Solid Security (Now Kadence Security) Setup: 2FA, Passwords, IP Bans

This article is a localized edition of the Japanese original. Read the Japanese original

Solid Security is a WordPress security plugin. It was originally called iThemes Security, was renamed Solid Security, and as of November 2026 is distributed on WordPress.org under the name Kadence Security (version 10.0 series). Even though the name changed, the plugin slug is still better-wp-security, so sites that used Solid Security switch to the new name through a normal update.

This article covers the login settings available in the free version (two-factor authentication and password requirements), IP bans, site scans and notifications. Brute force lockouts, changing the login URL (Hide Backend) and file change detection are covered in detail in How to set up iThemes Security (now Kadence Security).

Setting names and defaults were checked against the settings definitions of each feature in the plugin (version 10.0.6, as of November 2026). The screen labels may appear in English, so this article uses the English names.

Installation and initial setup

1. In the admin, go to Plugins → Add New Plugin, search for "Kadence Security", then install and activate it.
2. A "Security" menu is added to the admin, and the Setup screen opens first. Answer the questions about your type of site and your types of users, and features are turned on to match.

With WP-CLI, you can install it with the following command.

wp plugin install better-wp-security --activate

You can later turn individual features on or off and adjust them in detail under "Security" → "Settings".

How user groups work

Many Kadence Security features are applied per user group. For example, you can require strong passwords for administrators but not for subscribers.

• A group is made from a combination of WordPress roles (Administrator, Editor and so on) and individual users.
• If a user belongs to several groups, all settings enabled in each of those groups apply to that user.

Groups are created from your answers during setup. You can later review and change each group's settings on the user groups screen under "Security" → "Settings".

Two-factor authentication (Two-Factor)

Two-factor authentication asks for a verification code in addition to the password when logging in. It is off by default, so turn on "Two-Factor" under "Security" → "Settings".

Three methods are available.

• Authenticator app (Google Authenticator, Authy and so on): enter the six-digit code shown in the app on your smartphone.
• Email: a code is sent to the registered email address at every login. If the email does not arrive, you cannot log in, so use this on sites where email delivery is reliable.
• Backup codes: single-use codes for when you lose your smartphone. Store them somewhere safe once issued.

How users set it up

When two-factor authentication is on, users who log in through the WordPress login page see a setup guide (onboarding). For groups that should not see the guide, exclude them with "Skip Two-Factor Onboarding" in the user group settings. Even then, users can set up two-factor authentication themselves from Users → Profile.

Administrators should finish setting up their own accounts first and store their backup codes before guiding other users.

Application passwords

The user group settings also have an "Application Passwords" item. It makes users log in with an application password instead of their real password when external tools sign in through the REST API or XML-RPC. With two-factor authentication on, external tools cannot enter a verification code, so use application passwords for such integrations.

Password requirements

This feature puts conditions on login passwords. It is always active; in the user group settings you choose which conditions apply to which groups.

Refuse Compromised Passwords queries an external API, but according to the plugin's description it does not send the password in its original form.

When a condition is on, passwords are checked at login, and users whose password does not meet the conditions are shown a password change screen. It is a good idea to apply both conditions to groups with permission to change posts or the site, such as administrators and editors.

Banning IP addresses and user agents (Ban Users)

This feature refuses access from specific IP addresses and user agents (the name of the software making the request). It is on by default.

To add an IP address by hand, use the "Banned IPs" card on the "Security" Dashboard. IPs that keep getting locked out for brute force attacks are added to the ban list automatically once they reach the Ban Threshold count in Global Settings.

To avoid banning your own office's fixed IP by mistake, add it to Authorized IPs (IPs that are never locked out) in Global Settings.

Site scans (Site Scanner)

This feature checks WordPress core, plugins and themes for known vulnerabilities. According to the plugin's description, the free version runs scheduled scans four times a day and also uses Google Safe Browsing to check whether the site is on the malware warning list.

You can see the results under "Security" → "Site Scans" and "Vulnerabilities". For a plugin or theme with a vulnerability, update it if a fixed version exists; if none has been released, consider deactivating or replacing it. Site scans are not a malware scan that inspects each file on the site, so combine them with file change detection (File Change) to detect tampering.

Notification settings (Notification Center)

Email notifications for lockouts, file changes, detected vulnerabilities and so on are managed together in the notification settings (Notification Center).

On a site with several administrators, all of them get the same notifications. To send them only to the person in charge, change the recipients to individual users. If there are too many notifications, review whether to send each one and how often.

Other free features

Use these from "Security" → "Tools" or "Settings".

Cautions

• Back up the site's files and database before changing settings. Features that write to .htaccess or wp-config.php can make the site stop displaying on some server environments.
• Keep a way into the server, such as FTP, in case two-factor authentication or a lockout shuts you out. Renaming the wp-content/plugins/better-wp-security folder over FTP stops the plugin and lets you return to the normal login.
• Using it together with another security plugin with similar features, such as Wordfence, makes the cause of a lockout hard to tell. Use one or the other.
• Features marked "Pro" (Passwordless Logins, Trusted Devices, User Logging and so on) are available only in the paid version.

Summary

• As of November 2026, Solid Security has been renamed Kadence Security. The slug is still better-wp-security.
• Many features are applied per user group. Apply strong passwords and refusal of compromised passwords to the administrator and editor groups.
• For two-factor authentication, turn on "Two-Factor"; users set it up through the guide at login or on their profile screen. Administrators set up their own first and store their backup codes.
• Ban IPs by hand from "Banned IPs" on the Dashboard, and user agents in the Ban Users settings. Put your own fixed IP in Authorized IPs.

Related articles:

• How to add two-factor authentication to WordPress
• How to limit WordPress login attempts

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)