Switch from Really Simple Security to BetterShield: what carries over
To switch from Really Simple Security to BetterShield, install BetterShield beside it, preview the import, apply the changes it can match, check the result, then deactivate Really Simple Security. BetterShield reads the settings the old plugin left on the site and turns the ones it can match into its own. Really Simple Security is only read, never changed or switched off.
This post is for someone who has already decided to move. If you are still weighing it, how to switch WordPress security plugins without lockouts covers the general order, and the comparison sets BetterShield beside eight other plugins. For the same move from another plugin, see switching from Wordfence or switching from All-In-One Security. Here we stay with one move and say exactly what carries over, what does not and why.
Quick summary
- The import carries what is switched on in Really Simple Security: its login attempt limit and six hardening settings.
- A preview comes first and changes nothing. Under Not carried over from, it lists any setting that cannot move, with the reason.
- Two-factor enrollments from Really Simple Security do not move in this import, so each person sets it up again.
- BetterShield does not run a firewall and does not scan for malware, so those jobs do not move.
- No single step reverses the whole import, but each change has its own undo, and Really Simple Security itself is never changed.
Why the order matters
For a while, two security plugins are active on the same site. If both count failed sign-ins, a person can be paused by either one, and a lockout can feel like a mystery. The order below keeps one plugin in charge of each job at every moment.
Before you start, make sure you can get back in without the dashboard. Locked out of WordPress? shows what the recovery route looks like, and Set up recovery covers the steps. We recommend checking your way back in before you change anything else.
What carries over
Only what is switched on in Really Simple Security is carried. The first row lands on Protection › Login & Access, the rest on Protection › Hardening.
| In Really Simple Security | In BetterShield |
|---|---|
| Limited login attempts on, with the number of attempts, the period they are counted over and the lockout duration | Sign-in attempt limits, with Failures allowed, Counted within (minutes) and Pause lasts (minutes) |
| Disabling file editing | File editor lock |
| Disabling XML-RPC | Remote publishing block (XML-RPC) |
| Disabling user enumeration | Username privacy |
| Disabling directory indexing | Folder listing protection |
| Hiding the WordPress version | WordPress version privacy |
| Blocking code execution in uploads | Uploads code block |
Two details are worth knowing before you press anything:
- The numbers are read as minutes and must fit BetterShield’s range: 3 to 100 attempts, and 1 to 1440 minutes for each time.
- The import only turns protections on, never off.
If a row is unfamiliar, the docs explain each one: Hardening describes the six protections, and Login & Access the sign-in limit. For background on one of them, XML-RPC is the remote-call interface that Remote publishing block (XML-RPC) switches off.
What does not carry over, and why
One setting can be held back, and the preview lists it under Not carried over from, with the reason:
- Sign-in attempt limits. They are held back while Really Simple Security is active and still limits login attempts, so two plugins never count the same attempts. They are also listed when the numbers fall outside BetterShield’s range, with the numbers it found.
Anything else is neither read nor listed. This settings import does not carry Really Simple Security two-factor enrollments, so anyone who used two-factor in the old plugin sets it up again on their own Profile, or on Protection › Two-Factor for people who manage BetterShield.
BetterShield also does not run a firewall and does not scan for or remove malware. If you rely on your current plugin for either, decide which tool covers it before you deactivate anything.
While Really Simple Security is still active
Quick Setup’s Another security plugin is active step has a row for each shared job, and each one starts on Really Simple Security. Which rows appear depends on the edition that is active:
- Two-factor, always: Keep Really Simple Security, so anyone enrolled there signs in as now, or Use BetterShield.
- Sign-in attempt limits, only while its own login attempt limit is on: Keep Really Simple Security, which turns BetterShield’s own limit off, or Use BetterShield.
- Firewall and site scanner: a statement that BetterShield does not run a firewall or a malware scan.
The Overview’s Who does which job card shows the split. Not every overlap is caught, so avoid running sign-in attempt limits or two-factor in both. Run BetterShield alongside another security plugin explains each row.
Set it up: switch over step by step
- Install and activate BetterShield, leaving Really Simple Security active. The first audit changes nothing.
- In Quick Setup, choose who keeps each job and press Save choices. Already finished? Run Quick Setup again is on Settings › General.
- Go to BetterShield › Settings › General. Under This installation, Move settings between sites lists the plugin under the name your Plugins screen shows, as (active) or (not active). A deleted plugin whose settings remain shows as A security plugin that is no longer installed.
- Press Preview import. Nothing changes yet. Each fix shows will be applied, already matches, cannot work on this server or was refused, with any warning beside it. Login protection shows will change when your sign-in settings would change.
- Read the Not carried over from list, if there is one, then press Make these 4 changes. The button counts the changes for you.
- Check the result, as in the next section, then deactivate Really Simple Security on the Plugins screen.
- If the attempt limits were held back, press Preview import again. With the old plugin inactive, they carry over.
If the button reads Nothing here can be carried over, nothing in the table is switched on there that BetterShield can carry now.
Check it is working
- Each carried fix shows On since, and Sign-in attempt limits shows your numbers.
- An audit runs straight after the import. Once the old plugin is deactivated, the finding Nothing is limiting sign-in attempts means BetterShield’s limit is off. Preview the import again, or switch the limit on.
- A fix the preview marked cannot work on this server was not applied. Protection › Hardening shows it as Not available here, with the reason.
- Anyone who used two-factor sets it up again. Two-factor and passkeys shows both places, and WordPress two-factor authentication and passkeys is the longer guide.
What it can break, and how to undo
The import only turns protections on, so the risk is a protection you did not expect to be active. Read the preview, and apply it when you are ready to live with every row.
No single step reverses the whole import. Each change has its own undo:
- A fix it turned on. Switch it off on Protection › Hardening. Files the fix wrote are put back as they were.
- Sign-in numbers. Under Put a settings change back on Settings › General, press Put it back on the Login protection row. It restores only what the import changed there, and asks you to put any newer change to those settings back first.
Really Simple Security itself was never changed, so reactivating it is always possible.
Recommended settings
While both plugins are active, we recommend keeping the old plugin’s sign-in limits and two-factor, saving that choice, and moving one job at a time. Never run two login limiters or two two-factor systems for the same people. Once Really Simple Security is deactivated, preview the import again so any held-back limit carries over, then confirm that Sign-in attempt limits shows numbers you are happy with. The step-by-step reference is Switch from Really Simple Security to BetterShield.
Frequently asked questions
Does BetterShield replace a firewall or malware scan?
No. BetterShield does not run a firewall and does not scan for malware, and the import carries neither. If you rely on one, decide which tool provides it before you deactivate your current plugin.
Do my existing two-factor enrollments still work?
Enrollments from Really Simple Security do not move in this import, so each person sets up two-factor again. Until you choose Use BetterShield in Quick Setup, anyone enrolled in Really Simple Security keeps signing in as now.
Will the import change or switch off Really Simple Security?
No. BetterShield only reads the settings it left on the site. You deactivate Really Simple Security yourself on the Plugins screen, after you have checked the result.
Can I undo the import?
Yes, one change at a time. Switch a carried fix off on Protection › Hardening, or press Put it back on the Login protection row under Put a settings change back.
What if the old plugin still limits sign-ins when I preview?
The sign-in attempt limits are held back, so two plugins never count the same attempts. Deactivate Really Simple Security, then press Preview import again and they carry over.
Conclusion
Switching from Really Simple Security comes down to a short order: keep a way back in, preview the import, read what was not carried over, apply the changes, check the result and only then deactivate the old plugin. The import carries what matches and says plainly what does not, and every change can be taken back.
BetterShield is free on WordPress.org. The step-by-step reference is Switch from Really Simple Security to BetterShield.