Description

Break-Glass Access — known in Dutch as Noodtoegang — gives a website owner a safe “emergency button”. The administrator chooses, in advance, one existing user (any role except administrator) who is allowed to make a full backup when it is really needed — for example when the regular web administrator is unreachable. That user keeps their own role and only receives one extra right: “make an emergency backup”. They never become an administrator.

The name is literal: like breaking the glass on a fire alarm, this is meant for the one moment when the normal route is closed.

In an emergency, the chosen user requests a code. The code is sent by email to that user’s own account address. After entering the correct code, a temporary emergency window opens with a single button. The plugin drives UpdraftPlus and makes a full backup of files and database. With that backup, a (new) web administrator can restore the site on another server and give the owner the right access there.

The emergency window closes automatically (you choose 2, 4 or 8 hours, and 1-5 code requests per day) and every step is visible in the activity log. In the free version the administrator is deliberately not emailed — activity is visible in the log. With Pro the administrator is emailed the moment emergency access is activated and when a backup is made, and can then contact the client. By design the administrator cannot interrupt a running emergency backup — this plugin protects the site owner precisely in situations where the administrator is unreachable or uncooperative.

Pro adds an “emergency passport”: the welcome email a user receives when they are granted emergency access becomes a keepsake document with everything needed to secure the site — login name, the address the mail was sent to, a login link (also when the login URL is hidden), a password-reset link and, if set, a masked phone number and a private email address. The real password is never included.

The free version is fully functional on its own and works everywhere without any account or key.

Backup tool

Break-Glass Access uses the free UpdraftPlus plugin to make the actual backup. UpdraftPlus is a required plugin: install and activate it in advance via Plugins Add New (the plugin also shows a reminder with a direct install link). The plugin never installs anything automatically.

A backup is powerful — handle it with care

Whoever has the backup file can log in on a restored copy of the site. Store and share backups carefully.

Pro version

There is also a paid Pro version (a separate premium plugin). It adds service-based delivery and convenience: up to 5 emergency users, SMS verification, an extra backup mail server so the code still arrives when your site cannot send email, email alerts to the administrator when emergency access starts and when a backup is made, an emergency passport in the welcome email, a configuration self-test, and an extra email address for the code. Everything in this free plugin is complete and stays fully functional regardless of Pro.

Pro pricing and details:

English — breakglassaccess.com/pricing
Nederlands — noodtoegang.nl/prijzen

Websites and documentation

English: breakglassaccess.com — how it works · documentation · support
Nederlands: noodtoegang.nl — het doel · documentatie · support
Recommended by KVWB — Keurmerk Verantwoord Webbeheer

External services

The plugin works fully standalone. The free version connects to no external service at all (apart from installing UpdraftPlus from WordPress.org, below). The following connections are Pro features and require an active licence:

Extra backup mail server (Pro; on by default when Pro is active, can be switched off under Settings Verification). If your site cannot send email itself, the plugin asks the Break-Glass Access service (noodtoegang.nl) to deliver the emergency code, so a broken site mailbox never locks the user out. When enabled and the administrator saves the plugin settings, the site registers its URL, a site secret and the emergency users’ email addresses with the service; in an emergency the code and recipient address are then sent over HTTPS. The service only mails pre-registered addresses and does not log codes. Switch it off and no data is sent to the service. See https://noodtoegang.nl/privacyverklaring/ for the privacy policy.
SMS verification (Pro; off by default, switched on under Settings Verification). With an active licence and SMS enabled, the site registers its URL, a site secret and the chosen phone number with the Break-Glass Access service (noodtoegang.nl). In an emergency the site then sends only the site URL and the emergency code, signed; the service composes the text itself and sends it to the registered number only. The plugin never transmits a free-text message or an arbitrary number, and the service does not log codes.
WordPress.org. UpdraftPlus (the required backup tool) is installed by you from the official WordPress.org plugin directory, using the standard WordPress plugin installer, only when you choose to install it. The plugin never installs anything automatically. This applies to both the free and Pro versions.

No data is sent to any service without the actions described above. There is no tracking or telemetry.

For developers

Capability kvwb_make_backup — granted per user to the chosen emergency user (no separate role).
Filter kvwb_nt_trigger_backup — take over how the backup is triggered.
Filter kvwb_nt_purchase_url — change the URL of the “View Pro” button.
Filter kvwb_nt_mail_logo_url — set a logo for the plugin’s emails (empty by default: the free plugin loads no external image when a recipient opens an email; the emails use a text header instead).
Filter kvwb_nt_send_sms — short-circuit the SMS request ($pre, $type, $code; return true/false), for local testing or a custom gateway. The plugin never sends the phone number or the message text itself: the service holds the registered number and composes the text.
Filter kvwb_nt_sms_endpoint / constant KVWB_NT_SMS_URL — override the SMS service endpoint (HTTPS only).
Filter kvwb_nt_send_failsafe_mail — short-circuit the backup email delivery (return true/false), for local testing.
Filter kvwb_nt_mail_endpoint / constant KVWB_NT_MAIL_URL and filter kvwb_nt_register_endpoint / constant KVWB_NT_REGISTER_URL — override the backup delivery endpoints (HTTPS only).
Constant KVWB_NT_DEV (wp-config.php; local testing ONLY) — shows the emergency code on screen so you can test without working email.

Screenshots

Settings: choose the emergency user, see how the code is delivered, and check at a glance that everything is ready for an emergency.

Times and limits: how long an emergency session stays open (2, 4 or 8 hours) and how often a code may be requested per day, with a readiness check alongside. — Settings: choose the emergency user, see how the code is delivered, and check at a glance that everything is ready for an emergency.

Installation

In WordPress, go to Plugins Add New Upload Plugin.
Choose the plugin ZIP file and activate the plugin.
Go to “Break-Glass Access” Settings.
Under “Emergency user”, choose the user who may make an emergency backup.
Optionally set the notification email address.
The chosen user then sees the “Break-Glass Access” menu in their own dashboard.

FAQ

Does the emergency user become an administrator?: No. The emergency user keeps their own role and only receives the right to make a backup. They never gain administrator rights.
Does it work without a paid licence?: Yes. The free version — including the full emergency backup — works everywhere without any account or key.
Which backup tool is used?: UpdraftPlus. It is a required plugin — install and activate it in advance via Plugins Add New. The plugin shows a reminder with a direct install link but never installs anything automatically.
Is any data sent to an external service?: Not in the free version. The free version never sends any data to an external service; every emergency code is delivered through your own site email only. The extra backup mail server and SMS delivery are Pro features (see the “External services” section below), and only send data when you have an active Pro licence and have enabled them. There is no tracking or telemetry. Installing UpdraftPlus uses the standard WordPress plugin installer.

Reviews

pixelsz August 24, 2026

Een overzichtelijke plug-in die een belangrijk gemis binnen webbeheer opvult. Hij stelt het eigendom van ons als website-eigenaar veilig. In geval van nood kunnen we nu altijd een volledige back-up maken en eventueel verhuizen.

Read all 0 reviews

Contributors & Developers

“Break-Glass Access – Emergency Backup (Noodtoegang)” is open source software. The following people have contributed to this plugin.

KVWB

Translate “Break-Glass Access – Emergency Backup (Noodtoegang)” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

0.9.21

Fixed (Pro, important): three Pro features silently did nothing because the premium module read a settings key that does not exist (emergency_user_ids instead of emergency_user_id). The emergency passport discarded the phone number and private email on save, the mail failsafe registered no recipients at all, and the self-test always reported “no emergency user set”. All three now work.
Fixed (Pro): the emergency passport fields (phone, private email) are now also shown for the extra emergency users, not only for the first one.
Changed (Pro): registering this site with the service now waits for the answer and stores the result. A failed registration is visible in the self-test and in the service status block, instead of failing silently. This matters because the service only delivers to what was registered in advance.
Fixed (Pro): a crafted settings POST could cause a PHP error while saving the extra email address.
Fixed (Pro): saving settings could emit PHP warnings on PHP 8, which broke the redirect after saving on sites with debug display enabled.

0.9.20

Pro: SMS delivery now works end to end. The phone number is registered with the service in advance and the service composes the message itself — the plugin no longer sends a phone number or free text, and every request is signed. This makes it impossible for a leaked licence key to be used to send SMS to arbitrary numbers.
Pro: the site now also registers with the service when only SMS is enabled (previously only when the mail fallback was on).

0.9.19

Changed: the plugin is now called “Break-Glass Access – Emergency Backup (Noodtoegang)”, so it can be found under all the names it is known by. Nothing else changed for existing installations.
Fixed: the Pro panel said 7 days money-back; the actual guarantee is 14 days.
Added: direct links to the English and Dutch project websites.

0.9.18

Removed: remote revocation of emergency access (the Pro service endpoint and all related code and texts). Reason: being able to withdraw access from a distance conflicts with the plugin’s core promise that the site owner can always secure their own site. An administrator can still remove an emergency user locally in the settings.
Under the hood: the uninstall cleanup now lives in a shared cleanup.php, used by both uninstall.php (WordPress.org build) and the Freemius after_uninstall hook (premium build).

0.9.17

Compliance (WordPress.org review): the activity log is now fully visible in the free version. The events were already stored locally; hiding the view behind Pro is not allowed (guideline 5).
Compliance: the session duration (2/4/8 hours) and the daily code limit (1-5) are now normal, free settings.
The free plugin is now single-emergency-user by design: one plain setting, no capped or hidden multi-user code. Support for up to 5 emergency users is provided entirely by the separate Pro plugin.
Privacy: plugin emails no longer load a remotely hosted logo, so opening an email triggers no request to any external server. The emails now use a text header; a site-own logo can still be set with the kvwb_nt_mail_logo_url filter.
The Pro pop-up no longer opens automatically; it only opens when a Pro button is clicked.
Code polish (Plugin Check): removed the manual textdomain loading (WordPress loads translations automatically), renamed internal constants to the plugin prefix, and the daily-limit counter now uses a single user-meta key — the uninstall routine no longer needs a direct database query.

0.9.14

Compliance: the free build now contains no Pro/service code at all. All external-service code (SMS delivery, the backup mail-server failsafe, and remote revocation) has moved to the premium-only module, so the free version never makes an external call — every emergency code is delivered through your own site email (wp_mail) only.
Compliance: removed all licence checks and locked/disabled Pro fields from the free settings screen. Pro features are now shown as a clear, static feature overview with an upgrade link (no non-working fields).
Changed: display name is now “KVWB Break-Glass Access”.
Changed: UpdraftPlus is no longer installed or activated automatically. It is now declared as a required plugin (Requires Plugins header, WordPress 6.5+) and the plugin shows an admin notice with a direct install link.
Changed: the emergency backup temporarily forces UpdraftPlus to include all components, then restores your original UpdraftPlus settings when the backup completes (previously these were overwritten permanently).
Improved: all inline scripts and styles are now enqueued properly (wp_enqueue_script/style, wp_add_inline_script/style); hardcoded paths replaced with WordPress functions (wp_upload_dir, WP_PLUGIN_DIR, get_theme_root, and UpdraftPlus’ own backup directory).
Improved: the admin menu no longer sits above WordPress core items; removed the manual textdomain loading (WordPress loads translations automatically since 4.6).
Fixed: the disk-space warning email now goes to the configured notification address.

0.9.13

Redesigned settings screen: a calm “readiness panel”. One clear status line at the top answers the key question — “if something happens today, will everything work?” — followed by four numbered steps (who, delivery, times, notifications).
New: emergency users are now shown as person cards with their role, delivery method and (Pro) the completeness of their emergency passport.
New (Pro): the phone number and private email address for the emergency passport can now be entered per emergency user in the settings — previously these could only be set in code.
Improved: session duration and daily limit are now segmented buttons that show all options at a glance, including the honest “2 hours — minimum”.
Fixed: the “Log” tab no longer shows a permissions error in the free version; it now explains that the activity log is a Pro feature.
Fixed: saving the settings in the free version no longer silently switched off the extra backup mail server default; upgrading to Pro now starts with the recommended setting enabled.
Fixed: the Pro administrator notification “a backup has been made” is now sent when the backup has actually completed (and only once), instead of when it starts.
Fixed: emails on non-Dutch sites now link to breakglassaccess.com (was a non-existent domain).
Improved: uninstalling the plugin now also removes the disk-space warning options, cached size estimate, daily-limit counters and emergency-passport user data.

0.9.12

New Pro feature “Emergency passport”: the welcome email a user receives when granted emergency access can become a keepsake document with everything needed to secure the site (login name, delivery address, login link — also with a hidden login URL — password-reset link, and an optional masked phone number and private email). The real password is never included.
Changed: administrator notifications are now a Pro feature. In the free version the administrator is not emailed at all (activity stays visible in the log); with Pro the administrator is emailed the moment emergency access is activated and when a backup is made. Both notifications live in the premium module, so the free build stays free of locked local code.
Changed: the extra backup mail server (delivery via the Break-Glass Access service) is now a Pro feature. The free version sends no data to any external service and delivers every code through your own site email only. Strongly recommended for Pro users, so emergency emails always arrive even if your site email breaks.
Changed: the activity log is now a Pro feature and no longer appears in the menu of the free version.
The free version shows the Pro features as clearly-labelled benefits (in the welcome email and the dashboard banner).

0.9.11

Removed the per-session “emergency stop” entirely (feature and all texts). By design the administrator cannot interrupt a running emergency backup: this plugin protects the site owner precisely when the administrator is unreachable or uncooperative. The administrator is notified by email when access starts and when a backup is made, and can contact the client.

0.9.10

Clearer settings screen: the fields you can adjust are now highlighted in a light colour, with a small legend, so it is easy to see what is editable versus Pro-only.

0.9.9

The emergency screen now shows the session length and how many code requests are allowed per day, and (with Pro) all destinations including a masked phone number.
Refreshed the “More protection with Pro” panels with a lighter look.
Fixed a display issue where the dropdown arrow could repeat across select fields.

0.9.8

Pro: the minimum session duration is now 2 hours (was 1 hour). An administrator can no longer set the emergency window shorter than a backup realistically needs; the core enforces the same lower bound for any external code.
Clearer edge case: with an active Pro licence on the free build, the settings now explain that the Pro version needs to be installed, instead of showing greyed-out preview cards.

0.9.7

Security hardening: downloading a backup now requires an active emergency session for the emergency user (an administrator can always download). This prevents a designated emergency user from downloading backup files outside an emergency window.
Backup delivery via the service is now an explicit option (on by default) that can be switched off. When it is off, no data is sent to the delivery service at all. This makes the external connection transparent and fully under the administrator’s control.
The remote-revocation REST endpoint now performs its HMAC-signature check in a real permission callback instead of allowing the request through and checking inside the handler.
Removed the unused “emergency function disabled / access taken over” state, a leftover from the old flow in which the emergency user temporarily became an administrator. The emergency user never becomes an administrator.

0.9.6

Completely redesigned admin interface: flat, sharp-cornered design with hairline borders, a consistent spacing grid, a fixed 170px label column so every field and hint aligns, tab navigation (Settings / Log / Guide), a system-status sidebar and a save bar.
The emergency page now shows a step indicator (request – enter – backup) and tells the emergency user to which email address(es) the code will be sent.
Fixed: the Pro self-test button no longer sits in a nested form (it could hijack the settings save in the premium build).

0.9.5

Backup delivery is now a fixed safety feature: there is no setting anymore, so a (former) administrator can never block the delivery of emergency codes. Documented under “External services”.
Simpler emergency page: one button sends the code via the site’s own email. If nothing arrives, the emergency user ticks “I did not receive a code” and a new code is automatically delivered via the backup delivery service — no technical choices needed.
Complete Dutch (nl_NL) translation: all texts added in 0.9.1–0.9.5 are now translated, and internal log entries are now written in the site language instead of hard-coded Dutch.

0.9.4

Backup delivery is now enabled by default (visible in the settings, can be disabled). A site owner who never touches the settings still gets rescue delivery when their site email is broken. Registration with the service only happens when the administrator saves the settings — never silently.
The emergency user now chooses the delivery route when requesting a code: via the website’s own mail server (default) or via the noodtoegang.nl delivery service.

0.9.3

New: “No email received?” link on the emergency page. Sends a NEW code — covers silent mail failures and spam-folder problems. The previous code is invalidated, the usual cooldown applies and everything is logged. Delivery via the backup delivery service is a Pro feature; the free version re-sends via your own site email.
New (Pro): “Always deliver the code via the service” — codes are always sent from the Break-Glass Access service for maximum deliverability, with automatic fallback to your own site email if the service is unreachable. The rescue core never depends on the service alone.
Delivery order is now explicit: own site email first (default), service as backup; or service first (Pro option) with site email as backup.

0.9.2

New (free, opt-in): backup email delivery. If your site cannot send email itself, the Break-Glass Access service delivers the emergency code — so a broken mail configuration no longer blocks the emergency button. Off by default; documented under “External services”.
New (free): early warning on the settings page when the plugin’s emails fail (welcome email, disk-space alert), with a tip to install an SMTP plugin. You find out long before an emergency.
The plugin never asks for or stores email passwords. For a site that cannot send mail, use an SMTP plugin or the backup delivery service.
Free version now shows honest, disabled previews of the Pro features (times and limits, extra email address, self-test, up to 5 emergency users).
Added the “External services” section to this readme.

0.9.1

Premium features restructured for the Freemius model: local premium code now lives in a separate /premium/ module that is not part of the free build. No locked code in the free version.
Service-backed Pro features (SMS verification via the Break-Glass Access service, remote revocation from the portal) are shipped as connector code, unlocked by an active licence — the service does the actual work.
Remote revocation endpoint secured with per-site secret, HMAC-SHA256 signature and a 5-minute timestamp window.
Uninstall now correctly removes the emergency-backup capability for all configured emergency users.

0.9.0

Public free release for the WordPress.org Plugin Directory.
The free version is fully self-contained: the emergency backup works everywhere without any account, key or external connection.
The emergency code is sent by email to the emergency user’s own account address.
Premium features (up to 5 emergency users, SMS verification, adjustable times and limits, remote revocation, self-test, extra email address) are available separately as Break-Glass Access Pro.

0.8.x

Welcome email when a user is added as an emergency user.
Consistent sender name for all plugin emails (the sending address stays your site’s, so SPF/DKIM are unaffected).
Disk space check with a clear status tile in the settings overview.
The emergency user can close the emergency window themselves; the plugin warns if the backup was not downloaded yet.

0.7.x

Emergency access is granted per user ID (not a capability), so the menu always appears for the chosen user.
User guide page with clear, step-by-step instructions.

0.5.x

The emergency user no longer becomes an administrator; the backup is made with their own role.
Exactly one backup per request; the download list shows only the newest, complete backup set.
Forces all UpdraftPlus components plus the database so a backup is never empty; one-click combined ZIP download.