# WordPress security plugin setup: Quick Setup and what to check

How to set up a WordPress security plugin in your first hour: what BetterShield's Quick Setup does at each step, and what to check after it finishes.

By M Asif Rahman, Nov 5, 2026. Updated Nov 8, 2026.

To set up a WordPress security plugin well, install it, keep your way back in somewhere safe, let its setup wizard apply the changes that cannot lock anyone out, and then check what it actually did. With **BetterShield**, that wizard is **Quick Setup**, and it opens once after you activate the plugin. This guide walks through each of its steps, what each one saves, and the short list of things to look at when it finishes.

The longer sequence for a whole site, from sign-in rules to alerts, is in [How to secure a WordPress site: what to turn on, in order](/blog/how-to-secure-wordpress-site/). This post covers only the first hour: the plugin’s own setup, and how to tell that it worked.

## Quick summary

- Activation runs a read-only audit and emails a single-use recovery link to the site’s admin address. Save it before you change anything else.
- Quick Setup has at most five steps: **Getting Started**, **Coexistence** (only when another security plugin is active), **Protect**, **Ecosystem** and **BetterShield Hub**.
- Every step can be skipped, and you can run the wizard again from **Settings › General**.
- The **Protect** step shows your score now and the score you reach after **Apply & Continue**, so nothing is applied unseen.
- After setup, check the score breakdown, your recovery readiness and the activity log, and test a sign-in before you end your current session.

## Why the first hour matters

A security plugin has two jobs on day one. It has to tell you the truth about the site, and it has to make the first changes without getting in your way. Most plugins that go wrong at this stage do so by switching on something that locks the owner out. BetterShield’s answer is the order of the wizard: it makes sure you have a way back in, and it offers only the hardening fixes that cannot lock anyone out.

BetterShield needs WordPress 6.7 or newer and PHP 8.0 or newer. If you are still choosing between plugins, [WordPress security plugin: six questions to ask before you choose](/blog/choose-wordpress-security-plugin/) sets out what to look for. If you want the full list of what the audit looks at, [the WordPress security checklist](/blog/wordpress-security-checklist/) covers it. WordPress also has its own [Site Health screen](https://wordpress.org/documentation/article/site-health-screen/), which reports on the site’s configuration. It is a useful second opinion next to any plugin’s score.

## What activation does

Install BetterShield from **Plugins › Add Plugin**, then activate it. Activation does four things:

1. It runs a read-only audit.
2. It emails the site administrator a single-use recovery link.
3. It starts the protections that are on by default: the sign-in limit, the hidden bot check and password standards.
4. It opens Quick Setup.

Apart from refusing requests to cloud-metadata addresses, no hardening fix is on yet. Instant alerts and the weekly summary start off on a new install, and you choose them in Quick Setup or in **Settings › Email alerts**. The reference for this part is [Install and set up](/docs/install-and-set-up/).

Before you change anything else, save the recovery link somewhere off the site, such as a password manager. It works once and lasts 90 days. Then open **BetterShield › Protection › Recovery**, press **Issue Recovery Codes** and keep the eight codes off the site too. They work when email does not. The full options are in [Set up recovery](/docs/set-up-recovery/).

## Quick Setup, step by step

### Step 1: Getting Started

You choose whether to share usage data. It stays off unless you allow it, and the step lets you review **What we collect** first. Skipping sends no usage report.

### Step 2: Coexistence, only if another plugin is active

If another active security plugin shares a job with BetterShield, this step asks which plugin should handle each one, such as limiting sign-in attempts or two-factor. The choices start with **Use BetterShield**, and the preview states what BetterShield can carry over from the other plugin and what stays behind.

Read the card before you press **Save & Continue**. It tells you when saving also deactivates a plugin whose jobs are moving to BetterShield. A plugin’s own **Deactivate** button switches it off in place, which stops everything that plugin does, including features BetterShield may not replace. Its settings stay saved, and the summary offers **Turn It Back On**. The details are in [Run BetterShield alongside another security plugin](/docs/alongside-another-security-plugin/). The step does not catch every overlap, so check the other plugin’s settings as well.

### Step 3: Protect

This is the step that changes the most, and it is built so you can see the result before you commit. **Protect your site** opens with a score preview: your grade and score now, and the grade and score you reach after **Apply & Continue**. Below it, **Recommended** lists each choice that moves the score, with the points it is worth.

| Area | What you decide |
|---|---|
| Sign-in attempt limits | BetterShield’s own limit is on, unless you kept this job with another plugin |
| Safe fixes | **Choose Fixes** shows the five that need no extra steps; recommended ones start selected |
| More settings | **Just me** or **Me and a team**, how visits reach your site, email alerts and vulnerability checks |
| Vulnerability checks | Off until you choose them; with consent, names and versions go to BetterShield Hub, and no Hub account is needed |

The five safe fixes are the file editor, usernames, security headers, folder listing and the WordPress version. Each has a preview, and you can switch off any you do not want. Under **More settings**, the question about how visits reach your site starts with what BetterShield detected. Override it only when you know how your proxy or service is set up.

**Apply & Continue** saves the site answers, the vulnerability consent and the fixes in order. If one section cannot save, read its error and correct it. A partial failure does not mean the earlier successful actions were rolled back.

### Step 4: Ecosystem

This step shows the score after setup, which matches the preview, and a folded list of what changed, each with its undo control. It also offers the next steps that still earn points: setting up recovery, **Set Up Two-Factor**, blocking common usernames and opening alerts. Recommended WPDeveloper plugins appear here. Install only the ones you choose, and only when your account and installation allow it.

### Step 5: BetterShield Hub

The last step offers the optional Hub, where one account can watch several sites. You can press **I’ll Connect Later**. If you connect, the approval goes through the Hub sign-in and the site’s own approval page, and you should read the read and change permissions before you approve.

## What to check after Quick Setup

Quick Setup is not the finish line. The plugin’s own advice is to read the result before adding stricter sign-in rules. Work through these in order:

1. **Open the Overview** and read the score breakdown. The score is 60 points for setup essentials and 40 for site health, so the breakdown shows which side still has room.
2. **Check recovery readiness.** If your backup way to sign in is not fully set up, a finding says so. Fix it before you require two-factor of anyone.
3. Read the receipt and the activity log for what setup applied. Every change setup made is recorded, and each fix you chose has an undo.
4. **Verify how visits reach your site.** Behind Cloudflare or another proxy, a wrong answer here can leave failed sign-ins uncounted. See [Proxies and Cloudflare](/docs/proxies-and-cloudflare/).
5. **Review the alert recipients.** Alerts are off on a new install until you turn them on, so press **Send a Test Alert** once you have.
6. Test a sign-in in a private window before you end your current session.

## Recommended settings

We recommend finishing the first hour with only the five safe fixes, your own two-factor and a working recovery path. Then read the first audit before you go further. The step-by-step order for everything after that is in [Recommended setup](/docs/recommended-setup/).

Keep one plugin in charge of each job. If another plugin keeps limiting sign-ins, let it, and let BetterShield’s own limiter stand down. Two plugins limiting the same sign-ins can lock out the people you are trying to protect.

## What it can break, and how to undo

- **A fix you chose in Protect:** each one has an individual undo, and the set can be undone together from the Ecosystem step’s list of changes.
- **A plugin you deactivated in Coexistence:** its features stop. Its settings stay saved, and **Turn It Back On** reactivates it from the summary or from Plugins.
- **A wrong proxy answer:** correct it under the sign-in settings, and check that failed sign-ins are counted again.
- **A setup you want to revise:** use **Run Quick Setup Again** under **Settings › General**. It opens with your current choices and changes only the answers you revise. See [Run Quick Setup again](/docs/rerun-quick-setup/).

Recovery links and recovery codes have their own lifecycle. A general settings undo does not restore them, so issue new ones if you need them.

## Frequently asked questions

### How long does WordPress security plugin setup take?

For BetterShield, Quick Setup has at most five steps and every step can be skipped. Plan on a few minutes for the wizard and a few more for the checks afterwards.

### Can I skip Quick Setup and do it later?

Yes. Your saved progress is kept when you leave partway through, and the Overview’s setup card lets you continue. A completed wizard can be reopened with **Run Quick Setup Again**.

### Will Quick Setup lock me out of my own site?

It is built not to. The fixes it offers are the ones that need no extra steps and cannot lock anyone out, and it asks you to keep a recovery link and recovery codes first. Test a sign-in before you end your session anyway.

### Do I need BetterShield Hub?

No. The Hub is optional, and **I’ll Connect Later** skips it. Vulnerability checks are separate and stay off until you choose them.

### Does BetterShield replace my firewall or malware scanner?

No. BetterShield is not a firewall and does not scan for malware. If you rely on those jobs elsewhere, keep them.

## Conclusion

A good WordPress security plugin setup is short: a way back in, the safe fixes on one screen with the result shown first, and a few checks afterwards. Quick Setup puts the choices in that order and records what it applied, so you can see it and take it back.

BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). The full reference for the wizard is [Install and set up](/docs/install-and-set-up/).