# BetterShield FAQ: the questions people ask most Short answers about BetterShield: what is free, firewalls, other security plugins, lockouts, two-factor, speed, data, WooCommerce, multisite and uninstalling. Find short answers about **[BetterShield](/)**, with a link to the guide that explains each topic. If yours is not here, see [Getting help](/docs/getting-help/). ## About BetterShield ### Is BetterShield free? Yes. The audit, every plain-language explanation, all 30 fixes and their undo, two-factor sign-in, passkeys, login protection, the recovery link, the activity log, incident response, the file check and the MCP server are free, with no account and no payment. [BetterShield Ultra](/ultra/) is a separate paid add-on for people who look after sites for others. ### Does it include a firewall or a malware scanner? No. BetterShield audits your configuration, hardens it with fixes you can undo, secures sign-ins, logs activity, groups suspicious changes into incidents, and compares WordPress core and directory plugins with the official WordPress.org copies. It does not filter traffic or remove malware. If you need those, keep a plugin or service that does them; see the next question. ### Does it tell me when a plugin has a known vulnerability? Vulnerability checks are optional. With consent in Settings, BetterShield asks BetterShield Hub for published vulnerability advisories and matches versions on your site. No Hub account or paid license is required. A failed refresh is shown as unavailable or stale, never as a clean result. ### Do I need an account? No. Nothing to sign up for. File checks ask WordPress.org about core and directory plugins, and the publisher for supported WPDeveloper paid-plugin checksums. Optional services require consent or configuration. See [What BetterShield contacts](/docs/what-bettershield-contacts/). ## Other security plugins ### Can I run BetterShield alongside another security plugin? Yes, with care. Quick Setup asks which plugin keeps each overlapping job, and Hardening points out a fix another plugin already applies. It cannot catch every overlap, so do not run login limits or two-factor in both. See [Run alongside another security plugin](/docs/alongside-another-security-plugin/). ### How do I switch from another security plugin? **Settings › General** can bring over the protections and sign-in attempt limits from Wordfence, All-In-One Security, Kadence Security or Really Simple Security, with a preview first, a list of what it could not carry and why, and an undo. The other plugin is only read. Each has its own guide: [From Wordfence](/docs/switch-from-wordfence/), [From All-In-One Security](/docs/switch-from-all-in-one-security/), [From Kadence Security](/docs/switch-from-kadence-security/) and [From Really Simple Security](/docs/switch-from-really-simple-security/). ## Fixes and your site ### Will the fixes break my site? Each fix shows what it will change before you apply it (one, refusing requests to cloud-metadata addresses, is on from the start), and each has an undo that does not expire. Two effects outlast an undo, and the fix says so first: people signed out by a key change stay signed out, and browsers that already saw the HSTS header keep insisting on HTTPS until it expires. See [Hardening](/docs/hardening/). ### Will it slow down my site? The Overview shows the database queries and milliseconds BetterShield added to real page views, so you can see the cost. Audits, file checks and emails never run during a visitor's page view, and nothing is added to a WooCommerce cart or checkout. ### Does it work with WooCommerce? Yes. Customers get a **Sign-in security** tab on **My Account**, where they can set up two-factor and passkeys and see where they are signed in, and the hidden bot check covers the store's account forms. Nothing is added to the cart or checkout. ### Does it work on multisite? Yes. Each site keeps its own settings and records, the network screen lists every site's score, two-factor and passkey rules can be set once as a floor for every site, and the network has its own recovery link. See [Multisite networks](/docs/multisite-network/). ## Sign-ins and lockouts ### What happens if I lock myself out? Open your recovery link. It pauses BetterShield's protections for one hour, changes no setting, and issues your next link straight away. A link you never use stops working after 90 days, with a warning in the last two weeks. Printed recovery codes work too, with no email needed. See [Locked out](/docs/locked-out/). ### Can two-factor lock my users out? Not by requiring it. People get a grace period (14 days by default), with an email three days before it ends, and are asked in the dashboard after their password, never refused at sign-in. Each person gets ten backup codes, and an administrator can turn two-factor off for someone who lost everything. See [Two-factor and passkeys](/docs/two-factor-and-passkeys/). ### Why are lockouts not running on my site? Usually because the site is behind a proxy or load balancer BetterShield has not been told about, so every visitor seems to come from one private address, and locking it would lock everyone out. (An unnamed proxy on a public address is the opposite case: lockouts run, against the proxy's address, so name it too.) The Findings screen shows **Failed sign-ins are not being counted, so password guessing is not stopped**. Name the proxy under **Addresses of your CDN or proxy** on **Protection › Login & Access**, or, if it is already named, set it to send an X-Forwarded-For header. Cloudflare needs no entry, but press **Yes, this site is behind Cloudflare** when the screen asks: until then, a lockout counts Cloudflare's address and the visitor's together. See [Troubleshooting](/docs/troubleshooting/). ## Data and privacy ### What does BetterShield keep about people? The activity log (30 days, with IP addresses shortened), recent sign-in attempts, passkeys and the records each feature needs. WordPress's export and erase tools cover them, and a few records are kept on purpose. See [Privacy and personal data](/docs/privacy-and-personal-data/). ### Is the activity log tamper-proof? No, and it does not claim to be. It is tamper-evident: each finished day is sealed and chained to the day before, and if a sealed day is later edited or deleted, the next daily check opens a high-severity finding. See [Activity log](/docs/activity-log/). ### Can an AI assistant change my site? Only if you let it. The MCP server is off until you turn it on, reading and changing are separate switches, and some things, such as creating accounts or changing recovery settings, are never possible through a connection. See [Connect an AI assistant](/docs/connect-an-ai-assistant/). ## The Hub and uninstalling ### Do I need BetterShield Hub? The free WordPress plugin needs no Hub account. The optional Hub workspace brings connected sites, team access, reports and shared alerts together. Some optional services use Hub separately: vulnerability checks need consent but no Hub account, and Ultra request-protection rules use a Hub link. See [Connect to BetterShield Hub](/docs/connect-to-bettershield-hub/). ### What happens if I delete the plugin? By default its records stay, and the files its fixes wrote (.htaccess rules, blank index files) stay in place. Fixes that work through the plugin's own code stop when it is deactivated or deleted, and come back if you reinstall. Undo any fix you do not want to keep before you delete. Under **Settings › General**, **If this plugin is ever deleted** can remove its records instead, which also takes its applied fixes back off. See [General settings](/docs/general-settings/). ## Related - [Troubleshooting](/docs/troubleshooting/) - [Server compatibility](/docs/server-compatibility/) - [Getting help](/docs/getting-help/) - [Install and set up](/docs/install-and-set-up/)