# WordPress site lockdown: sign others out and freeze changes How to lock down a WordPress site in one step: who is signed out, what is frozen, what visitors see, how to lift it and how to check it worked. By M Asif Rahman, Oct 28, 2026. Updated Nov 5, 2026. A WordPress site lockdown is one switch that signs everyone else out of the dashboard and freezes installs and updates, while visitors see the site exactly as before. BetterShield calls it **Lock the Site Down**, and it sits at the bottom of **BetterShield › Protection › Recovery**, in the card named **Emergency lockdown**. This guide covers what it does, what it leaves alone, when to use it, how to lift it and how to check it is on. It belongs to the hour when you think someone else holds a dashboard session, and it follows the same logic as [signing everyone out of WordPress](/blog/wordpress-force-logout-all-users/) and the first steps in [WordPress security incident response](/blog/wordpress-security-incident-response/). Lockdown is the heavier option of the three: it ends sessions and also closes the doors that let a new change in. ## Quick summary - **Lock the Site Down** signs out every other dashboard session, refuses sign-ins from accounts that cannot manage the site and freezes plugin, theme and core installs and updates. - The front end stays open. Visitors see no change, and a WooCommerce checkout keeps working. - It never expires. It stays on until somebody presses **Lift the Lockdown**. - Your recovery link or a recovery code pauses it for an hour if you are locked out yourself, and it comes back when safe mode ends. - Turning it on and lifting it both write an entry to the activity log, and the entries are emailed to your alert recipients. ## Why a lockdown helps When something looks wrong, the first problem is that the site keeps changing while you look at it. Another administrator signs in, a plugin updates, a colleague installs something to help. Each change makes it harder to tell what was there before. A lockdown stops the changing. It does not find anything, remove anything or tell you what happened. It gives you a quiet site to look at: the same files, the same accounts and the same settings from the minute you pressed the switch until you lift it. The longer guides on [WordPress hardening](/blog/wordpress-hardening/) and [recovery mode](/blog/wordpress-recovery-mode/) cover what to do before and after. ## What it does While the lockdown is on, BetterShield: - **Signs out every other dashboard session,** including yours on other devices. Every account that can edit posts is signed out, and on multisite super admins too. The session you pressed the switch from is kept. One press reaches up to 500 accounts. - **Refuses sign-ins from every account that cannot manage this site.** Those people see a plain message that the site is temporarily closed to sign-ins. Their password is not counted as wrong, so nobody is locked out when the lockdown ends. - **Turns off XML-RPC and application passwords.** - **Pauses AI assistant connections, connected apps and BetterShield Hub** until you lift it. - **Stops new registrations** through WordPress’s own sign-up and a store’s My Account form. An account made at checkout is left alone. - **Stops installing or updating** plugins, themes and WordPress itself from the dashboard, administrators included, and closes the file editors. Automatic background updates you switched on in WordPress still run, because a person does not make them. ## What it leaves alone - **The front end.** Nothing here touches what visitors see. - **Accounts that cannot edit posts,** such as subscribers and a store’s customers, keep the sessions they already have. - **Deactivating and deleting plugins,** so you can remove what you find. - **Administrators’ sign-ins.** The people who manage the site can still get in to look around. ## When to use it, and when not to Use it when you believe someone else holds a dashboard account or session: an administrator you do not recognize, a change nobody on the team made, or an incident that points at a signed-in account. The order is lock down, look, remove what you find, then lift it. It is too much when one account is the concern. Press **Sign Out All Their Sessions** for that account under **Who is signed in** on Login & Access, and ask its owner to choose a new password. The [sessions guide](/docs/sessions/) explains both buttons. If the fix is an update, remember that updates are frozen: lift the lockdown, update, and lock down again if you still need to. | Site | What we recommend | |---|---| | Blog or brochure site | Use it freely. Only staff sign in, and they sign in again afterwards. | | Store (WooCommerce) | Orders keep coming in, but customers cannot sign in to their accounts, and neither can staff such as Shop Managers unless their role can manage the site. Keep it as short as you can. | | Membership or course site | Members cannot sign in for as long as it is on. Lift it as soon as you are done. | | Agency or many sites | It is per site. Lock down only the site with the problem. | ## Lock the site down Check that your recovery link works before you press anything. The [recovery setup guide](/docs/set-up-recovery/) shows how, and [locked out of WordPress](/blog/locked-out-of-wordpress/) covers the way back in if it goes wrong. 1. Open **BetterShield › Protection › Recovery** and scroll to **Emergency lockdown**. 2. Press **Lock the Site Down**. The confirmation says that it signs everyone else out of the dashboard and stops installing or updating plugins and themes from it until you lift it, and that visitors see no change. 3. Press **Yes: Lock This Site Down**. It takes effect at once. **Cancel** changes nothing. With **Ask for my password before removing a protection** on under **BetterShield › Settings › General** (see [asking for a password before a protection is removed](/blog/wordpress-confirm-before-removing-protection/)), both turning the lockdown on and lifting it ask for your password. Neither can be done with an application password. From the terminal, `wp bettershield lockdown` reports whether one is on and since when. `wp bettershield lockdown on --user=` and `off` change it. Run from the terminal, `on` signs out every dashboard session, your own included, because there is no browser session to keep. The full list is in [WP-CLI commands](/docs/wp-cli-commands/). ``` wp bettershield lockdown wp bettershield lockdown on --user=admin wp bettershield lockdown off --user=admin ``` An AI assistant can propose a lockdown too. An assistant you allowed to change the site applies it once you agree in the conversation, and any other caller waits for approval under **Agents › Requests**. Only the site can lift a lockdown. ## Check it is working - The card’s badge reads **Locked down**, and it says the site has been locked down since the time you pressed the switch and stays that way until you lift it. - On the Recovery tab, the **Lockdown** tile reads **On**, with the time it began. - Open a private window and try a subscriber’s sign-in. It should be refused with the closed-to-sign-ins message. - In the activity log you will see **Site locked down** (Critical), and later **Site lockdown lifted** (High). With instant alerts enabled, both are emailed to your alert recipients as they happen. See [email alerts](/docs/email-alerts/). ## What it can break, and how to undo it - **Editors, authors and other staff** are signed out and cannot sign in again until it is lifted. - **Tools that use XML-RPC or application passwords,** such as the WordPress mobile app or a connected service, stop working. - **Updates and installs** are refused, and WordPress’s own registration is closed. - **Connected assistants and the Hub** are paused and resume when you lift it. To undo it, press **Lift the Lockdown**. The confirmation says every account can sign in again and everything the lockdown paused resumes. Sign-ins, registrations, updates, XML-RPC and application passwords come back at once. Sessions that were ended stay ended, so people sign in again with their usual password. If you are locked out yourself, your recovery link or a recovery code starts safe mode, which stands the lockdown down for that hour. It comes back when safe mode ends, so sign in and lift it during that hour. Otherwise it starts again. ## On multisite Each site has its own switch, and throwing it on one site leaves the others open. It still signs out the network’s super admins, because their sessions reach this site too. The network’s recovery link stands a lockdown down on every site for its hour. See the [multisite security guide](/blog/wordpress-multisite-security/) for the wider picture. ## After the lockdown A lockdown is the start of a review, not the end of one. While it is on, look at the people and the files: who has an administrator account, which plugins were changed recently, and what the activity log shows around the time you became concerned. The [incidents guide](/docs/incidents/) explains how BetterShield groups related records, and [WordPress’s own security documentation](https://developer.wordpress.org/advanced-administration/security/hardening/) covers the steps that apply to any site. When you have removed what you found and changed the passwords that matter, lift the lockdown and watch the activity log for the next day. ## Frequently asked questions ### Does a WordPress site lockdown take my site offline? No. The front end stays as it was, so visitors see no change and a WooCommerce checkout keeps working. What closes is the administrative side: other dashboard sessions end, accounts that cannot manage the site cannot sign in, and installs and updates are frozen. ### How long does a lockdown last? Until somebody lifts it. It never expires on its own, so lift it as soon as you have finished looking, especially on a store or membership site where customers and members cannot sign in while it is on. ### Can I still sign in during a lockdown? Administrators can sign in, because the lockdown refuses only accounts that cannot manage the site. If you are locked out of your own account, use your recovery link or a recovery code. It pauses the lockdown for an hour, and you can lift it from the Recovery tab in that hour. ### Does a lockdown remove malware or fix the problem? No. It freezes the site so you can look, and it signs out sessions. It does not scan, clean or repair anything, and BetterShield is not a malware scanner. Removing what you find, changing passwords and checking the activity log is still your work. ### Is lockdown part of the free plugin? Yes. The lockdown, the recovery link and the WP-CLI commands are in the free [BetterShield plugin on WordPress.org](https://wordpress.org/plugins/bettershield/), with no account needed. ## Conclusion A site lockdown gives you a still site to look at: other dashboard sessions end, sign-ins from accounts that cannot manage the site are refused, and installs and updates wait, while visitors see nothing different. Press **Lift the Lockdown** when you are done, because it never expires on its own. BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). The full reference is the [Lock the site down](/docs/site-lockdown/) guide.