# Switch from All-In-One Security to BetterShield: what carries over

Moving from All-In-One Security to BetterShield? See what the import carries over, what it holds back and why, and the order that avoids a lockout.

By M Asif Rahman, Oct 23, 2026. Updated Nov 8, 2026.

To switch from All-In-One Security to **BetterShield**, install BetterShield beside it, preview the import, apply the changes it can match, check the result, then deactivate All-In-One Security. BetterShield reads the settings the old plugin left on the site and turns the ones it can match into its own. All-In-One Security is only read, never changed or switched off.

This post is for someone who has already decided to move. If you are still weighing it, [how to switch WordPress security plugins without lockouts](/blog/switch-wordpress-security-plugins/) covers the general order, and the [comparison](/compare/) sets BetterShield beside eight other plugins. The same move from another plugin has its own guides, such as [switching from Really Simple Security](/blog/switch-from-really-simple-security-to-bettershield/), [switching from Kadence Security](/blog/switch-from-kadence-security-to-bettershield/) and [switching from Wordfence](/blog/switch-from-wordfence-to-bettershield/). Here we stay with one move and say exactly what carries over, what does not and why.

## Quick summary

- The import carries what is switched on in All-In-One Security: its login lockdown numbers, its allowed IP addresses and five matching hardening settings.
- A preview comes first and changes nothing. Under **Not carried over from**, it lists each setting that cannot move, with the reason.
- Two-factor enrollments from All-In-One Security do not move in this import, so each person sets it up again.
- BetterShield does not run a firewall and does not scan for malware, so those jobs do not move.
- No single step reverses the whole import, but each change has its own undo, and All-In-One Security itself is never changed.

## Why the order matters

For a while, two security plugins are active on the same site. If both count failed sign-ins, a person can be paused by either one, and a lockout can feel like a mystery. The order below keeps one plugin in charge of each job at every moment.

Before you start, make sure you can get back in without the dashboard. [Locked out of WordPress?](/blog/locked-out-of-wordpress/) shows what the recovery route looks like, and [Set up recovery](/docs/set-up-recovery/) covers the steps. We recommend checking your way back in before you change anything else.

## What carries over

Only what is switched on in All-In-One Security is carried. The first two rows land on **Protection › Login & Access**, the rest on **Protection › Hardening**.

| In All-In-One Security | In BetterShield |
|---|---|
| Login lockdown on, with its maximum login attempts, retry time period and lockout time length | **Sign-in attempt limits**, with **Failures allowed**, **Counted within (minutes)** and **Pause lasts (minutes)** |
| Its login lockdown’s allowed IP addresses, while that list is switched on | **Always allowed**, each noted "Brought over from another security plugin" |
| Disabling file editing | **File editor lock** |
| Preventing user enumeration | **Username privacy** |
| Removing the WordPress generator meta information | **WordPress version privacy** |
| Disabling index views | **Folder listing protection** |
| Its pingback firewall for XML-RPC | **Remote publishing block (XML-RPC)** |

Two details are worth knowing before you press anything:

- The numbers must fit BetterShield’s range: 3 to 100 attempts, and 1 to 1440 minutes for each time.
- The import only turns protections on, never off.

If a row is unfamiliar, the docs explain each one: [Hardening](/docs/hardening/) describes the protections, and [Login & Access](/docs/login-and-access/) the sign-in limit. For background on one of them, [XML-RPC](https://en.wikipedia.org/wiki/XML-RPC) is the remote-call interface that **Remote publishing block (XML-RPC)** switches off.

## What does not carry over, and why

The preview lists each setting that is switched on in All-In-One Security but cannot move, under **Not carried over from**, with the reason:

- **Turning off only XML-RPC pingbacks.** Not carried in this version. Choose **Pingbacks only** on **Remote publishing block (XML-RPC)** under **Protection › Hardening**, which does the same.
- **A changed sign-in address.** Not carried in this version. Set it with **Custom sign-in address** on **Protection › Login & Access**, where BetterShield first checks for a working way back in, checked within the last day.
- **Some allowed addresses.** Only single addresses and CIDR ranges are carried. The rest are named for you to add by hand.
- **Sign-in attempt limits.** They are held back while All-In-One Security is active and its login lockdown is on, so two plugins never count the same attempts. They are also listed when the numbers fall outside BetterShield’s range.

Anything else is neither read nor listed. This settings import does not carry All-In-One Security two-factor enrollments, so anyone who used two-factor in the old plugin sets it up again on their own **Profile**, or on **Protection › Two-Factor** for people who manage BetterShield.

BetterShield also does not run a firewall and does not scan for or remove malware. If you rely on your current plugin for either, decide which tool covers it before you deactivate anything.

## While All-In-One Security is still active

Quick Setup’s **Another security plugin is active** step has a row for each shared job, and each one starts on All-In-One Security:

- **Sign-in attempt limits**, only while its login lockdown is on: **Keep** All-In-One Security, which turns BetterShield’s own limit off, or **Use BetterShield**.
- **Two-factor**: **Keep** All-In-One Security, so anyone enrolled there signs in as now, or **Use BetterShield**.
- **Activity log**: **Keep both** or **Use BetterShield only**.
- **File change monitoring**, only while its scheduled file change scan is on: **Keep both** or **Use BetterShield only**.
- **Sign-in address**, only while its renamed login page is on: a statement that All-In-One Security handles it, and BetterShield’s own option for moving it stays off.
- **Firewall and site scanner**: a statement that BetterShield does not run a firewall or a malware scan.

On **Protection › Login & Access**, **Custom sign-in address** also warns while All-In-One Security’s renamed login page is on, because both can move or hide the sign-in page. The Overview’s **Who does which job** card shows the split. Not every overlap is caught, so avoid running sign-in limits or two-factor in both. [Run BetterShield alongside another security plugin](/docs/alongside-another-security-plugin/) explains each row.

## Set it up: switch over step by step

1. Install and activate BetterShield, leaving All-In-One Security active. The first audit changes nothing.
2. In Quick Setup, choose who keeps each job and press **Save choices**. Already finished? **Run Quick Setup again** is on **Settings › General**.
3. Go to **BetterShield › Settings › General**. Under **This installation**, **Move settings between sites** lists All-In-One Security as **(active)** or **(not active)**. A deleted plugin whose settings remain shows as **A security plugin that is no longer installed**.
4. Press **Preview import**. Nothing changes yet. Each fix shows **will be applied**, **already matches**, **cannot work on this server** or **was refused**, with any warning beside it. **Login protection** shows **will change** when your sign-in settings would change.
5. Read the **Not carried over from** list, then press **Make these 4 changes**. The button counts the changes for you, so your number may differ.
6. Check the result, as in the next section, then deactivate All-In-One Security on the **Plugins** screen.
7. If the attempt limits were held back, press **Preview import** again. With the old plugin inactive, they carry over.

## Check it is working

- Each carried fix shows **On since**, and **Sign-in attempt limits** shows your numbers.
- An audit runs straight after the import. Once the old plugin is deactivated, the finding **Nothing is limiting sign-in attempts** means BetterShield’s limit is off. Preview the import again, or switch the limit on.
- Anyone who used two-factor in the old plugin sets it up again. [Two-factor and passkeys](/docs/two-factor-and-passkeys/) shows both places, and [WordPress two-factor authentication and passkeys](/blog/wordpress-two-factor-authentication/) is the longer guide.

## What it can break, and how to undo

The import only turns protections on, so the risk is a protection you did not expect to be active. Read the preview, and apply it when you are ready to live with every row.

No single step reverses the whole import. Each change has its own undo:

- **A fix it turned on.** Switch it off on **Protection › Hardening**. Files the fix wrote are put back as they were.
- **Sign-in numbers.** Under **Put a settings change back** on **Settings › General**, press **Put it back** on the **Login protection** row. It restores only what the import changed there, and asks you to put any newer change to those settings back first.

All-In-One Security itself was never changed, so reactivating it is always possible.

## Recommended settings

While both plugins are active, we recommend keeping the old plugin’s sign-in limits and two-factor, saving that choice, and moving one job at a time. Never run two login limiters or two two-factor systems for the same people: a person can be locked out twice, or asked for two codes. Leave **Custom sign-in address** off while All-In-One Security moves the sign-in page. Once it is deactivated, preview the import again so any held-back limit carries over, then confirm that **Sign-in attempt limits** shows numbers you are happy with. The step-by-step reference is [Switch from All-In-One Security to BetterShield](/docs/switch-from-all-in-one-security/).

## Frequently asked questions

### Does BetterShield replace a firewall or malware scan?

No. BetterShield does not run a firewall and does not scan for malware, and the import carries neither. If you rely on one, decide which tool provides it before you deactivate your current plugin.

### Do my existing two-factor enrollments still work?

Enrollments from All-In-One Security do not move in this import, so each person sets up two-factor again. Until you choose **Use BetterShield** in Quick Setup, anyone enrolled in All-In-One Security keeps signing in as now.

### Will the import change or switch off All-In-One Security?

No. BetterShield only reads the settings it left on the site. You deactivate All-In-One Security yourself on the **Plugins** screen, after you have checked the result.

### What happens to my renamed login page?

A changed sign-in address is not carried in this version. While All-In-One Security’s renamed login page is on, BetterShield’s own option for moving the sign-in page stays off. Set the address afterwards with **Custom sign-in address** on **Protection › Login & Access**.

### Can I undo the import?

Yes, one change at a time. Switch a carried fix off on **Protection › Hardening**, or press **Put it back** on the **Login protection** row under **Put a settings change back**.

## Conclusion

Switching from All-In-One Security comes down to a short order: keep a way back in, preview the import, read what was not carried over, apply the changes, check the result and only then deactivate the old plugin. The import carries what matches and says plainly what does not, and every change can be taken back.

BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). The step-by-step reference is [Switch from All-In-One Security to BetterShield](/docs/switch-from-all-in-one-security/).