Switch from Kadence Security to BetterShield: what carries over

Q: Can I undo the import?

Yes, one change at a time. Switch a carried fix off on Protection › Hardening, or press Put it back on the Login protection row under Put a settings change back.

To switch from Kadence Security to BetterShield, install BetterShield beside it, preview the import, apply the changes it can match, check the result, then deactivate Kadence Security. BetterShield reads the settings the old plugin left on the site and turns the ones it can match into its own. Kadence Security is only read, never changed or switched off.

This post is for someone who has already decided to move. If you are still weighing it, how to switch WordPress security plugins without lockouts covers the general order, and the comparison sets BetterShield beside eight other plugins. The same move from another plugin has its own guides, such as switching from All-In-One Security and switching from Wordfence. Here we stay with one move and say exactly what carries over, what does not and why.

Quick summary

The import carries what is switched on in Kadence Security: its brute force numbers, the addresses it never locks out and four matching hardening settings.
A preview comes first and changes nothing. Under Not carried over from, it lists each setting that cannot move, with the reason.
Two-factor enrollments from Kadence Security do not move in this import, so each person sets it up again.
BetterShield does not run a firewall and does not scan for malware, so those jobs do not move.
No single step reverses the whole import, but each change has its own undo, and Kadence Security itself is never changed.

Why the order matters

For a while, two security plugins are active on the same site. If both count failed sign-ins, a person can be paused by either one, and a lockout can feel like a mystery. The order below keeps one plugin in charge of each job at every moment.

Before you start, make sure you can get back in without the dashboard. Locked out of WordPress? shows what the recovery route looks like, and Set up recovery covers the steps. We recommend checking your way back in before you change anything else.

What carries over

Only what is switched on in Kadence Security is carried. The first two rows land on Protection › Login & Access, the rest on Protection › Hardening.

In Kadence Security	In BetterShield
Brute force protection, with its maximum attempts per host, check period and lockout period	Sign-in attempt limits, with Failures allowed, Counted within (minutes) and Pause lasts (minutes)
Addresses its brute force protection never locks out	Always allowed, each noted “Brought over from another security plugin”
The file editor turned off	File editor lock
Directory browsing turned off	Folder listing protection
PHP in uploads turned off	Uploads code block
XML-RPC turned off in full	Remote publishing block (XML-RPC)

Two details are worth knowing before you press anything:

The numbers are read unless brute force protection was switched off there. They must fit BetterShield’s range: 3 to 100 attempts, and 1 to 1440 minutes for each time.
The import only turns protections on, never off.

If a row is unfamiliar, the docs explain each one: Hardening describes the protections, and Login & Access the sign-in limit. For background, XML-RPC is the remote-call interface that Remote publishing block (XML-RPC) switches off, and WordPress’s own hardening guide explains why the file editor is worth turning off.

What does not carry over, and why

The preview lists each setting that is switched on in Kadence Security but cannot move, under Not carried over from, with the reason:

Turning off only XML-RPC pingbacks. Not carried in this version. Choose Pingbacks only on Remote publishing block (XML-RPC) under Protection › Hardening, which does the same.
Restricting the REST API for signed-out visitors. There is no one-to-one fix. Username privacy covers the list of users; the rest of the REST API stays open.
Blocking access to system files. Not carried in this version. Review Private file protection instead.
A changed sign-in address. Not carried in this version. Set it with Custom sign-in address on Protection › Login & Access, where BetterShield first checks for a working way back in, checked within the last day.
Some allowed addresses. Only single addresses and CIDR ranges are carried. The rest are named for you to add by hand.
Sign-in attempt limits. They are held back while Kadence Security is active and its brute force protection is on, so two plugins never count the same attempts. They are also listed when the numbers fall outside BetterShield’s range.

Anything else is neither read nor listed. This settings import does not carry Kadence Security two-factor enrollments, so each person sets up two-factor again under Protection › Two-Factor.

BetterShield also does not run a firewall and does not scan for or remove malware. If you rely on your current plugin for either, decide which tool covers it before you deactivate anything.

While Kadence Security is still active

Quick Setup’s Another security plugin is active step has a row for each shared job, and each one starts on Kadence Security:

Sign-in attempt limits, only while its brute force protection is on: Keep Kadence Security, which turns BetterShield’s own limit off, or Use BetterShield.
Two-factor: Keep Kadence Security, so anyone enrolled there signs in as now, or Use BetterShield.
Activity log and File change monitoring: Keep both or Use BetterShield only.
Sign-in address, only while its hidden backend is on: a statement that Kadence Security handles it, and BetterShield’s own option for moving it stays off.
Firewall and site scanner: a statement that BetterShield does not run a firewall or a malware scan.

On Protection › Login & Access, Custom sign-in address also warns while Kadence Security’s hidden backend is on, because both can move or hide the sign-in page. The Overview’s Who does which job card shows the split. Not every overlap is caught, so avoid running sign-in limits or two-factor in both. Run BetterShield alongside another security plugin explains each row.

Set it up: switch over step by step

Install and activate BetterShield, leaving Kadence Security active. The first audit changes nothing.
In Quick Setup, choose who keeps each job and press Save choices. Already finished? Run Quick Setup again is on Settings › General.
Go to BetterShield › Settings › General. Under This installation, Move settings between sites lists Kadence Security under the name your Plugins screen shows, as (active) or (not active). A deleted plugin whose settings remain shows as A security plugin that is no longer installed.
Press Preview import. Nothing changes yet. Each fix shows will be applied, already matches, cannot work on this server or was refused, with any warning beside it. Login protection shows will change when your sign-in settings would change.
Read the Not carried over from list, then press Make these 4 changes. The button counts the changes for you, so your number may differ.
Check the result, as in the next section, then deactivate Kadence Security on the Plugins screen.
If the attempt limits were held back, press Preview import again. With the old plugin inactive, they carry over.

Check it is working

Each carried fix shows On since, and Sign-in attempt limits shows your numbers.
An audit runs straight after the import. Once the old plugin is deactivated, the finding Nothing is limiting sign-in attempts means BetterShield’s limit is off. Preview the import again, or switch the limit on.
Anyone who used two-factor in the old plugin sets it up again. Two-factor and passkeys shows where, and WordPress two-factor authentication and passkeys is the longer guide.

What it can break, and how to undo

The import only turns protections on, so the risk is a protection you did not expect to be active. Read the preview, and apply it when you are ready to live with every row.

No single step reverses the whole import. Each change has its own undo:

A fix it turned on. Switch it off on Protection › Hardening. Files the fix wrote are put back as they were.
Sign-in numbers. Under Put a settings change back on Settings › General, press Put it back on the Login protection row. It restores only what the import changed there, and asks you to put any newer change to those settings back first.

Kadence Security itself was never changed, so reactivating it is always possible.

Recommended settings

While both plugins are active, we recommend keeping the old plugin’s sign-in limits and two-factor, saving that choice, and moving one job at a time. Never run two login limiters or two two-factor systems for the same people: a person can be locked out twice, or asked for two codes. Leave Custom sign-in address off while Kadence Security’s hidden backend is on. Once it is deactivated, preview the import again so any held-back limit carries over, then confirm that Sign-in attempt limits shows numbers you are happy with. The step-by-step reference is Switch from Kadence Security to BetterShield.

Frequently asked questions

Does BetterShield replace a firewall or malware scan?

No. BetterShield does not run a firewall and does not scan for malware, and the import carries neither. If you rely on one, decide which tool provides it before you deactivate your current plugin.

Do my existing two-factor enrollments still work?

Enrollments from Kadence Security do not move in this import, so each person sets up two-factor again. Until you choose Use BetterShield in Quick Setup, anyone enrolled in Kadence Security keeps signing in as now.

Will the import change or switch off Kadence Security?

No. BetterShield only reads the settings it left on the site. You deactivate Kadence Security yourself on the Plugins screen, after you have checked the result.

What happens to my changed sign-in address?

A changed sign-in address is not carried in this version. While Kadence Security’s hidden backend is on, BetterShield’s own option for moving the sign-in page stays off. Set the address afterwards with Custom sign-in address on Protection › Login & Access.

Can I undo the import?

Yes, one change at a time. Switch a carried fix off on Protection › Hardening, or press Put it back on the Login protection row under Put a settings change back.

Conclusion

Switching from Kadence Security comes down to a short order: keep a way back in, preview the import, read what was not carried over, apply the changes, check the result and only then deactivate the old plugin. The import carries what matches and says plainly what does not, and every change can be taken back.

BetterShield is free on WordPress.org. The step-by-step reference is Switch from Kadence Security to BetterShield.