# WordPress blog security: authors, editors, comments and visitors

Secure a multi-author WordPress blog: two-factor for writers, limits on comments, and what to stop showing visitors, step by step with BetterShield.

By M Asif Rahman, Oct 31, 2026. Updated Nov 2, 2026.

WordPress blog security comes down to three places: the accounts that can publish, the comment form anyone can use, and what the site tells every visitor about itself. **BetterShield** puts a control on each, and this guide sets them up in the order that matters for a blog with more than one writer, with the settings we recommend and how to undo each one.

If you are choosing roles first, [WordPress user roles security: least privilege without guesswork](/blog/wordpress-user-roles-security/) covers who should hold which role. This post is about what to turn on once you know. The site’s [blogs and publishers playbook](/use-cases/blogs-publishers/) is the short version of it.

## Quick summary

- Every editor and author account can publish under the site’s name, so each one is worth a second step. **Require two-factor of a role** can ask for it from Editor and Author, not only Administrator.
- The comment form has two protections that are both on by default: **Block simple bots on forms** and **Send floods of comments to moderation**.
- **Username privacy** and **WordPress version privacy** stop the site announcing details that scripts use to choose what to try. Both start off.
- BetterShield does not sort spam, and it does not record edits to posts. It records sign-ins, accounts created or deleted, role changes and email changes.

## Why a blog is a different kind of site

A blog is open by design. Anyone can read it, anyone can comment, and several people may sign in to write. That is the point of it, and it also means the three places above are the ones a script can reach without any account.

None of this calls for alarm. The aim is to make the simple cases fail quietly. A password that someone else chose should not be enough to publish as your site. A script that fills a comment form faster than a person types should be turned away. A scanner that reads your version number should learn less. The [WordPress documentation on roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/) explains why Editor and Author can publish at all: both hold the capability to publish posts, and Authors can publish their own.

## Step 1: ask your writers for a second step

**Require two-factor of a role** is under **What the site requires** on **BetterShield › Protection › Two-Factor**. It lists every role on the site, so you can tick Editor and Author as well as Administrator.

It is enforced inside the dashboard, never at the sign-in page. The password still signs people in, and during the grace period they work as normal and see a notice on every dashboard page. After the grace period, every dashboard page sends them to the setup screen until they finish. Their profile, signing out and the front of the site stay open.

### Set it up

1. Open **BetterShield › Protection › Two-Factor** and set up your own two-factor first, because the requirement covers you too.
2. Tick the roles under **Require two-factor of a role**.
3. Set **Grace period, in days**. The default is 14, and the range is 0 to 90.
4. Press **Save requirement**.

If your recovery options have not been checked in the last day, or there is no working recovery link and no unused recovery code, **Check the way back in first** opens before the save. We recommend running **Check now** and fixing anything it finds. [Set up recovery](/docs/set-up-recovery/) walks through it.

### What to know

An account’s window starts the first time it opens a dashboard page while its role is ticked, not when the account was created. An account that has existed for years gets the full window. One email goes out three days before the deadline, as long as the grace period is longer than three days.

Only app codes count toward the requirement. A passkey does not satisfy it, even one that signs in without a code, so tell writers to use an authenticator app. Any app that makes six-digit codes works, including a password manager that does. [Two-factor with an app](/docs/two-factor-app/) shows what they will see, and [Enforce 2FA in WordPress: pilot, recovery and rollout](/blog/enforce-two-factor-wordpress/) covers telling a team before you save.

For a blog, we recommend Administrator plus Editor first, with the default 14 days, and Author once the first group has finished. A shorter window such as 7 days suits a small team you can talk to directly. The [full option reference](/docs/require-two-factor/) lists the rest.

## Step 2: keep the comment form open and quiet

Two protections already guard the comment form, and both are on by default.

**Block simple bots on forms** is under **Sign-in protection** on **BetterShield › Protection › Login & Access**. It adds a hidden field and a signed timestamp to the sign-in, registration and comment forms, and refuses submissions that fill the hidden field or arrive within two seconds of the form being drawn. On the comment form it checks signed-out commenters only. People see nothing and solve nothing, and it needs no JavaScript and no outside service. In the screen’s own words, it cuts bot noise and does not stop a targeted attacker. See [Refuse automated sign-ins, sign-ups and comments](/docs/bot-check/).

**Send floods of comments to moderation** is under **Request protection** on the same screen. When one connection reaches 10 comments within 10 minutes, its comments go to the moderation queue as pending for the next 30 minutes. Nothing is discarded, a comment already marked as spam stays spam, and people who can moderate comments are never counted.

| Setting | What it does | Default |
|---|---|---|
| **Limit per visitor** | The comment from one connection that closes the form to it, 3 to 100 | 10 |
| **Counted within (minutes)** | How far back comments are counted, 1 to 1440 | 10 |
| **Block lasts (minutes)** | How long comments wait in moderation, 1 to 1440 | 30 |

If readers often comment together from one school or office network, raise **Limit per visitor**. Change a number and a sentence under it replays the new value against the last two days of attempts, beside what the saved value did, before you press **Save**. [Limit comment spam and password resets in WordPress](/blog/wordpress-comment-spam-and-reset-limits/) goes through the replay with an example, and the [public form limits guide](/docs/form-limits/) has every option.

One honest limit: BetterShield does not read what a comment says, so it is not a spam filter. Held comments wait under Pending on the comments screen for you or an editor to read.

## Step 3: show visitors less

An open blog also tells anyone who asks which usernames exist and which WordPress version runs it. Scripts use both to choose what to try. Two fixes sit under **What the site reveals** on **BetterShield › Protection › Hardening**, and both start off.

**Username privacy** closes the routes a signed-out visitor can use to collect usernames. For visitors who are not signed in, the REST API user list answers 404, a numbered author link such as `?author=1` sends them to the home page, embeds of your posts stop naming the author, and the sign-in form answers a wrong password and an unknown username the same way. The users sitemap leaves the sitemap index for everyone. An archive at its own address, such as `/author/jane/`, still works, and the block editor and the Users screen work as before. [WordPress user enumeration: what it reveals and how to stop it](/blog/wordpress-user-enumeration/) explains why this matters less than people think and what to pair it with.

**WordPress version privacy** removes the generator tag from pages and feeds and masks the version in script and stylesheet addresses, while caches still refresh after every update. It hides the number and does not change it, so keep WordPress up to date as well. The full story is in [Hide the WordPress version without breaking caches](/blog/hide-wordpress-version/).

For both, press **Preview the change** first. It lists what applying would do and changes nothing. Then turn the switch on. Each row shows **On since** and **Undo never expires**.

### XML-RPC, after a look

Older publishing apps and pingbacks use `xmlrpc.php`, and so do scripts that try passwords. **Remote publishing block (XML-RPC)** answers it with 403, and it leaves the REST API that the block editor uses untouched. If you publish from the WordPress mobile app, choose **Pingbacks only** under **What to turn off** instead. **Preview the change** says whether anything used XML-RPC recently, and **Monitor first** watches for 1 hour, 24 hours or 7 days before you enforce it. [Should you disable XML-RPC in WordPress?](/blog/disable-xml-rpc-wordpress/) helps you decide.

## Step 4: tidy up when a writer moves on

Writers leave and editors change jobs, and their accounts and sessions stay behind until someone tidies up. On **Protection › Login & Access**, **Who is signed in** lists every account with a live session. **Sign out all their sessions** beside an account ends every session it holds, on every device, and leaves the account and its password alone. You can then change the role or remove the account under **Users** as usual. See [Sessions](/docs/sessions/) for the full table.

The activity log records sign-ins, accounts created or deleted, role changes, and email and password changes, with who and when, for 30 days in the free plugin. With instant alerts enabled, an alert is emailed straight away when an administrator or editor account is created, deleted or given a new email address. Edits to posts, pages and other content are not recorded, so BetterShield cannot tell you who changed an article.

## What it can break, and how to undo

- **Two-factor:** someone overdue cannot reach the post editor until they finish setup, and everything they need is on their profile. To undo, untick the role and press **Save requirement**.
- **Comment limits:** a shared network shares one count, so its comments wait in moderation. Raise the number, or add the network’s fixed address to **Always allowed**.
- **Hide usernames:** the lost-password form shows its normal “check your email” page for any name, so someone who mistypes an address is told a link is on its way and no email arrives.
- **Hide the WordPress version:** browsers and caches fetch some files once more when you apply or undo it.
- **XML-RPC:** the mobile app or Jetpack may stop if they use it. Turning the switch off brings it back at once.

Every one of these is a switch, and turning it off puts the old behavior back. With **Ask for my password before removing a protection** on, removing one asks for your password.

## Check it is working

- Under **BetterShield › Protection › Two-Factor**, the **Two-factor required for** tile names the roles, and the activity log shows “Two-factor requirement changed” and then “Two-factor turned on” as people finish.
- View the source of a post with comments open and look for “Leave this field empty”, the hidden field.
- On **Login & Access**, a held comment shows as a row on the **Lockouts** list under **Comments**, and the activity log records “Comment held for moderation”.
- Request `/wp-json/wp/v2/users` while signed out. With **Username privacy** on, it answers 404.
- View the source of your home page. The generator tag naming WordPress and its version is gone.

## Recommended settings

We recommend this order for a blog with several writers: set up your own two-factor, require it of Administrator and Editor with the default 14 days, keep the two comment protections on, preview and turn on **Username privacy** and **WordPress version privacy**, and decide about XML-RPC with the preview. Add Author to the two-factor roles once the first group has finished. Review **Who is signed in** whenever someone stops writing for you.

## Frequently asked questions

### Can I require two-factor for editors and authors only?

Yes. **Require two-factor of a role** lists every role, so tick the ones your writers use and leave the others unticked. Each account gets 14 days by default, and sign-in itself is never blocked. Someone who loses their phone signs in with a backup code, or an administrator turns two-factor off for that account.

### Does BetterShield filter comment spam?

No. It does not read what a comment says. It adds the hidden bot check and holds a connection’s comments in moderation once it reaches the limit. Nothing is discarded, and moderators are never held.

### Does the activity log record edits to posts?

No. It records sign-ins, accounts created or deleted, role changes, email and password changes, plugin, theme and core changes, and key site settings. Edits to posts, pages and other content are not recorded.

### Will hiding usernames break my author pages?

No. An author archive at its own address, such as `/author/jane/`, still works, because that address already shows the name. What changes is the REST API user list, numbered author links, the users sitemap and embeds.

## Conclusion

A multi-author blog needs very little: a second step for the accounts that publish, the comment protections that are already on, and fewer details shown to visitors. Each is a switch you can preview and undo. BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/), and the two-factor setup is in [Require two-factor of a role](/docs/require-two-factor/).