How to switch WordPress security plugins without lockouts

Knowing how to switch WordPress security plugins is mostly about the stretch in between. For a while, two plugins are active on the same site, and both may want to count failed sign-ins, ask for a second factor or move the sign-in page. Done in the wrong order, that is how people get shut out of a site they own.

This guide gives a handoff method to adapt to the plugins on your site: a way back in first, one job at a time, and a check after each step. Then it shows how BetterShield handles the overlap, from Quick Setup’s coexistence step to bringing your old settings over with a preview. If you have not yet decided what to move to, six questions to ask before you choose a WordPress security plugin is the place to start.

Quick summary

• Set up a way back in that does not depend on signing in, before you change anything.
• While both plugins are active, sign-in limits and two-factor belong to one plugin at a time. Activity logs and file checks can run in both.
• Move one job at a time and check after each, then deactivate the old plugin.
• Two-factor enrollments do not move between plugins, so people set it up again.
• In BetterShield, Quick Setup’s Another security plugin is active step splits the shared jobs, and Settings › General can bring over settings from Kadence Security, All-In-One Security, Really Simple Security and Wordfence, with a preview first.

Two security plugins on WordPress: what clashes and what does not

Running two security plugins is not a problem in itself. Running two of the same job sometimes is.

The first three rows are where a WordPress security plugin conflict usually shows up: somebody locked out twice, asked for two codes, or sent to a sign-in page that no longer answers.

An explicit handoff

One owner for each sign-in control

The overlap period needs a record of who is doing what.

1. 01
   Before the switch

   Record controls and recovery.

2. 02
   During the switch

   Move one job and verify it.

3. 03
   After the switch

   Check ownership and remaining rules.

Before the switch

What this means

List login limits, two-factor, URL changes, server rules and integration credentials. Save settings and verify host access.

Your next check

Confirm which recovery tool affects which plugin.

During the switch

What this means

Save coexistence choices explicitly. A plugin being active does not tell you whether its individual control is enabled.

Your next check

Test a fresh login and the relevant feature while keeping a working administrator session.

After the switch

What this means

Deactivation may leave server rules, caches or credentials elsewhere. Two-factor enrollment needs its own planned transition.

Your next check

Verify attempts, reset emails, integrations and alerts before deleting the old plugin’s data.

Before you start: a way back in

Make sure you can get back in without the dashboard. That might be your host’s file manager, SFTP or WP-CLI. Take a backup through your host or your backup tool too.

BetterShield adds its own. When you activate it, a single-use recovery link is emailed to the site’s admin address, and BetterShield › Protection › Recovery can issue eight printed recovery codes that work without email. Either one pauses BetterShield’s protections for an hour. It does not pause the other plugin’s, which is one more reason to leave each sign-in job with one plugin at a time. Locked out of WordPress? covers the recovery link and codes in full.

How to switch WordPress security plugins, step by step

Use this order as a starting point, then account for each plugin’s documented controls and recovery path.

1. Write down what the old plugin does today. Sign-in limits and their numbers, who uses two-factor, allowed addresses, a moved sign-in page, and the hardening settings you turned on.
2. Install the new plugin and leave the old one active. Change nothing yet.
3. Decide who keeps each job during the overlap, using the table above.
4. Move one job at a time. After each, sign out and back in from a private window, and check the new plugin’s screen shows what you expect.
5. Plan the two-factor handoff separately, with verified enrollment, so nobody is caught between two systems.
6. Deactivate the old plugin from the Plugins screen, then check again: sign-in limits running, alerts arriving.
7. Delete the old plugin only once its settings have been brought over or written down.

The BetterShield way

BetterShield is built to sit beside the plugin you have while you move. It reads which security plugins are active, and never changes or switches one off.

1. Let Quick Setup split the jobs

When another security plugin is active, Quick Setup adds a step titled Another security plugin is active, with a row for each job both would do:

• Sign-in attempt limits: Keep the other plugin (BetterShield’s own limit goes off), or Use BetterShield.
• Two-factor: Keep the other plugin, so anyone already enrolled keeps signing in as now, or Use BetterShield.
• Activity log and File change monitoring: Keep both, or Use BetterShield only.

Each row starts on the plugin that was there first, and nothing changes until you press Save choices. Some plugins count for sign-in attempt limits only while their own limit is switched on, so the row appears only when it applies. Skip saves nothing and leaves BetterShield’s limit on, so save a choice rather than skipping.

Once saved, the Overview’s Who does which job card shows the split. Already finished Quick Setup? Run Quick Setup again is on Settings › General. Alongside another plugin lists the plugins BetterShield recognizes and what each choice changes.

2. Preview the import

On BetterShield › Settings › General, under This installation, Move settings between sites lists Kadence Security, All-In-One Security, Really Simple Security or Wordfence when one has left settings on the site, marked (active) or (not active). The old plugin is only read, never changed.

1. Press Preview import. Nothing changes yet. Each fix is marked will be applied, already matches, cannot work on this server or was refused, and Login protection shows will change when your sign-in settings would change, with each setting listed from its old value to its new one. A change that leaves the site less protected carries a warning mark.
2. Read Not carried over from. It names each setting that was switched on there and could not come over, with the reason, such as a firewall, which BetterShield does not run. The settings import does not carry two-factor enrollments. Supported authenticator apps can move separately when their source plugin is deactivated after you choose BetterShield for two-factor in Quick Setup. Read Move existing two-factor accounts.
3. Press Make these 4 changes (the button counts them).

The import only turns fixes on, never off. Sign-in attempt numbers it carries over replace yours, so check them in the preview: they can be looser than the defaults. From Wordfence, Kadence Security and All-In-One Security, the addresses the old plugin never locks out are added to Always allowed too. An audit runs straight after it, so Findings reflects the new state.

3. Sign-in limits wait their turn

While an active plugin still limits sign-ins, the attempt numbers are held back and listed under Not carried over from as Sign-in attempt limits: “…is still active and still limits sign-ins. Carry these numbers over once it no longer does that job, or choose this plugin for it in the Quick Setup.” That is the rule from the table above, applied for you. Numbers also need to fit BetterShield’s range: 3 to 100 attempts, and 1 to 1440 minutes for each time.

4. Deactivate the old plugin, then finish

BetterShield never switches another plugin off, so deactivate the old one yourself from the Plugins screen. Then:

1. Press Preview import again. With the old plugin inactive, held-back numbers carry over.
2. Ask people to set up two-factor again, on Protection › Two-Factor or their own profile. Require two-factor of a role gives them a grace period, 14 days by default, and the free plugin requests enrollment in the dashboard. Arrange prompt enrollment for privileged users during the handoff.

5. Check, and put things back if you need to

• Sign-in attempt limits on Protection › Login & Access shows your numbers, and carried fixes show On since.
• If BetterShield’s limit is off and no plugin it recognizes is limiting sign-ins, Findings shows Nothing is limiting sign-in attempts (High). Preview the import again, or switch the limit on.
• If BetterShield’s limit is on and another active plugin limits sign-ins too, with no choice saved in Quick Setup, Findings shows Two plugins limit sign-in attempts (Low). Run Quick Setup again and save a choice, or switch one of the limits off.
• A fix the import turned on is switched off on the screen it is on. Sign-in numbers and allowed addresses come back with Put it back on the Login protection row under Put a settings change back, on Settings › General.

There is a guide per plugin: from Wordfence, from All-In-One Security, from Kadence Security and from Really Simple Security. Each lists what carries over, what does not, and why. For one worked example, switching from Wordfence to BetterShield follows the same order with the import’s exact labels.

Make the two-factor handoff a separate change window

BetterShield does not import another plugin’s enrollments or backup codes. Plan the cutover around the people who must use the site, not only the settings import. First test the exact combination on staging and record how each plugin enables, disables and restores its second-factor prompt.

If the old system can exempt a pilot account, you can test that person’s transition without changing everyone’s enforcement. If it cannot, arrange a supervised enrollment window: prepare recovery, disable the old prompt deliberately, enable the new owner’s flow, and have privileged users enroll and verify a fresh sign-in promptly. Do not leave a long, undocumented interval where staff rely only on a password. A grace period is a convenience for enrollment, not equivalent protection during the gap.

Worked example (fictional): a three-person team schedules a short handoff while all administrators are available. One administrator keeps a working session; the others verify new enrollment and stored backup codes. They check the last administrator before closing the window. A freelancer who is unavailable is handled with an explicit access decision rather than silently assumed migrated.

Keep a rollback record for each job: the previous owner, setting, recovery route and a test that proves restoration. Check host rules, must-use loaders, scheduled tasks and caching before deleting the previous plugin’s data. Deactivation does not establish that every effect it created elsewhere has disappeared.

Common mistakes

• Running two login limiters “just for a day”. Give the job to one plugin, then move it.
• Enrolling people in a second two-factor setup while the first still asks for a code.
• Deactivating the old plugin before your way back in is ready. Recovery comes first.
• Skipping the coexistence step and forgetting that both plugins are now limiting sign-ins.
• Deleting the old plugin before importing. BetterShield reads the settings a plugin left on the site, active or not. Once those settings are gone, there is nothing to read.

For the numbers themselves, see Limit login attempts in WordPress. For two-factor, see WordPress two-factor authentication.

Frequently asked questions

Conclusion

Switching security plugins goes smoothly in a calm order: a way back in, one job at a time, never two login limiters or two two-factor systems, and a check after each step. BetterShield’s coexistence step keeps the overlap tidy, and the import shows you what will change, and what will not, before anything moves.

BetterShield is free on WordPress.org. Alongside another plugin covers each choice in detail.