Risky modules and recovery · WellTend Site and Admin Toolkit docs

Most modules are harmless to switch on. Fourteen are marked Extra safeguards because a wrong setting can lock someone out, hide the site, stop email or change files. For these the Toolkit:

shows a plain-language warning and the way back, and asks you to confirm (--yes on the command line);
takes a safety copy of that module's settings first, as a snapshot in WellTend Snapshots when that plugin is active, and always keeps its own copies of the last three states;
keeps a recovery path that does not need the dashboard.

Three ways back in#

These work for every module, in this order of effort.

1. Switch it off in the dashboard. Turn the module off on the Modules page. Undo puts the previous settings back.

2. WP-CLI. If you have a terminal:

Terminal

wp awc toolkit disable change_login_url

3. The recovery constant. If you can edit files but not run WP-CLI, add one line to your own wp-config.php. The plugin never writes to that file itself.

wp-config.php

// Pause every module until you are back in:define( 'AWC_DISABLE_MODULES', true );// Or pause only these:define( 'AWC_DISABLE_MODULES', 'change_login_url,maintenance_mode' );

You can write true, yes, on, all or * (any letter case) for every module, or a list of module ids separated by commas, spaces or an array. Nothing is written to the database. The Modules page shows a banner that names the modules the line pauses, and everything works again as soon as you remove the line.

Careful with Disable User Account. Blocking a person works only while that module is on. If you pause it with this line, switch it off, or turn the plugin off, everyone you blocked can log in again. The Modules page asks you first when people are blocked, and the banner and the Plugins page tell you how many.

If a module fails while it starts up, the Toolkit skips only that module for the request and reports it on the Modules page, so one faulty module cannot take the site down.

Change Login URL hides /wp-login.php and /wp-admin from visitors who are not logged in. If you lose the new address:

run wp awc toolkit disable change_login_url, or
add define( 'AWC_DISABLE_MODULES', 'change_login_url' ); to wp-config.php.

The normal login page works again at once. Remove the line afterwards.

Each risky module#

change_login_url. Moves the login page from /wp-login.php to a secret address of your choice, so bots that hit the default address get nothing. Write the new address down: if you lose it, use the recovery steps shown in the confirmation.

Before you switch it on. Visitors who are not logged in will no longer reach /wp-login.php or /wp-admin: they get a "page not found". You log in at the new address instead, so write it down first (the Modules page shows it, and an email with it can be sent to you). Bookmarks and links to the old login page stop working. Nothing changes until you save a valid new address.

Getting back. If you cannot get in: add define( 'AWC_DISABLE_MODULES', 'change_login_url' ); to wp-config.php, or run wp awc toolkit disable change_login_url. The normal /wp-login.php works again immediately. Remove the line afterwards.

Nothing changes until you save a valid new address, and the recovery steps above work even if you have forgotten it.

limit_login_attempts. Locks an address out for 15 minutes after a few wrong passwords, and for a day after repeated lockouts. Your own address is never locked out while you set this up. Shared networks (offices, mobile data) share one address, so keep the limits generous.

Before you switch it on. After this many wrong passwords an address cannot log in, even with the right password, until the lockout ends. People who share one internet address (an office, a mobile network) share the count. Your current address is exempt while you set this up. If your site sits behind a proxy or CDN, fill in "Trusted proxies" and "Read the visitor address from this header", otherwise every visitor looks like one address.

Getting back. If you are locked out: add define( 'AWC_DISABLE_MODULES', 'limit_login_attempts' ); to wp-config.php, or run wp awc toolkit disable limit_login_attempts (or wp awc toolkit lockouts clear to only empty the lockout list). Lockouts also end by themselves after 15 minutes or 24 hours.

Password Protection#

password_protection. Hide the whole site behind one shared password. Good for a staging copy or a private preview. Logged-in administrators walk straight in.

Before you switch it on. Visitors will see a password form instead of your site, and search engines will be told not to list it. Logged-in administrators are not asked for the password, so stay logged in (or keep the address of wp-login.php at hand) while you test. Page caches and CDNs can keep showing saved pages without asking WordPress, so some visitors may see the real site when they should not: exclude this site from them while the password is on and clear them afterwards (the module warns you when it sees a cache). The "Always allow these addresses" list is for services only: a request for a page, post, search or the REST API of your site is never let in by it. Web hooks from other services (payment providers, for example) are blocked unless you list their address in "Always allow these addresses".

Getting back. Log in at wp-login.php as an administrator (it is never locked) and switch the module off. Without dashboard access, run wp awc toolkit disable password_protection or add define( 'AWC_DISABLE_MODULES', 'password_protection' ); to wp-config.php.

Maintenance Mode#

maintenance_mode. Shows visitors a friendly "we'll be back soon" page while you work. People who can edit posts still see the real site. Search engines are told to come back later, so your rankings are safe.

Before you switch it on. Visitors will see the maintenance page instead of your site. People who can edit posts (and anyone with your access link or secret key) still see the real site, so log in before you test. Web hooks from other services (payments, newsletters) and the REST API are blocked for visitors unless you list their address under "Always allow these addresses". Page caches and CDNs can keep showing saved pages without asking WordPress, so some visitors may still see the real site, or keep seeing the maintenance page afterwards: exclude this site from them while this is on and clear them after you switch it on or off (the module warns you when it sees a cache).

Getting back. Log in at wp-login.php (it is never blocked) and switch the module off. Without dashboard access, run wp awc toolkit disable maintenance_mode or add define( 'AWC_DISABLE_MODULES', 'maintenance_mode' ); to wp-config.php.

SVG Upload#

svg_upload. Lets the roles you choose upload SVG images. Every SVG is cleaned of scripts and outside links before it is saved, and a file that cannot be cleaned is refused.

Before you switch it on. SVG files are code. This module cleans each one on upload and refuses files it cannot clean, but only allow the roles you trust. SVG files already in your Media Library are not changed unless you clean them from the Media Library bulk actions. Animated SVGs lose their animation.

Getting back. Switch the module off (Modules page, or wp awc toolkit disable svg_upload). New SVG uploads stop at once; SVG files already uploaded keep working.

Every SVG is cleaned on every upload path, including uploads and sideloads, and a file that cannot be cleaned is refused rather than stored as it was.

Image Upload Control#

image_upload_control. Shrinks oversized photos as they are uploaded and turns BMP and non-transparent PNG files into JPG to save disk space. The original upload is replaced.

Before you switch it on. From now on, new pictures you upload are replaced by a smaller copy, and the original is not kept. Pictures already in your Media Library are not touched. This cannot be undone for pictures uploaded while the module is on; keep your originals if you need them, or add "-nr" to a file name to skip it.

Getting back. Switch the module off (Modules page, or wp awc toolkit disable image_upload_control). New uploads are then left as they are. Pictures that were already shrunk stay shrunk.

Media Replacement#

media_replacement. Replace a file in the Media Library with a new one while keeping its ID, address, title and date, so no links break. The old file is kept for 7 days so you can undo.

Before you switch it on. Replacing a file changes it everywhere it is used on your site. With the option below on, the previous file is kept for 7 days so you can undo; with it off, a replacement cannot be undone.

Getting back. Use "Undo replace" on the replace screen within 7 days, or restore the file from a backup. Switching the module off does not bring old files back. The kept copies stay for up to 7 days even if you switch the module off, so switch it back on to use "Undo replace".

admin_menu_organizer. Reorder the admin menu by dragging, rename items and tuck away the ones you do not use, for everyone or for chosen roles.

Before you switch it on. This changes the left-hand admin menu for everyone, or for the roles you choose. Hidden items are only tucked away: they still work when opened by address, and a "Show hidden menu items" link at the bottom of the menu brings them back. The Dashboard and the AllWPCare menu can not be hidden.

Getting back. Use the "Show hidden menu items" link at the bottom of the menu, or press Reset on the Menu Organizer page. If the admin ever looks wrong, add define( 'AWC_DISABLE_MODULES', 'admin_menu_organizer' ); to wp-config.php, or run: wp awc toolkit disable admin_menu_organizer.

Multiple User Roles#

multiple_user_roles. Lets you give one person several roles at once from the Edit User and Add New User screens (for example Editor and Shop manager).

Before you switch it on. A person with several roles gets every permission from all of them added together. Check each combination before you save it. You can only hand out roles you are allowed to manage, you cannot change your own roles here, and the last administrator always keeps the role.

Getting back. Switch the module off (Modules page, or wp awc toolkit disable multiple_user_roles). Extra roles already given stay on the people, but the Edit User screen goes back to showing one role. To remove an extra role use wp user remove-role <user> <role>.

Extra roles are stored as normal WordPress roles on the user. You cannot change your own roles here, and the last administrator always keeps the role.

View Admin as Role#

view_admin_as_role. Lets you see the dashboard and your site exactly as an Editor, Author, Customer or any other role would, then switch back with one click. Your own account is never changed.

Before you switch it on. While you view the site as another role you have only that role's permissions: you cannot reach this plugin's settings or most of the admin until you switch back. Things you create are still saved under your own name. Use the "Switch back" button that stays on every page, or log out and in again: your own account is never changed.

Getting back. Click "Switch back" (bottom left of every page and in the top bar), or log out and log in. Switching the module off, or adding define( 'AWC_DISABLE_MODULES', 'view_admin_as_role' ); to wp-config.php, ends every view immediately. Nothing is changed in your account, so there is nothing to repair.

Works by emulating the role's capabilities for the current request. Your own account and role are never changed in the database.

Plugins and Themes Rollback#

plugins_themes_rollback. Go back to an earlier version of a plugin or theme when an update broke something (or move to a later one) from one screen, with a log of what was changed. Only for plugins and themes from WordPress.org.

Before you switch it on. This adds a screen that can replace the files of any plugin or theme from WordPress.org with another version. An older version can break your site or leave its saved data in a form the old code does not understand. Make a backup before you use it. Only files from downloads.wordpress.org are ever installed.

Getting back. Switching the module off removes the screen but does not undo a rollback. If a rolled-back plugin breaks the site: WordPress shows a recovery link by email, or deactivate it from the Plugins screen, or run wp plugin install <slug> --version=<version> --force (or the latest version) in a terminal.

The only outgoing requests are to WordPress.org (api.wordpress.org to look up versions, downloads.wordpress.org to fetch them). Nothing you type becomes an address.

Disable All Updates#

disable_updates. Turns off WordPress, plugin and theme update checks, automatic updates, update notices and update emails. Pick only the parts you need.

Before you switch it on. Without updates your site stops receiving security fixes and will become easier to hack over time. If you only want to stop automatic installs, switch off just "Automatic updates" and keep the rest unticked. Continue?

Getting back. Switch this module off here, run wp awc toolkit disable disable_updates, or add define( 'AWC_DISABLE_MODULES', 'disable_updates' ); to wp-config.php.

Disable XML-RPC#

disable_xmlrpc. Turns off the XML-RPC endpoint, trackbacks and pingbacks that attackers probe.

Before you switch it on. Anything that talks to your site through XML-RPC stops working: the WordPress mobile app, Jetpack, some publishing tools and older apps. Pingbacks and trackbacks stop too. If you use any of these, leave this off.

Getting back. Switch the module off (Modules page, or wp awc toolkit disable disable_xmlrpc), or add define( 'AWC_DISABLE_MODULES', 'disable_xmlrpc' ); to wp-config.php. The connection works again at once.

Disable REST API#

disable_rest_api. Only logged-in people can use the REST API (wp-json), and the links that advertise it are removed from your pages.

Before you switch it on. Visitors can no longer use the REST API. Contact forms, shop carts, search boxes, embeds, the mobile app and any site that reads your content from outside may stop working until you add them to the list of public parts. Logged-in people and apps that sign in keep working.

Getting back. Add the part that broke to the list, switch the module off (Modules page, or wp awc toolkit disable disable_rest_api), or add define( 'AWC_DISABLE_MODULES', 'disable_rest_api' ); to wp-config.php.

On a multisite network#

SVG Upload, Disable All Updates, Custom Admin CSS and Custom Frontend CSS can only be turned on or changed by a network administrator. A site administrator sees why and can still turn them off.