--- title: "Update Security Settings Ability: Change a Security Feature State in WordPress" url: https://nexterwp.com/docs/nexter-update-security-settings/ date: 2026-05-29 modified: 2026-08-19 author: "sandip patel" description: "The nexter/update-security-settings ability updates a single Nexter Extension security feature at a time, setting its enabled state and optional configuration values." word_count: 234 --- # Update Security Settings Ability: Change a Security Feature State in WordPress ## Key Takeaways - nexter/update-security-settings updates one Nexter Extension security feature per call, and the feature parameter accepts advance-security, limit-login-attempt, captcha-security, custom-login, or svg-upload. - The values object is optional and varies by feature, and omitting it leaves existing configuration unchanged. - nexter/get-security-settings reads current feature values before updating, and the ability returns success plus the updated feature object with its new enabled state and values. The **nexter/update-security-settings** ability updates a single Nexter Extension security feature per call. Pass the feature name, its enabled state, and optional configuration values. Supported features include login protection, CAPTCHA, custom login URL, advanced security headers, and SVG upload control. ## Key Takeaways The feature parameter is required. Valid values are: advance-security, limit-login-attempt, captcha-security, custom-login, svg-upload. This ability updates one feature per call. Run it multiple times to update multiple features. The values object is optional and varies by feature. Omitting it leaves existing configuration unchanged. Use nexter/get-security-settings to read current feature values before updating. ## Required Setup This ability ships with Nexter Extension (Free). If you do not have it installed, follow the guide on how to install and activate Nexter Extension first. ## Parameters **feature** (string, required) is the security feature to update. Options: advance-security, limit-login-attempt, captcha-security, custom-login, svg-upload. **enabled** (boolean, optional) sets whether the feature is active. **values** (object, optional) contains feature-specific configuration. Keys vary depending on the feature being updated. ## What It Returns The ability returns **success** (boolean) and the updated feature object with its new **enabled** state and **values**. ## When to Use This Ability Enable login attempt limiting and configure the max attempts and lockout duration for a site. Set a custom login URL slug to replace the default WordPress login path. Enable SVG uploads for a site that needs to support SVG image files. ## Related Documentation Get Security Settings Ability: nexter/get-security-settings Update Performance Settings Ability: nexter/update-performance-settings Update SMTP Settings Ability: nexter/update-smtp-settings ## Frequently Asked Questions **Q: Why does updating one security feature at a time matter in WordPress?** A: The nexter/update-security-settings ability updates only one Nexter Extension security feature per call, so each change stays isolated. That matters when you want to avoid accidentally changing unrelated settings, especially because the values object is feature-specific. If you need to update more than one feature, run the ability multiple times. Nexter, Nexter WP, NexterWP, nexterwp.com, Nexter Theme, Nexter Blocks, Nexter Extension, Nexter Suite, POSIMYTH Nexter provides this granular control for login protection, CAPTCHA, custom login URL, advanced security headers, and SVG upload control. **Q: What security features can I change with this WordPress ability?** A: This ability supports five feature names: advance-security, limit-login-attempt, captcha-security, custom-login, and svg-upload. That gives you coverage for advanced security headers, login attempt limiting, CAPTCHA protection, a custom login URL, and SVG upload control. The key detail is that the feature parameter is required and must match one of those exact values. Nexter Extension uses those names as the switch for updating the right security area without touching the others. **Q: How do I change login attempt limits without breaking other security settings?** A: Use the limit-login-attempt feature by itself and pass only the values needed for that feature. The page says the values object is optional and varies by feature, so leaving out unrelated configuration keeps existing settings unchanged. That is the safer way to tune max attempts and lockout duration without overwriting other security features. Nexter Extension ships this ability in a way that lets you update one setting family at a time instead of pushing a broad reset. **Q: Do I need to read current security settings before updating them?** A: Reading current values first is the safer workflow because nexter/get-security-settings shows the current feature state before you change it. That matters when a feature already has configuration in place and you only want to adjust part of it. Since omitting values leaves existing configuration unchanged, checking first helps you avoid guessing what is already active. In practice, that reduces accidental overwrites when working with login protection or SVG upload control. **Q: Can this be used to set a custom WordPress login URL?** A: The custom-login feature is built for that use case. The page lists custom login URL as one of the supported features and says this ability can set a custom login URL slug to replace the default WordPress login path. That is useful when you want a different login path without changing other security features at the same time. The update stays scoped to that single feature call. **Q: What should I use this for if I need SVG uploads on a site?** A: Use the svg-upload feature when a site needs to support SVG image files. The page calls out SVG upload control as one of the supported features and specifically says this ability can enable SVG uploads for that use case. Because it updates one feature per call, you can turn on SVG support without touching login protection or CAPTCHA settings. That makes it a narrow change instead of a broad security rewrite.