Security you can actually read.
BetterShield looks over your WordPress site and tells you what it found, in plain language. You decide what to fix, and you can change your mind afterwards.
A WordPress plugin from WPDeveloper.
18 checks, grouped by the part of your site they are about
All of them only read. None of them change anything. Every finding explains why it matters and what could break if you act on it, and you get a score you can see the workings of.
-
Access 5
An account named "admin", the very first account still being an administrator, user profiles anyone can list, open registration into a role that can publish, and administrator passwords still stored in the older format.
-
Exposure 4
XML-RPC, the dashboard file editor, the WordPress version printed into every page, and missing security response headers.
-
Server 3
HTTPS, a PHP version that no longer gets security fixes, and wp-config.php being writable by other accounts on the machine.
-
Configuration 3
The secret keys in wp-config.php, the default database table prefix, and debug output shown to visitors.
-
Updates and extensions 3
Core and plugin updates waiting, and deactivated plugins or themes still sitting on the server.
Two of the checks are graded against where the site is running. Plain HTTP and visible debug output are normal on a laptop and serious on a live site, so BetterShield grades them differently instead of colouring both the same way. It works that out on your server — nothing is sent anywhere.
4 things you can change in one click
- Turn off XML-RPC.
- Remove the plugin and theme editor from the dashboard.
- Stop visitors listing your usernames.
- Send four standard security response headers.
Each one applies on its own and takes effect straight away. Each one has an undo that puts back exactly what was there before, and that undo never expires. If a fix is likely to clash with something you already run, you are told before you apply it, not after. Nothing is done by writing to a file, which is why undo is instant and complete.
Recovery and history
If you get locked out
When you activate the plugin it emails you a recovery link. Opening that link pauses every BetterShield protection for an hour. No login, no password, no second factor. Nothing is deactivated and no setting is lost.
Only a fingerprint of the link is stored, so you can replace it from the dashboard whenever you like.
What it records
Sign-ins and failed sign-ins, users and role changes, plugin and theme changes, a short list of settings, and everything the plugin does itself. Each entry says who did it, what it was, and when.
Entries are written in one batch after the page has already been sent to the visitor, and nothing at all is written during WooCommerce checkout. This release keeps 7 days of history.
What it does not do
There is no firewall and no malware scanning. Doing either of those badly is worse than not doing them, and we would rather say so than pretend otherwise.
The rules it holds itself to
- Audits only read. Nothing on your site changes unless you ask for it.
- Every change can be undone, and the undo is permanent.
- wp-config.php and .htaccess are never written.
- No external requests. Nothing about your site is sent anywhere.
- The whole diagnosis is free, and there is never an upsell inside a security warning.
Requires WordPress 6.6 or newer and PHP 8.0 or newer.