# How to switch WordPress security plugins without lockouts

How to switch WordPress security plugins safely: a way back in first, one job at a time, never two login limiters, and a check after every step.

By BetterShield Team, Oct 11, 2026. Updated Nov 8, 2026 by Nazmul Hasan Rupok.

Knowing how to switch WordPress security plugins is mostly about the stretch in between. For a while, two plugins are active on the same site, and both may want to count failed sign-ins, ask for a second factor or move the sign-in page. Done in the wrong order, that is how people get shut out of a site they own.

This guide gives a handoff method to adapt to the plugins on your site: a way back in first, one job at a time, and a check after each step. Then it shows how BetterShield handles the overlap, from Quick Setup's coexistence step to bringing your old settings over with a preview. If you have not yet decided what to move to, [six questions to ask before you choose a WordPress security plugin](/blog/choose-wordpress-security-plugin/) is the place to start.

## Quick summary

- Set up a way back in that does not depend on signing in, before you change anything.
- While both plugins are active, sign-in limits and two-factor belong to one plugin at a time. Activity logs and file checks can run in both.
- Move one job at a time and check after each, then deactivate the old plugin.
- Two-factor enrollments do not move between plugins, so people set it up again.
- In BetterShield, Quick Setup's **Another security plugin is active** step splits the shared jobs, and **Settings › General** can bring over settings from Kadence Security, All-In-One Security, Really Simple Security and Wordfence, with a preview first.

## Two security plugins on WordPress: what clashes and what does not

Running two security plugins is not a problem in itself. Running two of the same job sometimes is.

| Job | During the overlap | Why |
|---|---|---|
| Sign-in attempt limits | One plugin only | Each keeps its own count, so a person can be paused by either one, and clearing one pause leaves the other. |
| Two-factor | One plugin only | People would be asked for two codes, from two setups. |
| A moved sign-in address | One plugin, or neither | In BetterShield's own words: "Two features rewriting the same address do not combine predictably." |
| Activity log | Usually compatible | Review storage, duplicate alerts and performance. |
| File change monitoring | Usually compatible | Schedule scans and review their combined resource cost. |
| Firewall or malware scan | Whichever plugin provides it | BetterShield does not run either. |

The first three rows are where a WordPress security plugin conflict usually shows up: somebody locked out twice, asked for two codes, or sent to a sign-in page that no longer answers.

## Before you start: a way back in

Make sure you can get back in without the dashboard. That might be your host's file manager, SFTP or WP-CLI. Take a backup through your host or your backup tool too.

BetterShield adds its own. When you activate it, a single-use recovery link is emailed to the site's admin address, and **BetterShield › Protection › Recovery** can issue eight printed recovery codes that work without email. Either one pauses BetterShield's protections for an hour. It does not pause the other plugin's, which is one more reason to leave each sign-in job with one plugin at a time. [Locked out of WordPress?](/blog/locked-out-of-wordpress/) covers the recovery link and codes in full.

## How to switch WordPress security plugins, step by step

Use this order as a starting point, then account for each plugin’s documented controls and recovery path.

1. **Write down what the old plugin does today.** Sign-in limits and their numbers, who uses two-factor, allowed addresses, a moved sign-in page, and the hardening settings you turned on.
2. **Install the new plugin and leave the old one active.** Change nothing yet.
3. **Decide who keeps each job during the overlap**, using the table above.
4. **Move one job at a time.** After each, sign out and back in from a private window, and check the new plugin's screen shows what you expect.
5. **Plan the two-factor handoff separately, with verified enrollment**, so nobody is caught between two systems.
6. **Deactivate the old plugin** from the Plugins screen, then check again: sign-in limits running, alerts arriving.
7. **Delete the old plugin** only once its settings have been brought over or written down.

## The BetterShield way

BetterShield is built to sit beside the plugin you have while you move. It reads which security plugins are active, and never changes or switches one off.

### 1. Let Quick Setup split the jobs

When another security plugin is active, Quick Setup adds a step titled **Another security plugin is active**, with a row for each job both would do:

- **Sign-in attempt limits**: **Keep** the other plugin (BetterShield's own limit goes off), or **Use BetterShield**.
- **Two-factor**: **Keep** the other plugin, so anyone already enrolled keeps signing in as now, or **Use BetterShield**.
- **Activity log** and **File change monitoring**: **Keep both**, or **Use BetterShield only**.

Each row starts on the plugin that was there first, and nothing changes until you press **Save choices**. Some plugins count for sign-in attempt limits only while their own limit is switched on, so the row appears only when it applies. **Skip** saves nothing and leaves BetterShield's limit on, so save a choice rather than skipping.

Once saved, the Overview's **Who does which job** card shows the split. Already finished Quick Setup? **Run Quick Setup again** is on **Settings › General**. [Alongside another plugin](/docs/alongside-another-security-plugin/) lists the plugins BetterShield recognizes and what each choice changes.

### 2. Preview the import

On **BetterShield › Settings › General**, under **This installation**, **Move settings between sites** lists Kadence Security, All-In-One Security, Really Simple Security or Wordfence when one has left settings on the site, marked **(active)** or **(not active)**. The old plugin is only read, never changed.

1. Press **Preview import**. Nothing changes yet. Each fix is marked **will be applied**, **already matches**, **cannot work on this server** or **was refused**, and **Login protection** shows **will change** when your sign-in settings would change, with each setting listed from its old value to its new one. A change that leaves the site less protected carries a warning mark.
2. Read **Not carried over from**. It names each setting that was switched on there and could not come over, with the reason, such as a firewall, which BetterShield does not run. The settings import does not carry two-factor enrollments. Supported authenticator apps can move separately when their source plugin is deactivated after you choose BetterShield for two-factor in Quick Setup. Read [Move existing two-factor accounts](/docs/migrate-two-factor/).
3. Press **Make these 4 changes** (the button counts them).

The import only turns fixes on, never off. Sign-in attempt numbers it carries over replace yours, so check them in the preview: they can be looser than the defaults. From Wordfence, Kadence Security and All-In-One Security, the addresses the old plugin never locks out are added to **Always allowed** too. An audit runs straight after it, so **Findings** reflects the new state.

### 3. Sign-in limits wait their turn

While an active plugin still limits sign-ins, the attempt numbers are held back and listed under **Not carried over from** as **Sign-in attempt limits**: "…is still active and still limits sign-ins. Carry these numbers over once it no longer does that job, or choose this plugin for it in the Quick Setup." That is the rule from the table above, applied for you. Numbers also need to fit BetterShield's range: 3 to 100 attempts, and 1 to 1440 minutes for each time.

### 4. Deactivate the old plugin, then finish

BetterShield never switches another plugin off, so deactivate the old one yourself from the **Plugins** screen. Then:

1. Press **Preview import** again. With the old plugin inactive, held-back numbers carry over.
2. Ask people to set up two-factor again, on **Protection › Two-Factor** or their own profile. **Require two-factor of a role** gives them a grace period, 14 days by default, and the free plugin requests enrollment in the dashboard. Arrange prompt enrollment for privileged users during the handoff.

### 5. Check, and put things back if you need to

- **Sign-in attempt limits** on **Protection › Login & Access** shows your numbers, and carried fixes show **On since**.
- If BetterShield's limit is off and no plugin it recognizes is limiting sign-ins, **Findings** shows **Nothing is limiting sign-in attempts** (High). Preview the import again, or switch the limit on.
- If BetterShield's limit is on and another active plugin limits sign-ins too, with no choice saved in Quick Setup, **Findings** shows **Two plugins limit sign-in attempts** (Low). Run Quick Setup again and save a choice, or switch one of the limits off.
- A fix the import turned on is switched off on the screen it is on. Sign-in numbers and allowed addresses come back with **Put it back** on the **Login protection** row under **Put a settings change back**, on **Settings › General**.

There is a guide per plugin: [from Wordfence](/docs/switch-from-wordfence/), [from All-In-One Security](/docs/switch-from-all-in-one-security/), [from Kadence Security](/docs/switch-from-kadence-security/) and [from Really Simple Security](/docs/switch-from-really-simple-security/). Each lists what carries over, what does not, and why. For one worked example, [switching from Wordfence to BetterShield](/blog/switch-from-wordfence-to-bettershield/) follows the same order with the import’s exact labels.

## Make the two-factor handoff a separate change window

BetterShield does not import another plugin's enrollments or backup codes. Plan the cutover around the people who must use the site, not only the settings import. First test the exact combination on staging and record how each plugin enables, disables and restores its second-factor prompt.

If the old system can exempt a pilot account, you can test that person's transition without changing everyone's enforcement. If it cannot, arrange a supervised enrollment window: prepare recovery, disable the old prompt deliberately, enable the new owner's flow, and have privileged users enroll and verify a fresh sign-in promptly. Do not leave a long, undocumented interval where staff rely only on a password. A grace period is a convenience for enrollment, not equivalent protection during the gap.

**Worked example (fictional):** a three-person team schedules a short handoff while all administrators are available. One administrator keeps a working session; the others verify new enrollment and stored backup codes. They check the last administrator before closing the window. A freelancer who is unavailable is handled with an explicit access decision rather than silently assumed migrated.

Keep a rollback record for each job: the previous owner, setting, recovery route and a test that proves restoration. Check host rules, must-use loaders, scheduled tasks and caching before deleting the previous plugin's data. Deactivation does not establish that every effect it created elsewhere has disappeared.

## Common mistakes

- **Running two login limiters "just for a day".** Give the job to one plugin, then move it.
- **Enrolling people in a second two-factor setup** while the first still asks for a code.
- **Deactivating the old plugin before your way back in is ready.** Recovery comes first.
- **Skipping the coexistence step** and forgetting that both plugins are now limiting sign-ins.
- **Deleting the old plugin before importing.** BetterShield reads the settings a plugin left on the site, active or not. Once those settings are gone, there is nothing to read.

For the numbers themselves, see [Limit login attempts in WordPress](/blog/limit-login-attempts-wordpress/). For two-factor, see [WordPress two-factor authentication](/blog/wordpress-two-factor-authentication/).

## Frequently asked questions

### Can I run two security plugins on WordPress at the same time?

Yes, as long as they do not share sign-in jobs. Give sign-in attempt limits and two-factor to one plugin; activity logs and file checks can run in both. BetterShield's Quick Setup asks which plugin keeps each shared job. It does not catch every overlap, so check the other plugin's settings too.

### Will switching security plugins lock me out?

A conflict, missed setting or unavailable recovery path can still interrupt access. Reduce that risk with a staged handoff, an open administrator session and tests after each change. BetterShield recovery pauses its own enforcement, not another plugin’s.

### Does BetterShield bring over two-factor from my old plugin?

BetterShield does not import those enrollments. Each person enrolls again through a planned handoff. Test any per-user transition on staging, or arrange a supervised cutover; do not assume two simultaneous prompts or an unprotected grace period is acceptable.

### Does BetterShield deactivate or change my old plugin?

No. It reads which plugins are active and the settings they left, and changes neither. You deactivate the old plugin from the Plugins screen when you are ready.

### What if my old plugin is not one of the four?

Quick Setup's coexistence step recognizes more plugins than the import reads. Settings the import cannot read are set up by hand, using the list you made at the start.

## Conclusion

Switching security plugins goes smoothly in a calm order: a way back in, one job at a time, never two login limiters or two two-factor systems, and a check after each step. BetterShield's coexistence step keeps the overlap tidy, and the import shows you what will change, and what will not, before anything moves.

BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). [Alongside another plugin](/docs/alongside-another-security-plugin/) covers each choice in detail.