More control, whether you run one site or many.

Ultra overview

See which Ultra features are available and switched on, and open the relevant screen. A connected assistant can read the same overview.

Request protection

With a usable BetterShield Hub link, opt in to site-specific request rules that run on your own server, before ordinary plugins load where supported. Stop one rule, exclude a path or address, and optionally block addresses after repeated rule matches. The screen distinguishes live rules, test rules, expired rules and unavailable delivery.

Off until you choose it. It is not a malware scan. You can return to previous rules and pause updates if a new rule causes trouble.

Administrator accounts and access reviews

Mark an emergency account, warn and then block unused administrators, and schedule a review of administrator accounts, application passwords, assistant connections and temporary grants. Download the review receipt.

Nothing in a review changes until it is completed. An account suspension can be reversed; revoked credentials cannot be recovered.

Access requests and client read-only access

Allow selected roles to request a higher role for 1 to 8 hours. Administrators approve or deny it. Give a client access to Overview, Findings and past reports without changing their role or allowing security changes.

Sign-in hours and stolen-session checks

Set allowed days and hours by role in the site’s time zone, with monitoring before blocking. Watch privileged sessions for a simultaneous change of browser and network, then log and notify or require a new sign-in.

Settings watch

Save the site’s settings or an exported settings file as a baseline. Compare daily, review changes in Findings, and restore a chosen setting with undo.

It reports drift. It does not automatically restore settings.

Vulnerable-plugin automatic updates

Opt in to update eligible vulnerable plugins with current advisory data, publisher updates, host write access and a saved rollback copy. Choose exclusions and maintenance hours. Before and after an update, compare the front page, configured WooCommerce cart and checkout, and up to three more same-site pages.

Off until enabled. Pauses in safe mode or without current data. Failed checks are retried before file rollback; this does not test a purchase or reverse database changes.

Delayed automatic updates

Hold automatic plugin and theme updates for 1 to 7 days. Security fixes and updates you start yourself install immediately. Review waiting updates and install one early.

Admin branding

Use your own name and logo in the admin screens and optionally hide BetterShield’s help links. The Ultra section is called Extras when branded.

Recovery, license and support-related places retain the product’s identity.

Incident paging, help desk and escalation

Open one PagerDuty or Opsgenie alert, or one help-desk email thread, per incident. Acknowledging or handling the incident updates it. Escalate an unanswered critical incident after 15, 30 or 60 minutes.

Two-factor setup at sign-in

Choose the roles that need a second factor, with a shared grace period and optional days for each role. People in multiple covered roles get the shortest applicable period. Once it is up, their next sign-in opens an enrollment screen right after the password.

People in an enforced role cannot remove their own second factor, and an administrator can always turn two-factor off for someone.

Passkey policy

Remind chosen roles to add a passkey, set a date for passkey-only sign-in, and decide whether a device-verified passkey counts as both factors.

A reminder until you set a deadline. From that date enrolled accounts use their passkey; accounts without one keep password sign-in until they add a key.

Trusted devices

Skip the code screen for a shared or role-specific number of days. A blank role value inherits the shared period, and multiple roles use the shortest. Whoever manages BetterShield can forget trusted browsers, and users can see and forget their own from their profile.

Devices are forgotten when the password changes or when everyone is signed out.

The sign-in report

Two-factor and passkey coverage for each role, including accounts with no backup codes left, with a CSV export.

Sign-in screens in your name

Your logo, accent color, heading and opening line on the code and enrollment screens.

Bot check with Cloudflare Turnstile

Turnstile on the sign-in, lost-password, registration and comment forms, WooCommerce’s included, with two-factor sign-in supported. Needs WordPress 7.0 or newer.

Sign-in protection switches on only after your keys pass a check. A visitor who opens a guarded form loads Turnstile’s script from Cloudflare, which gives Cloudflare their IP address.

Alert channels

Send BetterShield’s alerts to Slack, Microsoft Teams, Google Chat, Discord, a JSON webhook or a syslog collector: up to five destinations, each with its own severity floor. A destination can receive the alerts, or the whole activity record for the event classes you choose, and a button sends a test message to check it. Rules can add chosen activity types, or everything one account or role does, at any severity, and alerts can also go to up to five email addresses. A webhook can take standard JSON, NDJSON, Splunk HEC, Datadog Logs or Elastic bulk format, and a syslog collector RFC 5424 or the Common Event Format (CEF). Custom JSON and NDJSON webhook deliveries can be verified using each destination’s own signing secret, shown once. Existing destinations may need a secret created first. A webhook or syslog destination can also receive a daily log checkpoint, to check later whether a day of the activity log still matches.

As well as email, never instead. Webhook addresses must use https and cannot point at this site or a private address. Checkpoints show that the log changed after they were sent. They do not prevent it.

Store, form and search-engine activity

Records what other plugins change, in the activity log and every feed: WooCommerce settings, payment method settings, refunds, order statuses changed by hand, prices, coupons and products removed; forms saved or removed in Contact Form 7, WPForms and Gravity Forms; and pages or settings moved in or out of search results in Yoast SEO, Rank Math and ThinkRank.

Only changes somebody makes in the dashboard, over REST or from WP-CLI. Payment method settings are recorded by name, never by value.

The client report

A scheduled report for the people who pay for the site and never sign in to it: where the site stands, what was fixed and what happened, on the day you choose. Up to five recipients, with your agency’s name and the logo you set for the code and enrollment screens. A second schedule emails what one account, or everyone with one role, did each week or month, with the activity list attached as a CSV file. Keep a client on file with up to five contacts and your notes, and a site with no recipients of its own sends to them. With an AI provider connected, a report you send by hand can open with a short paragraph you read and approve first.

No links into a dashboard the reader cannot open, and nothing is sold inside it. Your notes are never in it, and a scheduled report goes without the paragraph.

Temporary access

Give someone a role for anything from an hour to 30 days, and it ends on its own. A card shows every grant in force, with an End now button.

Their previous roles are put back exactly, and the last administrator is never removed.

Handover

When an agency stops looking after a site, pick its accounts and read one preview of everything they still hold. Then confirm once to end their temporary grants, revoke the assistant connections and application passwords you tick, and suspend and sign out their accounts. The client report can go out with a receipt in counts.

Run it from an account of the client’s own. A suspended account can be let back in, with its role and content intact.

Cloudflare controls

From the Cloudflare tab, raise the zone’s security level, put a challenge on the network of a sign-in lockout, deploy Cloudflare’s managed ruleset, and challenge or block visitors from the countries you name. An AI assistant can propose managed rules and country challenges, each applied only after you confirm it. Needs WordPress 7.0 or newer and a Cloudflare token saved in Settings › Connectors.

Every change is written to the undo ledger before it is made. A lockout rule is always a challenge, never a block, and never reaches a network an administrator has used or one holding an allowlisted address. The country list starts empty, a country rule challenges unless you choose to block, and your own country cannot be on it. A copy marked staging sends nothing to Cloudflare, and nothing happens at the edge while safe mode is on.

Hourly checks of files with no official copy

BetterShield’s check of drop-ins, must-use plugins, the active theme, wp-config.php, the root .htaccess and plugins with no published copy runs every hour instead of once a day.

Scheduled work

The Scheduled tasks tab lists every scheduled task with when it last ran and when it runs next, warns when scheduled work has stopped, and can ask the audit, file check, certificate check or unpublished-code watch to run early.

Command line and settings export

`wp bettershield-ultra policy`, `grants`, `channels`, `edge` and `report` show what Ultra has set on a site. The sign-in policy travels in BetterShield’s settings export, so one site’s setup can be imported into the next.

Reads for a connected assistant

When you let an assistant read your site in BetterShield, it can also read Ultra’s temporary access, alert channels, policies, network edge state, automatic response history, scheduled work and log checkpoints.

Nothing it reads includes a webhook address, an undo handle or a sign-in name.

Up to 365 days of activity history

Choose 90, 180 or 365 days of activity, with 90 as the default instead of Free’s 30. Create sealed monthly archives and an evidence pack. More than 90 days requires BetterShield 1.1.2 or newer. Handled incidents are kept 180 days.

No hourly limit on explanations

BetterShield’s hourly cap on plain-language explanations of a finding is lifted.

Your AI key stays with WordPress. Ultra never asks for, stores or sends one.