# Switch from Wordfence to BetterShield: what carries over

Moving from Wordfence to BetterShield? See what the import carries over, what it leaves behind and why, and the order that avoids a lockout.

By M Asif Rahman, Oct 16, 2026. Updated Nov 8, 2026.

To switch from Wordfence to **BetterShield**, install BetterShield beside Wordfence, preview the import, apply the changes it can match, check the result, then deactivate Wordfence. BetterShield reads the settings Wordfence left on the site and turns the ones it can match into its own. Wordfence is only read, never changed or switched off.

This post is for someone who has already decided to move. If you are still weighing it, [how to switch WordPress security plugins without lockouts](/blog/switch-wordpress-security-plugins/) covers the general order, and the [comparison](/compare/) sets BetterShield beside eight other plugins. Here we stay with one move and say exactly what carries over, what does not and why. Moving from Really Simple Security instead? [That switch has its own post](/blog/switch-from-really-simple-security-to-bettershield/), or from a plugin that only limits sign-in attempts? [Limit Login Attempts Reloaded has one too](/blog/switch-from-limit-login-attempts-reloaded-to-bettershield/).

## Quick summary

- The import carries what is switched on in Wordfence: its sign-in limits, its allowed addresses and four matching protections.
- A preview comes first and changes nothing. It also lists, under **Not carried over from**, each Wordfence setting that cannot move and the reason.
- BetterShield does not run a firewall, does not block by country and does not scan for malware, so those jobs do not move.
- Supported authenticator apps can move when you hand two-factor to BetterShield in Quick Setup and deactivate Wordfence. Backup codes need a new set.
- No single step reverses the whole import, but each change has its own undo, and Wordfence itself is never changed.

## Why the order matters

For a while, two security plugins are active on the same site. If both count failed sign-ins, a person can be paused by either one, and a lockout can feel like a mystery. The order below keeps one plugin in charge of each job at every moment, which is the whole point of doing this carefully.

Before you start, make sure you can get back in without the dashboard. BetterShield emails a single-use recovery link to the site’s administration address when you activate it, and [Locked out of WordPress?](/blog/locked-out-of-wordpress/) shows what using it looks like. We recommend checking that the email arrived before you change anything else.

## What carries over

Only what is switched on in Wordfence is carried. The first three rows land on **Protection › Login & Access**, the rest on **Protection › Hardening**.

| In Wordfence | In BetterShield |
|---|---|
| Login security on, with its failures allowed, minutes counted and lockout minutes | **Sign-in attempt limits**, with **Failures allowed**, **Counted within (minutes)** and **Pause lasts (minutes)** |
| Allowlisted IP addresses | **Always allowed**, each noted “Brought over from another security plugin” |
| The breached-password check | **Leaked password check** |
| Stopping author scans | **Username privacy** |
| Hiding the WordPress version | **WordPress version privacy** |
| Turning off code execution in uploads | **Uploads code block** |

Three details are worth knowing before you press anything:

- The numbers must fit BetterShield’s range: 3 to 100 failures, and 1 to 1440 minutes for each time.
- Addresses join **Always allowed**. Nothing there is removed, and nothing is added twice.
- The import only turns protections on, never off.

## What does not carry over, and why

The preview lists each of these that is on in Wordfence, with the reason. Here they are in one place, so nothing surprises you afterward.

- **The firewall and its rules.** BetterShield does not run a firewall of its own.
- **Rate limiting.** There is no equivalent. Sign-in attempts are limited on **Login & Access**, and the public forms under **Request protection**.
- **Country blocking.** BetterShield does not block by country.
- **Blocked usernames.** Here a wrong username already counts toward the attempt limit, and a blocked name would stop any account later given it from signing in.
- **Locking out a username that does not exist at once.** A wrong username counts toward the limit like any other failure.
- **Two-factor authentication.** Supported authenticator apps can move on deactivation after choosing BetterShield for two-factor in Quick Setup. Backup codes do not move; the preview names anyone who must enroll again.
- **Some allowed addresses.** Only single addresses and [CIDR ranges](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) are carried. The rest are named for you to add by hand.
- **Sign-in attempt limits, sometimes.** They are held back while Wordfence is active and still limits sign-ins, so two plugins never count the same attempts, or when the numbers fall outside BetterShield’s range.

BetterShield also does not scan for or remove malware. If you rely on Wordfence for that, decide which tool covers it before you deactivate anything. Anything else in Wordfence is neither read nor listed.

## While Wordfence is still active

Quick Setup’s **Another security plugin is active** step has a row for each shared job, and each one starts on Wordfence:

- **Sign-in attempt limits**, shown only while Wordfence’s login security is on: **Keep** Wordfence, which turns BetterShield’s own limit off, or **Use BetterShield**.
- **Two-factor**: **Keep** Wordfence, so anyone enrolled there signs in as now, or **Use BetterShield**.
- **File change monitoring**: **Keep both** or **Use BetterShield only**.
- **Firewall and site scanner**: a statement that BetterShield does not run a firewall or a malware scan.

The Overview’s **Who does which job** card shows the split. Not every overlap is caught, so avoid running sign-in limits or two-factor in both. [Run BetterShield alongside another security plugin](/docs/alongside-another-security-plugin/) explains each row.

## Set it up: switch over step by step

1. Install and activate BetterShield, leaving Wordfence active. The first audit changes nothing.
2. In Quick Setup, choose who keeps each job and press **Save choices**. Already finished? **Run Quick Setup again** is on **Settings › General**.
3. Go to **BetterShield › Settings › General**. Under **This installation**, **Move settings between sites** lists Wordfence as **(active)** or **(not active)**. A deleted plugin whose settings remain shows as **A security plugin that is no longer installed**.
4. Press **Preview import**. Nothing changes yet. Each fix shows **will be applied**, **already matches**, **cannot work on this server** or **was refused**, with any warning beside it. **Login protection** shows **will change** when your sign-in settings would change.
5. Read the **Not carried over from** list, then press **Make these 4 changes**. The button counts the changes for you.
6. Check the result, as in the next section, then deactivate Wordfence on the **Plugins** screen.
7. If the attempt limits were held back, press **Preview import** again. With Wordfence inactive, they carry over.

## Check it is working

- Each carried fix shows **On since**, **Sign-in attempt limits** shows your numbers, and **Always allowed** lists the addresses.
- An audit runs straight after the import. With Wordfence deactivated, the finding **Nothing is limiting sign-in attempts** means BetterShield’s limit is off. Preview the import again, or switch the limit on.
- Anyone who used two-factor in Wordfence sets it up again on their own **Profile**, or on **Protection › Two-Factor** for people who manage BetterShield. [Two-factor and passkeys](/docs/two-factor-and-passkeys/) shows both, and [WordPress two-factor authentication and passkeys](/blog/wordpress-two-factor-authentication/) is the longer setup guide.

## What it can break, and how to undo

The import only turns protections on, so the risk is a protection you did not expect to be active. Read the preview, and apply it when you are ready to live with every row.

No single step reverses the whole import. Each change has its own undo:

- **A fix it turned on.** Switch it off on **Protection › Hardening**, or on **Protection › Login & Access** for **Leaked password check**. Files the fix wrote are put back as they were.
- **Sign-in numbers and allowed addresses.** Under **Put a settings change back** on **Settings › General**, press **Put it back** on the **Login protection** row. It restores only what the import changed there, and asks you to put any newer change to those settings back first.

Wordfence itself was never changed, so reactivating it is always possible.

## Recommended settings

While both plugins are active, we recommend keeping Wordfence’s sign-in limits and two-factor, saving that choice, and moving one job at a time. Never run two login limiters or two two-factor systems for the same people. Once Wordfence is deactivated, preview the import again so the held-back limits carry over, then confirm that **Sign-in attempt limits** shows numbers you are happy with. [Login & Access](/docs/login-and-access/) and [Hardening](/docs/hardening/) describe every setting the import touches.

## Frequently asked questions

### Does BetterShield replace Wordfence’s firewall?

No. BetterShield does not run a firewall of its own, and the import does not carry Wordfence’s firewall rules. If you rely on one, decide which tool provides it before you deactivate Wordfence.

### Do my Wordfence two-factor codes still work in BetterShield?

Supported authenticator apps can move when Wordfence is deactivated after you choose BetterShield for two-factor in Quick Setup. Read the preview and issue new backup codes afterward. [Move existing two-factor accounts](/docs/migrate-two-factor/) covers the steps and undo. Until you choose **Use BetterShield** in Quick Setup, anyone enrolled in Wordfence keeps signing in as now.

### Will the import change or switch off Wordfence?

No. BetterShield only reads the settings Wordfence left on the site. You deactivate Wordfence yourself on the **Plugins** screen, after you have checked the result.

### Can I undo the import?

Yes, one change at a time. Switch a carried fix off on **Protection › Hardening**, or press **Put it back** on the **Login protection** row under **Put a settings change back**.

### What if Wordfence still limits sign-ins when I preview?

The sign-in attempt limits are held back, so two plugins never count the same attempts. Deactivate Wordfence, then press **Preview import** again and they carry over.

## Conclusion

Switching from Wordfence comes down to a short order: keep a way back in, preview the import, read what was not carried over, apply the changes, check the result and only then deactivate Wordfence. The import carries what matches and says plainly what does not, and every change can be taken back.

BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). The step-by-step reference is [Switch from Wordfence to BetterShield](/docs/switch-from-wordfence/).