Skip to content

Recovery

Recovery switches

Every planAbout Dashboard and Security Score

Three emergency switches you add to wp-config.php when a protection keeps you out of your own site. They turn the protection off until you remove the line.

What it does

SMG_DISABLE_LOGIN_GUARD turns off the custom login address and the sign-in policy, so /wp-login.php works again.

SMG_DISABLE_2FA turns off the two-factor step. Each user's two-factor setup is kept for later.

SMG_SAFE_MODE turns off everything that could keep you out: Login Guard, two-factor, lockouts, bans, country blocking, firewall rules, CAPTCHA and IP reputation checks. It also gives every administrator full access to Stack Guard, even one set to View Only or Hidden on the Access tab.

Why it matters

Strong protection can lock out the wrong person: a forgotten login address, a lost phone or a mistaken ban. These switches mean you can always get back in through your hosting account.

Use one

  1. Open wp-config.php in your site's main folder, using your host's file manager or an FTP program. Your host's support team can do this for you.
  2. Just above the line That's all, stop editing!, add one line, for example define( 'SMG_SAFE_MODE', true );, and save.
  3. Sign in at yoursite.com/wp-login.php. A red notice on every admin page reminds you that recovery mode is on.
  4. Fix the cause: note your login address, reset two-factor, lift the ban or add your address to the allow list.
  5. Remove the line from wp-config.php so the protections work again.

Settings marked "Test after changing"

Settings that can break the site or lock people out carry a yellow Test after changing marker. Point at it, or move to it with the Tab key, to see why. Examples: the custom login address, Require 2FA, country blocking, firewall rules, Content Security Policy in Enforce mode, HSTS, and automatic security key changes.

After you save a change to one of them, Stack Guard shows Test your site now. Open the site in a private window and check that you can sign in and that the pages you care about still work before changing anything else. Changing these one at a time means you always know which change caused a problem.

Good to know

Use the narrowest switch that solves the problem: SMG_DISABLE_LOGIN_GUARD for a lost login address, SMG_DISABLE_2FA for a lost phone, and safe mode only when you are not sure.

Your settings are not changed. Everything comes back the moment the line is removed.

Safe mode still records failed sign-ins; it just never locks anyone out.

Which plan includes it

The recovery switches work in every plan, so changing plans can never lock you out.

How it works, for developers
  • The constants are read by SMG_Core::is_disabled() and SMG_Core::is_safe_mode() before modules load, so the switched-off code never runs.
  • The notice uses admin_notices, is shown to users with manage_options, and names the constants that are set.
  • There is no setting or screen to turn these on: only someone with access to your server files can use them, which is what makes them safe.
  • The marked settings are listed once, in SMG_Risk::all(). The reminder is shown only to the person who saved, once, on the next Stack Guard page.

Quick answers about recovery switches

What does Recovery switches do in Stack Guard?

SMG_DISABLE_LOGIN_GUARD turns off the custom login address and the sign-in policy, so /wp-login.php works again. SMG_DISABLE_2FA turns off the two-factor step. Each user's two-factor setup is kept for later. SMG_SAFE_MODE turns off everything that could keep you out: Login Guard, two-factor, lockouts, bans, country blocking, firewall rules, CAPTCHA and IP reputation checks. It also gives every administrator full access to Stack Guard, even one set to View Only or Hidden on the Access tab.

Why use recovery switches on a WordPress site?

Strong protection can lock out the wrong person: a forgotten login address, a lost phone or a mistaken ban. These switches mean you can always get back in through your hosting account.

How do I set up recovery switches?

1. Open wp-config.php in your site's main folder, using your host's file manager or an FTP program. Your host's support team can do this for you. 2. Just above the line That's all, stop editing!, add one line, for example define( 'SMG_SAFE_MODE', true );, and save. 3. Sign in at yoursite.com/wp-login.php. A red notice on every admin page reminds you that recovery mode is on. 4. Fix the cause: note your login address, reset two-factor, lift the ban or add your address to the allow list. 5. Remove the line from wp-config.php so the protections work again.

Which Stack Guard plan includes recovery switches?

The recovery switches work in every plan, so changing plans can never lock you out.

Not running Stack Guard yet? It is free.

Download Free