield’s range.

Anything else is neither read nor listed. This settings import does not carry All-In-One Security two-factor enrollments, so anyone who used two-factor in the old plugin sets it up again on their own Profile, or on Protection › Two-Factor for people who manage BetterShield.

BetterShield also does not run a firewall and does not scan for or remove malware. If you rely on your current plugin for either, decide which tool covers it before you deactivate anything.

While All-In-One Security is still active

Quick Setup’s Another security plugin is active step has a row for each shared job, and each one starts on All-In-One Security:

Sign-in attempt limits, only while its login lockdown is on: Keep All-In-One Security, which turns BetterShield’s own limit off, or Use BetterShield.
Two-factor: Keep All-In-One Security, so anyone enrolled there signs in as now, or Use BetterShield.
Activity log: Keep both or Use BetterShield only.
File change monitoring, only while its scheduled file change scan is on: Keep both or Use BetterShield only.
Sign-in address, only while its renamed login page is on: a statement that All-In-One Security handles it, and BetterShield’s own option for moving it stays off.
Firewall and site scanner: a statement that BetterShield does not run a firewall or a malware scan.

On Protection › Login & Access, Custom sign-in address also warns while All-In-One Security’s renamed login page is on, because both can move or hide the sign-in page. The Overview’s Who does which job card shows the split. Not every overlap is caught, so avoid running sign-in limits or two-factor in both. Run BetterShield alongside another security plugin explains each row.

Set it up: switch over step by step

Install and activate BetterShield, leaving All-In-One Security active. The first audit changes nothing.
In Quick Setup, choose who keeps each job and press Save choices. Already finished? Run Quick Setup again is on Settings › General.
Go to BetterShield › Settings › General. Under This installation, Move settings between sites lists All-In-One Security as (active) or (not active). A deleted plugin whose settings remain shows as A security plugin that is no longer installed.
Press Preview import. Nothing changes yet. Each fix shows will be applied, already matches, cannot work on this server or was refused, with any warning beside it. Login protection shows will change when your sign-in settings would change.
Read the Not carried over from list, then press Make these 4 changes. The button counts the changes for you, so your number may differ.
Check the result, as in the next section, then deactivate All-In-One Security on the Plugins screen.
If the attempt limits were held back, press Preview import again. With the old plugin inactive, they carry over.

Check it is working

Each carried fix shows On since, and Sign-in attempt limits shows your numbers.
An audit runs straight after the import. Once the old plugin is deactivated, the finding Nothing is limiting sign-in attempts means BetterShield’s limit is off. Preview the import again, or switch the limit on.
Anyone who used two-factor in the old plugin sets it up again. Two-factor and passkeys shows both places, and WordPress two-factor authentication and passkeys is the longer guide.

What it can break, and how to undo

The import only turns protections on, so the risk is a protection you did not expect to be active. Read the preview, and apply it when you are ready to live with every row.

No single step reverses the whole import. Each change has its own undo:

A fix it turned on. Switch it off on Protection › Hardening. Files the fix wrote are put back as they were.
Sign-in numbers. Under Put a settings change back on Settings › General, press Put it back on the Login protection row. It restores only what the import changed there, and asks you to put any newer change to those settings back first.

All-In-One Security itself was never changed, so reactivating it is always possible.

Recommended settings

While both plugins are active, we recommend keeping the old plugin’s sign-in limits and two-factor, saving that choice, and moving one job at a time. Never run two login limiters or two two-factor systems for the same people: a person can be locked out twice, or asked for two codes. Leave Custom sign-in address off while All-In-One Security moves the sign-in page. Once it is deactivated, preview the import again so any held-back limit carries over, then confirm that Sign-in attempt limits shows numbers you are happy with. The step-by-step reference is Switch from All-In-One Security to BetterShield.

Frequently asked questions

Does BetterShield replace a firewall or malware scan?

No. BetterShield does not run a firewall and does not scan for malware, and the import carries neither. If you rely on one, decide which tool provides it before you deactivate your current plugin.

Do my existing two-factor enrollments still work?

Enrollments from All-In-One Security do not move in this import, so each person sets up two-factor again. Until you choose Use BetterShield in Quick Setup, anyone enrolled in All-In-One Security keeps signing in as now.

Will the import change or switch off All-In-One Security?

No. BetterShield only reads the settings it left on the site. You deactivate All-In-One Security yourself on the Plugins screen, after you have checked the result.

What happens to my renamed login page?

A changed sign-in address is not carried in this version. While All-In-One Security’s renamed login page is on, BetterShield’s own option for moving the sign-in page stays off. Set the address afterwards with Custom sign-in address on Protection › Login & Access.

Can I undo the import?

Yes, one change at a time. Switch a carried fix off on Protection › Hardening, or press Put it back on the Login protection row under Put a settings change back.

Conclusion

Switching from All-In-One Security comes down to a short order: keep a way back in, preview the import, read what was not carried over, apply the changes, check the result and only then deactivate the old plugin. The import carries what matches and says plainly what does not, and every change can be taken back.

BetterShield is free on WordPress.org. The step-by-step reference is Switch from All-In-One Security to BetterShield.