How To Set Up Site Recovery With BetterShield?

Keep a BetterShield recovery link and recovery codes, check daily that they work, and test that recovery email leaves your site.

BetterShield gives you two ways back in that need no password: a recovery link and recovery codes. Either one starts safe mode for an hour, so a BetterShield setting can never keep you out for good. Set them up on BetterShield › Protection › Recovery. Using them is covered in Locked out.

What it does

The recovery link is a private address for this site. It works once, stops working 90 days after it was issued, and is shown only once, because the site keeps just a fingerprint of it. Using it shows the next link on screen and emails a copy to the site’s administration email address.
Recovery codes are eight single-use codes for the day email is the problem. They use the same address as the link and do not expire.
Recovery check checks both every day without using either. If your host tells BetterShield it gives you a way into the site that does not use the sign-in form, the recovery findings pass.

Step 1: Set Up Site Recovery

The first link is emailed to the site’s administration address at activation, with the subject “[example.com] Your BetterShield recovery link” (your domain in the brackets). A new link made under Generate a New Link retires the earlier one.

Option	What it does	Default
Generate a New Link (Generate Recovery Link when none exists)	Makes a new link and shows it once, with Copy link. The old link stops working at once, including a copy you saved. Not emailed.	One link, emailed at activation
Issue Recovery Codes (Issue a New Set when some are left)	Shows eight codes once, grouped in fours, with Print and Copy all. The printed sheet names the address to add a code to. A new set replaces every unused code.	None
Check Recovery Options	Runs the four checks below at once and refreshes Findings. Uses no link or code. Once a minute at most.	Runs daily on its own
Send a weekly recovery email check	Emails your alert recipients at most once a week, through the same path as alerts, with the subject “[Site name] Recovery readiness email check”. It holds no link or code, and is not sent while alerts are muted.	Off

From the terminal, wp bettershield recover --new-link turns on safe mode for an hour and prints a fresh link once; the old one stops working. See WP-CLI commands.

The Recovery check lists four checks:

Check	Passes when
Recovery link	A link exists, has not expired, and its email was not refused for sending.
Recovery codes	At least one code is unused.
Administrator address	At least one administrator has a valid email address (the first 200 are checked). It cannot prove the inbox is read.
Email path	The last weekly test was accepted for sending within eight days. Counted only while the weekly check is on.

Recovery screen with recovery-link readiness and recovery-code controls in BetterShield 1.1.5. — Confirm delivery on the recovery card after checking your inbox.

Applying a Signing in fix (including Enforce reviewed settings after Monitor first), or adding a role to Require two-factor of a role, first checks that you have a working recovery link or an unused recovery code, and that recovery was checked in the last 24 hours. If not, Check the way back in first opens with the reason:

Open Recovery, when there is no working way back in.
Check now, when the last check is over a day old. It checks, then makes the change if it passes.
Go ahead anyway makes the change and logs “Sign-in change made without a recovery check”. Cancel changes nothing.

wp bettershield harden <item> --force is the terminal’s Go ahead anyway. Undoing a fix is never held. Sign in with a passkey only offers no way round: adding a role is refused until you hold a current link whose email was not refused, or recovery codes.

Recommended settings

We recommend keeping both kinds of recovery: the link is the quick way back, and the codes still work when email does not.

Keep the link in your password manager, in this site’s entry, not only in an inbox.
Print the codes and keep the sheet away from your computer.
Turn on Send a weekly recovery email check, and look for the first message.
Generate a new link when someone who has seen it leaves, after the site moves to a new address, and when Findings says it is close to expiring. Issue new codes when someone who saw the sheet leaves, or only a few are left.
Press Check Recovery Options before requiring two-factor or passkey-only sign-in of a role.

Site	What we recommend
Store (WooCommerce)	Keep the codes where more than one person who runs the shop can reach them.
Agency or many sites	One vault entry per site, shared with the people who look after it. On multisite, keep the network link too.

What it can break, and how to undo

A new link (including Resend) retires the old one for good. If the Resend email cannot be sent, the new link is shown once on screen.
A new set of codes retires old sheets.
After you change alert recipients, the email check reads as untested until the next weekly test is due.
Ten wrong codes from one connection within an hour stop codes working from it for up to an hour.
If BetterShield’s own records cannot be read, codes are refused and Findings shows Sign-ins are being refused because BetterShield cannot save to the database (Critical). The link still works.
With Ask for my password before removing a protection on, generating a link, issuing codes and turning off the weekly check ask for your password. None of them works with an application password.

Confirm the recovery email arrived

When the recovery card asks Did the recovery email arrive?, check your inbox and select It Arrived. The Overview then reflects your confirmation. Mail accepted for sending alone does not establish delivery.

Final Outcome

The tab’s tiles: Recovery link reads Ready, Missing, Expired or Not delivered; Recovery codes and Recovery check show counts.

The Overview’s recovery card is titled A recovery link is ready or Recovery needs a look.
Findings: Your recovery options aren’t fully set up (Low) while any check fails, including when no codes are left or the daily check has not run for two days. The recovery link is close to expiring (Medium) in its last 14 days and after; with passkey-only sign-in on, The recovery link is close to expiring, and passwords are switched off (High).
Activity log: “Recovery link generated” (also for new codes), “Recovery link rejected” and “Safe mode started”.
Email: “[your site] Your BetterShield recovery link was used”, with the replacement, each time a link is used.

On multisite

Each site has its own link and codes. Network administrators also get Recovery link for the network on BetterShield › Network: one link that pauses enforcement on every site for an hour, used at any site’s recovery address. It is shown once, not emailed; after use, its replacement goes to the network’s administration address. See Multisite networks.

This is how you can set up site recovery with BetterShield.

Getting Stuck? Feel free to contact our Dedicated Support Team.