Escuder Maintenance

FAQ

Can I lock myself out?

The real wp-login.php page and ordinary administration remain available. Sign in with an account that has manage_options to view the site or change the IP list. Editors, authors and subscribers do not automatically bypass maintenance. If necessary, deactivate the plugin through WordPress or WP-CLI and purge caches.

For emergency recovery, add define( ‘ESCUDER_MAINTENANCE_BYPASS’, true ); in wp-config.php before WordPress loads. Remove it or set it to false after recovery. This is a server configuration constant, not a query parameter or public bypass link.

What does Add my IP do?

It adds the REMOTE_ADDR address seen by WordPress to the unsaved list. Click Save changes to apply it. The plugin does not contact an external IP lookup service. A public IP may change, and everyone sharing an allowed public IP can view the site. Ranges, ports and comments are not accepted.

Does this work behind Cloudflare or a reverse proxy?

Your host must restore the real visitor address from trusted proxies. The plugin deliberately ignores X-Forwarded-For, Forwarded, CF-Connecting-IP and similar visitor-supplied headers. Never allow the common IP of a proxy or CDN as a workaround: it could let every visitor in.

Are REST, feeds and public Ajax blocked?

Yes, when the request reaches the plugin and the visitor is not authorized. The same standalone HTML 503 page is returned, including for APIs. Authenticated administrators and allowed IPs can pass the maintenance gate, but native permissions and REST nonce checks still apply. Cron and WP-CLI remain available; scheduled tasks are not paused. Other plugins handling requests before this gate are outside its control.

Are uploaded images and PDFs private?

No. Direct static-file URLs are handled by the web server and may remain accessible. Use server or proxy access control for confidential staging sites.

Why can I still see the site after enabling maintenance?

You may be signed in as an administrator, using an allowed IP, or seeing a cached page. Test while signed out on a different network. Disable and purge full-page caches at every layer, including the host and CDN. Check whether the emergency bypass constant is enabled.

How are languages handled?

The interface follows WordPress and the administrator’s language. Default public messages follow the request locale; customized title and message are plain text in the language you enter. French and Spanish fallback translations are included. Official WordPress.org language packs take priority. The plugin does not change your WordPress language or indexing settings.

Can I change themes?

Yes. Configuration and the standalone maintenance page are independent of your theme and page builder.

What happens on deactivation, reactivation and deletion?

Deactivation stops maintenance and keeps settings. Reactivation keeps the page and IP list but turns maintenance off, so enabling a plugin cannot unexpectedly close a site. Deletion through WordPress removes this plugin’s settings and stored IP list. It never deletes uploaded logos, pages or media. Purge external caches after deactivation as well.

Is multisite supported?

Network activation is deliberately refused. Activate separately on each site if needed; settings belong to that site. This first release has not been validated on a real multisite network. Deletion removes plugin options across the network.