Recovery
Use read-only and paused
Emergency modes are the control you use when you do not yet know which agent is responsible. They apply site-wide and take effect at once.
- Recovery & emergency
- 4 min read
The three modes
| Mode | Effect | Use when |
|---|---|---|
| Normal | Configured policy applies as written. | Routine operation. |
| Read‑only | Anything that writes is refused. Reads continue, so diagnostics still work. | You suspect a problem and need to investigate without further change. |
| Paused | All governed requests are refused. | An incident is in progress, or you are handing the site to someone else. |
Read-only is the underused one. It stops the damage while leaving you able to see what is happening, which is usually what you actually want in the first ten minutes.
Modes only ever tighten
Emergency mode overrides an allow decision. It never overrides a refusal, and it cannot be used to widen access. Returning to normal restores exactly the policy you had configured — the modes do not rewrite your permission matrix.
Runtime verification tests this against a live request: paused refuses both a read and a write, read-only refuses the write while still allowing the read, and every refusal is recorded with its reason while the audit chain stays valid.
Site mode versus agent state
Site mode affects every agent. If you already know which agent is misbehaving, pause that agent instead — dropping the whole site to read-only stops six integrations to fix one.
Use site mode for exactly the case it is good at: you know something is wrong and you do not yet know what.
Every mode change is recorded
Entering and leaving a mode is an administrative event with who and when. During an incident review that timeline matters: it shows how long the exposure lasted and who closed it.
Emergency controls are identical in every edition. Scale and optional features differ between plans; the ability to stop does not.
Recovery & emergency
Keep the boundary while you fix the problem.
A good fix restores intended behaviour without creating a second path around WordPress or the governed request lifecycle.