# Switch from Kadence Security to BetterShield: what carries over

Moving from Kadence Security to BetterShield? See what the import carries over, what it holds back and why, and the order that avoids a lockout.

By M Asif Rahman, Oct 25, 2026. Updated Nov 8, 2026.

To switch from Kadence Security to **BetterShield**, install BetterShield beside it, preview the import, apply the changes it can match, check the result, then deactivate Kadence Security. BetterShield reads the settings the old plugin left on the site and turns the ones it can match into its own. Kadence Security is only read, never changed or switched off.

This post is for someone who has already decided to move. If you are still weighing it, [how to switch WordPress security plugins without lockouts](/blog/switch-wordpress-security-plugins/) covers the general order, and the [comparison](/compare/) sets BetterShield beside eight other plugins. The same move from another plugin has its own guides, such as [switching from All-In-One Security](/blog/switch-from-all-in-one-security-to-bettershield/) and [switching from Wordfence](/blog/switch-from-wordfence-to-bettershield/). Here we stay with one move and say exactly what carries over, what does not and why.

## Quick summary

- The import carries what is switched on in Kadence Security: its brute force numbers, the addresses it never locks out and four matching hardening settings.
- A preview comes first and changes nothing. Under **Not carried over from**, it lists each setting that cannot move, with the reason.
- Two-factor enrollments from Kadence Security do not move in this import, so each person sets it up again.
- BetterShield does not run a firewall and does not scan for malware, so those jobs do not move.
- No single step reverses the whole import, but each change has its own undo, and Kadence Security itself is never changed.

## Why the order matters

For a while, two security plugins are active on the same site. If both count failed sign-ins, a person can be paused by either one, and a lockout can feel like a mystery. The order below keeps one plugin in charge of each job at every moment.

Before you start, make sure you can get back in without the dashboard. [Locked out of WordPress?](/blog/locked-out-of-wordpress/) shows what the recovery route looks like, and [Set up recovery](/docs/set-up-recovery/) covers the steps. We recommend checking your way back in before you change anything else.

## What carries over

Only what is switched on in Kadence Security is carried. The first two rows land on **Protection › Login & Access**, the rest on **Protection › Hardening**.

| In Kadence Security | In BetterShield |
|---|---|
| Brute force protection, with its maximum attempts per host, check period and lockout period | **Sign-in attempt limits**, with **Failures allowed**, **Counted within (minutes)** and **Pause lasts (minutes)** |
| Addresses its brute force protection never locks out | **Always allowed**, each noted "Brought over from another security plugin" |
| The file editor turned off | **File editor lock** |
| Directory browsing turned off | **Folder listing protection** |
| PHP in uploads turned off | **Uploads code block** |
| XML-RPC turned off in full | **Remote publishing block (XML-RPC)** |

Two details are worth knowing before you press anything:

- The numbers are read unless brute force protection was switched off there. They must fit BetterShield’s range: 3 to 100 attempts, and 1 to 1440 minutes for each time.
- The import only turns protections on, never off.

If a row is unfamiliar, the docs explain each one: [Hardening](/docs/hardening/) describes the protections, and [Login & Access](/docs/login-and-access/) the sign-in limit. For background, [XML-RPC](https://en.wikipedia.org/wiki/XML-RPC) is the remote-call interface that **Remote publishing block (XML-RPC)** switches off, and WordPress’s own [hardening guide](https://developer.wordpress.org/advanced-administration/security/hardening/) explains why the file editor is worth turning off.

## What does not carry over, and why

The preview lists each setting that is switched on in Kadence Security but cannot move, under **Not carried over from**, with the reason:

- **Turning off only XML-RPC pingbacks.** Not carried in this version. Choose **Pingbacks only** on **Remote publishing block (XML-RPC)** under **Protection › Hardening**, which does the same.
- **Restricting the REST API for signed-out visitors.** There is no one-to-one fix. **Username privacy** covers the list of users; the rest of the REST API stays open.
- **Blocking access to system files.** Not carried in this version. Review **Private file protection** instead.
- **A changed sign-in address.** Not carried in this version. Set it with **Custom sign-in address** on **Protection › Login & Access**, where BetterShield first checks for a working way back in, checked within the last day.
- **Some allowed addresses.** Only single addresses and CIDR ranges are carried. The rest are named for you to add by hand.
- **Sign-in attempt limits.** They are held back while Kadence Security is active and its brute force protection is on, so two plugins never count the same attempts. They are also listed when the numbers fall outside BetterShield’s range.

Anything else is neither read nor listed. This settings import does not carry Kadence Security two-factor enrollments, so each person sets up two-factor again under **Protection › Two-Factor**.

BetterShield also does not run a firewall and does not scan for or remove malware. If you rely on your current plugin for either, decide which tool covers it before you deactivate anything.

## While Kadence Security is still active

Quick Setup’s **Another security plugin is active** step has a row for each shared job, and each one starts on Kadence Security:

- **Sign-in attempt limits**, only while its brute force protection is on: **Keep** Kadence Security, which turns BetterShield’s own limit off, or **Use BetterShield**.
- **Two-factor**: **Keep** Kadence Security, so anyone enrolled there signs in as now, or **Use BetterShield**.
- **Activity log** and **File change monitoring**: **Keep both** or **Use BetterShield only**.
- **Sign-in address**, only while its hidden backend is on: a statement that Kadence Security handles it, and BetterShield’s own option for moving it stays off.
- **Firewall and site scanner**: a statement that BetterShield does not run a firewall or a malware scan.

On **Protection › Login & Access**, **Custom sign-in address** also warns while Kadence Security’s hidden backend is on, because both can move or hide the sign-in page. The Overview’s **Who does which job** card shows the split. Not every overlap is caught, so avoid running sign-in limits or two-factor in both. [Run BetterShield alongside another security plugin](/docs/alongside-another-security-plugin/) explains each row.

## Set it up: switch over step by step

1. Install and activate BetterShield, leaving Kadence Security active. The first audit changes nothing.
2. In Quick Setup, choose who keeps each job and press **Save choices**. Already finished? **Run Quick Setup again** is on **Settings › General**.
3. Go to **BetterShield › Settings › General**. Under **This installation**, **Move settings between sites** lists Kadence Security under the name your **Plugins** screen shows, as **(active)** or **(not active)**. A deleted plugin whose settings remain shows as **A security plugin that is no longer installed**.
4. Press **Preview import**. Nothing changes yet. Each fix shows **will be applied**, **already matches**, **cannot work on this server** or **was refused**, with any warning beside it. **Login protection** shows **will change** when your sign-in settings would change.
5. Read the **Not carried over from** list, then press **Make these 4 changes**. The button counts the changes for you, so your number may differ.
6. Check the result, as in the next section, then deactivate Kadence Security on the **Plugins** screen.
7. If the attempt limits were held back, press **Preview import** again. With the old plugin inactive, they carry over.

## Check it is working

- Each carried fix shows **On since**, and **Sign-in attempt limits** shows your numbers.
- An audit runs straight after the import. Once the old plugin is deactivated, the finding **Nothing is limiting sign-in attempts** means BetterShield’s limit is off. Preview the import again, or switch the limit on.
- Anyone who used two-factor in the old plugin sets it up again. [Two-factor and passkeys](/docs/two-factor-and-passkeys/) shows where, and [WordPress two-factor authentication and passkeys](/blog/wordpress-two-factor-authentication/) is the longer guide.

## What it can break, and how to undo

The import only turns protections on, so the risk is a protection you did not expect to be active. Read the preview, and apply it when you are ready to live with every row.

No single step reverses the whole import. Each change has its own undo:

- **A fix it turned on.** Switch it off on **Protection › Hardening**. Files the fix wrote are put back as they were.
- **Sign-in numbers.** Under **Put a settings change back** on **Settings › General**, press **Put it back** on the **Login protection** row. It restores only what the import changed there, and asks you to put any newer change to those settings back first.

Kadence Security itself was never changed, so reactivating it is always possible.

## Recommended settings

While both plugins are active, we recommend keeping the old plugin’s sign-in limits and two-factor, saving that choice, and moving one job at a time. Never run two login limiters or two two-factor systems for the same people: a person can be locked out twice, or asked for two codes. Leave **Custom sign-in address** off while Kadence Security’s hidden backend is on. Once it is deactivated, preview the import again so any held-back limit carries over, then confirm that **Sign-in attempt limits** shows numbers you are happy with. The step-by-step reference is [Switch from Kadence Security to BetterShield](/docs/switch-from-kadence-security/).

## Frequently asked questions

### Does BetterShield replace a firewall or malware scan?

No. BetterShield does not run a firewall and does not scan for malware, and the import carries neither. If you rely on one, decide which tool provides it before you deactivate your current plugin.

### Do my existing two-factor enrollments still work?

Enrollments from Kadence Security do not move in this import, so each person sets up two-factor again. Until you choose **Use BetterShield** in Quick Setup, anyone enrolled in Kadence Security keeps signing in as now.

### Will the import change or switch off Kadence Security?

No. BetterShield only reads the settings it left on the site. You deactivate Kadence Security yourself on the **Plugins** screen, after you have checked the result.

### What happens to my changed sign-in address?

A changed sign-in address is not carried in this version. While Kadence Security’s hidden backend is on, BetterShield’s own option for moving the sign-in page stays off. Set the address afterwards with **Custom sign-in address** on **Protection › Login & Access**.

### Can I undo the import?

Yes, one change at a time. Switch a carried fix off on **Protection › Hardening**, or press **Put it back** on the **Login protection** row under **Put a settings change back**.

## Conclusion

Switching from Kadence Security comes down to a short order: keep a way back in, preview the import, read what was not carried over, apply the changes, check the result and only then deactivate the old plugin. The import carries what matches and says plainly what does not, and every change can be taken back.

BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). The step-by-step reference is [Switch from Kadence Security to BetterShield](/docs/switch-from-kadence-security/).