# BetterShield: Free WordPress Security Plugin with One-Click Fixes

> Free WordPress security plugin: a 75-check audit in plain language, 30 one-click fixes, two-factor, passkeys, login protection and an activity log.

See what’s actually wrong with your site’s security, then fix what you want. BetterShield 1.1.8 requires WordPress 6.7 or newer and PHP 8.0 or newer. Get it from the WordPress.org directory: https://wordpress.org/plugins/bettershield/

## Free and Ultra

BetterShield is free on WordPress.org: the 75-check audit, one-click fixes, 2FA and passkeys. Ultra, for one site or many, is from $79 a year.

### Free

- 75-check audit and score
- 30 one-click security fixes
- Login protection, two-factor and passkeys
- Activity log and file integrity check
- Lockout recovery without FTP
- Incidents that group related events
- MCP server for AI assistants

### BetterShield Ultra

- Two-factor setup at sign-in, passkey policy and trusted devices
- Chat, webhook, syslog and incident alert destinations, with rules by event type or person
- Scheduled client reports, and activity reports for one person or role
- Temporary access that ends on its own
- Cloudflare controls (WordPress 7.0 or newer)
- Up to 365 days of activity history

| Plan | Covers | Yearly | Lifetime |
|---|---|---|---|
| Personal | 1 site | $79 per year | $199 paid once |
| Business | 5 sites | $139 per year | $399 paid once |
| Agency | 25 sites | $299 per year | $699 paid once |
| Agency Plus | 100 sites | $599 per year | $1,199 paid once |

A yearly plan renews at the same price until you cancel; a lifetime plan is paid once. Full refund within 14 days on any Ultra plan.

Plans: https://bettershield.ai/pricing/. Free and Ultra side by side: https://bettershield.ai/ultra/.

## Start here

- [The WordPress security checklist: 75 checks, explained](https://bettershield.ai/blog/wordpress-security-checklist/index.md): What the audit looks at in each of its five areas, and what to do about every finding.
- [Install and set up](https://bettershield.ai/docs/install-and-set-up/index.md): Install the free plugin and work through each Quick Setup step, with its choices and defaults.
- [Recommended setup](https://bettershield.ai/docs/recommended-setup/index.md): What to turn on after Quick Setup, in what order, and why.
- [WordPress hardening: 30 one-click fixes and what each changes](https://bettershield.ai/blog/wordpress-hardening/index.md): What each one-click fix changes, what it can affect, and which to watch with Monitor first.
- [WordPress two-factor authentication and passkeys: a setup guide](https://bettershield.ai/blog/wordpress-two-factor-authentication/index.md): Authenticator apps and passkeys, requiring them by role, and helping someone who lost their phone.
- [Score and findings](https://bettershield.ai/docs/score-and-findings/index.md): What your score and grade mean, and how to fix, snooze or set aside each finding.
- [Locked out](https://bettershield.ai/docs/locked-out/index.md): Use your recovery link or a recovery code to pause protections for an hour and sign in again.
- [Unexpected WordPress admin activity: a first-hour response plan](https://bettershield.ai/blog/wordpress-security-incident-response/index.md): Preserve evidence, review access and contain changes in the first hour after unexpected admin activity.
- [How to switch WordPress security plugins without lockouts](https://bettershield.ai/blog/switch-wordpress-security-plugins/index.md): A way back in first, one job at a time, never two login limiters, and a check after every step.
- [WordPress MCP: connecting an AI assistant to your site safely](https://bettershield.ai/blog/ai-assistant-wordpress-security/index.md): What an MCP connection lets an assistant read and change, and what to ask before you connect one.

## Frequently asked questions

### Is BetterShield free?

Yes. The audit, every plain-language explanation, all 30 fixes, two-factor authentication, passkeys, login protection, the recovery link, the activity log, incident response, the file check and the MCP server are free. There is no account and no payment. BetterShield Ultra adds premium features for the sites you manage.

### Does it include a firewall or a malware scanner?

The free plugin does not include a general-purpose firewall and does not provide a general malware scan or automatic cleanup. It flags limited store-script and added-PHP signals for review; these cannot establish that a site is clean. Ultra adds optional request protection through a usable Hub link and applicable rules. It audits your configuration, hardens it with one-click fixes, secures logins, logs activity, groups suspicious changes into incidents, compares WordPress core and directory plugins with the official WordPress.org copies, and watches your theme and the files nobody publishes for changes.

### Will the fixes break my site?

Every fix can show you what it will change before you apply it, and you can switch it off at any time. Where switching off cannot reach everything, the fix says so first: people signed out by a key change stay signed out, and browsers that already saw the HSTS header keep insisting on HTTPS until it expires.

### What happens if I lock myself out?

Open your latest recovery link and press its one button. BetterShield’s sign-in protections pause for one hour and your settings stay exactly as they are. Using a link issues the next one straight away, on the page and by email, and printed recovery codes are a second way back in.

### Can an AI assistant change my site?

Only if you let it. The MCP connection is off until you turn it on under Agents › Connect, and reading and changing are separate switches. With only reading on, an assistant can look and change nothing. With changing on, it can apply fixes and put a changed file back, and every change is recorded in the activity log. A change to how people sign in, taking a protection off, updating a plugin, moving files into quarantine or changing an account waits for you to agree to the plan it shows you. Creating accounts or credentials, changing your recovery options, two-factor or alert settings, lifting lockouts and deleting log rows are never possible through a connection.

### Does BetterShield detect vulnerable plugins?

Vulnerability checks are optional. With consent in Settings, BetterShield asks BetterShield Hub for published advisories and matches versions on your site. No Hub account or paid license is required. A failed refresh is shown as unavailable or stale, never as a clean result.

### Do I need an account?

No account is required for the free WordPress plugin. Create a Hub account only if you want its workspace for connected sites, team access and reports. Optional vulnerability checks need your consent but no Hub account.

### Does BetterShield send my data anywhere?

File checks contact WordPress.org for core and directory plugins and the publisher for supported WPDeveloper paid-plugin checksums. Requests carry version numbers and plugin slugs, never your site address, email or username. Optional services require your choice: usage sharing (asked once in Quick Setup, where Skip sends nothing), the breached-password check, your own AI provider, and BetterShield Hub.

## Pages

- [Features](https://bettershield.ai/features/): BetterShield features: a 75-check security audit, 30 one-click fixes, login protection, 2FA, passkeys, file integrity checks and an activity log.
- [Pricing](https://bettershield.ai/pricing/): BetterShield is free on WordPress.org: the 75-check audit, one-click fixes, 2FA and passkeys. Ultra, for one site or many, is from $79 a year.
- [BetterShield Ultra](https://bettershield.ai/ultra/): BetterShield Ultra adds premium features for any site: sign-in rules by role, client reports, alert channels, Cloudflare controls and 90 days of history.
- [BetterShield Hub](https://bettershield.ai/bettershield-hub/): Manage WordPress sites in one free Hub: scores, findings, approved fixes, team alerts, client reports, status pages and one AI connection.
- [Compare plugins](https://bettershield.ai/compare/): BetterShield compared with Wordfence, Really Simple Security, AIOS, Kadence, Sucuri, MalCare, Patchstack and Jetpack Protect, checked by installing each.
- [Use cases](https://bettershield.ai/use-cases/): How BetterShield secures each kind of WordPress site: what goes wrong, the features that deal with it, and the exact prompts to hand your AI assistant.
- [Security checklist](https://bettershield.ai/checklist/): The WordPress security checklist behind BetterShield’s free audit: 75 read-only checks across access, exposure, updates, server and configuration.
- [Docs](https://bettershield.ai/docs/): Guides to install, set up and use BetterShield: Quick Setup, findings, hardening, two-factor, recovery, AI assistants, the Hub and WP-CLI.
- [Blog](https://bettershield.ai/blog/): Practical WordPress security guides, setup advice, incident response, AI assistants and product news from BetterShield contributors.
- [Changelog](https://bettershield.ai/changelog/): Release notes for BetterShield, BetterShield Ultra and BetterShield Hub, newest first, with changes and improvements for each product.
- [Support](https://bettershield.ai/support/): Get help with BetterShield: ask in the WordPress.org support forum, open a ticket, or get back into your site without FTP if you are locked out.
- [Report a security issue](https://bettershield.ai/security/): Found a security issue in BetterShield, Ultra, the Hub or this site? Email support@wpdeveloper.com and keep it private until it is fixed.

Every page, doc and post, with a line on each: https://bettershield.ai/llms.txt