Recovery
Terminate sessions and credentials
Use this when the concern is the credential rather than the policy.
- Recovery & emergency
- 3 min read
What it does
- Invalidates the connection’s credentials.
- Terminates sessions connection-wide, not one at a time.
- Records the termination as an administrative event.
The ordering matters: credentials are invalidated before the connection state changes, so there is no window in which a session that started a moment earlier keeps working.
When to use it
- A credential may have leaked.
- Someone with access to it has left.
- You see activity from an agent you did not expect to be running.
- You are handing the site to a new owner.
- Before restoring a production backup onto a staging site.
Versus pausing
| Concern | Use |
|---|---|
| The agent is doing the wrong thing | Pause the agent — a policy problem |
| Someone else may hold the credential | Terminate sessions and rotate — a credential problem |
| Both, or you are unsure | Do both. They are independent. |
Stale sessions expire anyway
Sessions expire automatically during authentication and administration, so an abandoned session does not linger indefinitely. Termination is the deliberate version of that, for when waiting is not acceptable.
Recovery & emergency
Keep the boundary while you fix the problem.
A good fix restores intended behaviour without creating a second path around WordPress or the governed request lifecycle.