# WordPress multisite security: one score table, rules set once

How to see every site’s score in one table and set two-factor and passkey rules once for a WordPress multisite network, with recovery and the undo.

By M Asif Rahman, Oct 22, 2026. Updated Oct 24, 2026.

To secure a WordPress multisite network without visiting every site, use **BetterShield › Network** in Network Admin: one table that shows each site’s score and open findings, two rules you set once for every site, and a recovery link for the whole network. Each site still keeps its own findings, settings and fixes. This guide covers what the Network screen does, how to set the network rules, and the settings we recommend.

It builds on [requiring two-factor](/blog/enforce-two-factor-wordpress/), which explains the rule the network can set as a floor. If a network rule ever locks someone out, [getting back in](/blog/locked-out-of-wordpress/) is the post to open.

## Quick summary

- **Network Admin › BetterShield › Network** lists every site with its **Score** and grade, **Open findings**, **Last audit** and **State**, 200 sites at a time.
- **Require two-factor across the network** and **Passkey-only roles across the network** are floors: a site can add roles but cannot remove one the network requires.
- The network has its own one-time **recovery link**, which pauses enforcement on every site for one hour when it is opened.
- **Rotate the sign-in keys** ends every other session on every site, and each policy change can be put back from **Recent changes to the network**.
- Site-level settings stay on each site, so a network rule sets a minimum and never replaces a site’s own choices.

## Why a network needs its own screen

A multisite network is one WordPress installation running many sites. People who look after one often have the same question every morning: which of these sites needs attention first? Opening each dashboard in turn answers it slowly, and a rule such as “administrators use two-factor” is easy to apply to nine sites and forget on the tenth.

The Network screen answers both. It gives network administrators the cross-site view, and a small number of choices that apply everywhere. Everything else stays where it was. The [WordPress multisite documentation](https://developer.wordpress.org/advanced-administration/multisite/) describes how the network and its sites relate; BetterShield follows that split, with site-level settings on each site and the network-level ones in Network Admin.

## What the Network screen does

On a multisite install, network administrators also get **BetterShield › Network** and **BetterShield › Activity** in Network Admin. The [Multisite networks](/docs/multisite-network/) guide lists every card, and the ones that matter most are these.

### Every site on this network

**Every site on this network** has one row per site: **Site**, **Score** and grade, **Open findings**, **Last audit** and **State**. The site name links to that site’s BetterShield dashboard. State can read **Carried over**, **Not yet carried over**, **Not set up here yet** or **No way back in**.

The table reads each site’s latest saved status and does not run an audit. Values are cached for up to an hour, **Read them again now** refreshes them, and **Show more sites** loads the next 200. Reading and refreshing change nothing on any site. [Review every site on the network](/docs/network-site-overview/) has the detail.

### Set once, for every site

The **Set once, for every site** group holds the two policies. Both start as **Not set**, and only a network administrator can change them.

| Policy | What it does | Default |
|---|---|---|
| **Require two-factor across the network** | Roles that must set up two-factor. Offers **Administrator**, **Editor**, **Author**, **Contributor** and **Subscriber**. | No role ticked |
| **Grace period, in days** | How long an account has, 0 to 90. **0** asks straight away. | 14 shown |
| **Passkey-only roles across the network** | Roles that sign in with a passkey instead of a password on every site. | No role ticked |

### Recovery link for the network

**Recovery link for the network** is a separate recovery path above any single site’s link. **Generate recovery link** creates a link shown once. It works once and lasts 90 days, and opening it pauses BetterShield enforcement on every site for one hour. A site’s own recovery link pauses only that site. For how a site’s own recovery link differs from WordPress’s built-in recovery mode, see [WordPress recovery mode vs a recovery link](/blog/wordpress-recovery-mode/).

## Setting the network rules

A network rule is a floor. Each site enforces the network’s roles plus its own, so a site administrator can ask for more but cannot take a role off the network’s list. Where both levels set a grace period, the shorter one applies. Each site’s clock still starts when that site first sees the account, as [Require two-factor of a role](/docs/require-two-factor/) explains.

### Set it up

1. Make sure BetterShield is network-activated. Existing sites are set up during activation, and later sites are set up when they are created. If a large network leaves a site as **Not set up here yet**, open BetterShield on that site.
2. Check the way back in first. Open the **State** column and look for any site that reads **No way back in**.
3. Open **Network Admin › BetterShield › Network › Set once, for every site › Require two-factor across the network**.
4. Tick the roles, enter **Grace period, in days**, and select **Save**.
5. For passkeys, open **Passkey-only roles across the network**, tick the roles and select **Save**.

Two things to know before the passkey rule. Adding a role is refused when any site lacks a working recovery link or printed recovery codes, and it is refused on networks with more than 200 sites. If sites under the policy later lose their recovery path, the main site’s audit opens a medium finding. [Set a network passkey-only policy](/docs/network-passkey-policy/) and [Require two-factor across the network](/docs/network-two-factor-policy/) have the full details. For the passkey side of the picture, see [how to add passkeys](/blog/wordpress-passkeys/).

A person’s two-factor setup belongs to their account, so it applies on every site of the network. Passkeys are shared by the sites that use the network’s own domain; a site on a domain of its own needs its own passkey.

## Seeing what happened across the network

**Network Admin › BetterShield › Activity** has **Site activity** and **Incidents**. Site activity combines carried-over activity and names the site on each row. **Site** defaults to **Every site**, and the category, search, actor, network and date controls work like the site-level log. The Network Admin view has no CSV export and no daily-seal display, so use an individual site’s log for those, or run `wp bettershield activity --sites=all`.

**Incidents** lists open incidents by site, ten sites at a time. It is network-level triage: the timeline, related activity and response plan stay on the individual site. An incident is a correlation of recorded evidence, not a verdict about intent or the condition of the site.

Both views read from shared tables. The **Moving the log to the shared tables** card follows an automatic move of each site’s activity log, findings, agent activity and passkeys into them. It runs in small hourly batches, shows **Not started**, **In progress**, **Waiting to retry** or **Finished**, and removes nothing from the original site tables. Let it finish before you rely on a complete cross-site view. [Review the network activity log](/docs/network-activity-log/), [Review network incidents](/docs/network-incidents/) and [Monitor the network log migration](/docs/network-log-migration/) go through each one. For what the log itself records, see the [WordPress activity log](/blog/wordpress-activity-log/) post.

## What it can break, and how to undo

- **A network rule can block people who have not enrolled.** After the grace period, an affected account without two-factor is sent to the setup screen, and a passkey-only role without a usable passkey may be unable to sign in. Untick the roles and save, or use **Put back**.
- **Put back restores the value a save replaced.** **Recent changes to the network** lists changes to the two policies, each row naming the change, the actor and the time. **Put back** applies the earlier value to the sites the original operation reached. It does not restore revoked credentials, ended sessions or used recovery links. See [Review network settings history](/docs/network-settings-history/).
- **Rotating the sign-in keys cannot be undone.** **Rotate the sign-in keys** replaces the network’s WordPress sign-in keys and ends every other active session on every site, while you stay signed in. You confirm with **I understand every other session on every site will end** before the second **Rotate the sign-in keys** press. The ended sessions cannot be restored. [Rotate network sign-in keys](/docs/network-sign-in-key-rotation/) has the steps.
- **The recovery link is powerful.** Anyone holding it can start the one-hour pause. **Generate a new link** invalidates the previous one, and **End the pause now** ends an active network pause on every site. [Use the network recovery link](/docs/network-recovery-link/) explains the replacement email.

## Check it is working

- Select **Read them again now** and confirm a few scores and audit times match the individual sites.
- Open a site’s **Login & Access** screen. Roles the network requires should be locked into its effective policy, and a site administrator should not be able to weaken them.
- On **Activity**, choose one site and confirm every row names it.
- On the recovery card, confirm a link is on record and when it expires. Do not open it as a routine test, because using it consumes it and starts the pause.

From a terminal, `wp bettershield activity` accepts `--sites=<ids>` on multisite, a comma-separated list of site IDs or `all`. See [WordPress security from the command line](/blog/wordpress-security-wp-cli/) and [WP-CLI commands](/docs/wp-cli-commands/).

## Recommended settings

We recommend a short, careful order for a network:

1. Read the table first. Review sites with no recent audit or **No way back in** before changing any rule.
2. Generate the network recovery link, store it offline, and check that the network administration address is monitored.
3. Start the two-factor rule with **Administrator** and a measured grace period, and tell site owners first. Widen to other roles once support for enrollment is ready.
4. Treat the passkey-only rule as a later step for a small administrative group, after at least two usable recovery methods are confirmed.
5. Allow the log migration to finish before you rely on **Incidents** across the network.

| Network | What we recommend |
|---|---|
| A few sites, one owner | Administrator two-factor as the network floor, with the default 14 days. |
| An agency or many client sites | Floor for Administrator, recovery checked on every site, and the table reviewed before every operational review. |
| Sites on their own domains | Remember passkeys do not carry across domains, so enroll them site by site. |

## Frequently asked questions

### Does BetterShield work on WordPress multisite?

Yes. Each site keeps its own findings, settings and fixes. The network administrator gets every site’s score and open findings in one table, two-factor and passkey rules set once as a floor under every site, and a recovery link for the network.

### Can a site administrator override a network rule?

A site can ask for more, but not less. It cannot untick a role the network requires, and where both set a grace period the shorter applies.

### How many sites can the Network table show?

200 sites at a time. **Show more sites** loads the next 200, and the values are cached for up to an hour.

### Does the Network screen run an audit?

No. The table reads each site’s latest saved status. Opening an uninitialized site’s BetterShield screen completes its setup, including its first audit.

### Can I undo a network policy change?

Yes, for the two-factor and passkey-only policies. Use **Put back** under **Recent changes to the network**, or untick the roles and save. Ended sessions and used recovery links are not restored.

## Conclusion

A network is easier to look after when you can see it all at once and set the few rules that belong everywhere in one place. Read the table, check the way back in, set a floor with a sensible grace period, and keep the recovery link somewhere safe. BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/); the full reference is [Multisite networks](/docs/multisite-network/), and the rule behind the floor is [Require two-factor of a role](/docs/require-two-factor/).