by
WPDeveloper
0 (0 reviews)
BetterShield – Security Audit, 2FA, Passkeys & Login Protection
Free WordPress security audit, thirty one-click fixes you can undo, 2FA, passkeys, login protection and an activity log. No account needed.
BetterShield ranks #10,947 among WordPress.org plugins with 300+ active installations, is #703 of 5,058 in the Security category, and was last updated Oct 28, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v1.1.4
Current Version v1.1.4
Updated 4 days ago
Last Update on 28 Oct, 2026
Refreshed 19 hours ago
Last Refreshed on
#703 of 5,058 in Security
Top 25% by installs
Downloads +714.2% this week
Actively maintained
Rank
#10,947
—
No change
Active Installs
300+
+29900%
KW Avg Position
110
16 better
Downloads
1.4K
+29 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 400
300+
400+
1,126
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 76 more installs to reach 400+
Rank Changes
Current
#10,947
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Security History
Source: WPVulnerabilityNo known vulnerabilities on record for BetterShield. Checked 3 days ago.
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.1.4
- Last Updated
- Oct 28, 2026
- Requires WP
- 6.7+
- Tested Up To
- 7.1.4
- PHP Version
- 8.0 or higher
- Author
- WPDeveloper
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about BetterShield – Security Audit, 2FA, Passkeys & Login Protection
Compatible add-ons can register confirmed actions through the native WordPress Abilities API. The same permission checks, write opt-in, rate limits, target-bound plans and single-use confirmations apply when those abilities are carried over MCP.
Yes. The audit, every plain-language explanation, all 30 fixes and their undo, two-factor authentication, passkeys, login protection, the recovery link, the activity log, incident response, the file check and the MCP server are free. There is no account and no payment. BetterShield Ultra, a separate paid add-on for agencies, adds extras such as two-factor setup at sign-in for the roles you choose, a scheduled client report and longer history: https://bettershield.ai/ultra/
No. BetterShield does not include a firewall and does not scan for or remove malware. It audits your configuration, hardens it with fixes you can undo, secures logins, logs activity, groups suspicious changes into incidents, compares WordPress core and directory plugins with the official WordPress.org copies, and watches your theme and the files nobody publishes for changes.
Yes, on a server that runs Fail2Ban. Turn on “Tell this server’s firewall when a connection is paused” under BetterShield > Login & access, or a host can turn it on for every site with the bettershield_host_ban_line filter. Each pause then writes one line to the server’s auth log naming the network (IPv4 /24, IPv6 /64), never an address or a username. A sample filter and jail ship in the plugin’s fail2ban folder. A network that holds an address on your allowed list writes no line.
Yes, with care. If another security plugin is active, the Quick Setup asks which plugin should keep each shared job, such as login limits, so they are not both doing it. On the Hardening screen, a fix another plugin already covers says so. It does not catch every overlap, so check the other plugin's settings too, and avoid turning on login or two-factor features in both.
Install BetterShield and let the first audit run; it changes nothing. If you are coming from another security plugin, Settings > General can bring over its protections and sign-in attempt limits (several popular security plugins are supported). You see a preview first, it lists what it could not carry and why, the other plugin is only read, and the import can be undone. Then apply any other fixes you want one at a time and switch the old plugin's features off as you go.
Every fix can show you what it will change before you apply it, and each can be undone at any time. Where an undo cannot reach everything, the fix says so first: people signed out by a key change stay signed out, and browsers that already saw the HSTS header keep insisting on HTTPS until it expires.
Open your latest recovery link and press its one button. BetterShield's sign-in protections pause for one hour and your settings stay exactly as they are. You can generate a fresh link from Protection > Recovery at any time; generating one stops the old one working. Using a link issues the next one straight away, on the page and by email. A link you never use stops working after 90 days, and BetterShield warns you in the last two weeks. Printed recovery codes are a second way back in.
Not by setting it up. Nothing is enforced until the app is proven to work and the backup codes are saved, and required two-factor comes with a grace period (14 days by default), with an email to the account three days before it ends. If someone loses their phone, a backup code signs them in, and an administrator can turn two-factor off for them. If you are the only administrator and have lost both, use your recovery link: while safe mode is on, your password turns two-factor off under Protection > Two-factor, and an alert goes out when it does.
The Overview measures it and shows the number for your own site. For visitors, BetterShield runs the fixes you turned on, its login protection on sign-in, the limits on the comment, reset and sign-up forms, the opt-in missing-page limit, and a hidden bot check on the sign-in, registration and comment forms. Audits, file checks and emails never run inside a visitor's page view. On the WooCommerce cart and checkout, BetterShield adds no bot check, skips its sampling, checks and housekeeping, and only records security events.
