# How To Keep a Decoy Credential With BetterShield?

Create a deliberately unused application password whose attempted use is refused, recorded, and alerted.

In **[BetterShield](/)**, the switch is under **BetterShield › Agents › Agent surface › Decoy credential**.

## What it does

**Keep a decoy credential on my account** is off by default. It creates an application password named **BetterShield canary (do not use)**. No tool receives the secret and no configuration names it. If the credential is attempted, BetterShield refuses authentication, records the event, and emails an urgent alert even with instant alerts off. **Mute all alerts** still silences that email.

An attempted use means someone or something obtained the credential value from the database or a backup. It still does not identify who did so.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Keep a Decoy Credential

Turn on the switch while signed in as the account that should hold the decoy. Leave the named application password untouched on the WordPress profile screen.

<figure class="doc-shot">
  <img src="/docs/screenshots/decoy-credential.png" alt="Decoy credential setting explaining the unused application password and its account-profile name." width="1960" height="322" loading="lazy" decoding="async">
  <figcaption>The decoy exists to remain unused and is never issued to a real tool.</figcaption>
</figure>

## Recommended settings

Use a privileged administrative account whose security alerts are monitored. Never copy or test the decoy secret.

## What it can break and how to undo

The decoy cannot authenticate, so assigning it to a real tool makes that tool fail and triggers the alert. Turn the switch off to remove BetterShield's decoy record and credential.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

The row should state that the decoy is kept and the profile should list **BetterShield canary (do not use)**. Do not test it by using the credential.

<figure class="doc-shot">
  <img src="/docs/screenshots/decoy-credential.png" alt="Decoy credential setting explaining the unused application password and its account-profile name." width="1960" height="322" loading="lazy" decoding="async">
  <figcaption>Example Decoy credential view. Check the saved values and status on your own site.</figcaption>
</figure>

## On multisite

Application passwords belong to network-wide user accounts. BetterShield records which site planted each decoy.

## Related

- [Set a decoy URL](/docs/decoy-url/)
- [Choose who receives alerts](/docs/alert-recipients/)
- [Limit an application password](/docs/application-password-limits/)

This is how you can keep a decoy credential with BetterShield.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).