Recover from a lockout

Use this page when SafeHouse keeps you out of your own site: you cannot log in, a form refuses you, or a module broke something and you cannot reach wp-admin to switch it off. The routes below go from the least to the most invasive. Start at the top.

If you are not an administrator of the site, contact the person who runs it. Only they can lift a lockout.

Check that SafeHouse is the cause

SafeHouse messages are specific. Compare what you see with this table.

What you see	Cause	Go to
"Too many failed login attempts from your address. Try again in 15 minutes."	Login limits locked out your address.	Wait or lift the lockout
"This account is paused for new devices after many failed attempts. Log in from a device you used before, or try again in an hour."	Login limits paused the account for browsers that never logged into it.	Wait or lift the lockout
"The anti-bot check did not pass. Please wait for it to finish and try again."	Bot protection: Cloudflare Turnstile did not confirm the form.	Troubleshooting
"This looks like an automated submission. Please make sure JavaScript is on and try again."	Bot protection's honeypot: JavaScript is off, or the form is not a standard WordPress or WooCommerce form.	Troubleshooting
A short "We will be back soon" page	Maintenance mode is on.	Log in at /wp-login.php; it always works.
"Installing plugins and themes is locked by SafeHouse. Unlock it first (SafeHouse in the admin menu or wp shouse unlock)."	Install lockdown	Unlock installs
A broken page or a critical error right after you changed a SafeHouse setting	A module, or one of its settings	Turn on safe mode

If the message mentions Wordfence, your host or your firewall, SafeHouse is not the cause.

Wait or lift the lockout

1. Wait. An address lockout tells you how many minutes are left. An account pause lasts one hour.

2. For an account pause, log in from a browser you used for this account before. It carries a device cookie and is not paused.

3. Ask another administrator to go to SafeHouse → Modules → Login limits → Details and select Lift all lockouts.

4. If you have WP-CLI access, lift the lockout yourself:

   wp shouse login unlock --all

   The command prints how many records it cleared, for example Success: 2 lockout record(s) cleared.

Switch off one module

When you know which module is in the way and you have WP-CLI, switch only that module off:

wp shouse module disable login_limits

The command prints Success: login_limits disabled. Module IDs are listed on Modules.

Without WP-CLI, you can force a module off in wp-config.php:

define( 'SHOUSE_MODULES', [ 'login_limits' => false ] );

Remove the line again once you have fixed the cause. While it is there, the module's switch on the settings page is locked.

Turn on safe mode

Safe mode stops every SafeHouse module at once, without changing any setting. Use one of these three ways. Each one is enough.

With WP-CLI:

wp shouse safe-mode on

The command prints Success: Safe mode on. and writes the change to the activity log.

With FTP, SFTP or your host's file manager:

1. Open the wp-content folder of the site.
2. Create an empty file named shouse-safe-mode there.

In wp-config.php:

1. Open wp-config.php.

2. Above the line /* That's all, stop editing! Happy publishing. */, add:

   define( 'SHOUSE_SAFE_MODE', true );

3. Save the file.

Reload the site. Every administrator now sees this notice on every wp-admin screen:

SafeHouse safe mode is on: every module is stopped. Remove wp-content/shouse-safe-mode or the SHOUSE_SAFE_MODE constant to resume.

On SafeHouse → Modules, modules that are switched on show Enabled, not running, and the header shows 0 of 15 running.

What safe mode stops and what keeps working

Safe mode stops:

• every module, with all its checks, alerts, cron jobs, settings panels and buttons
• the module WP-CLI commands, such as wp shouse login and wp shouse unlock
• the SafeHouse Redis object cache: WordPress uses its own cache meanwhile

Safe mode keeps:

• your settings, unchanged
• the SafeHouse settings page, so you can change settings while modules are stopped
• signed updates, so a fixed release can still arrive
• the core WP-CLI commands: wp shouse status, module, log, safe-mode, update-check and object-cache

Leave safe mode without getting locked out again

Fix the cause first, then turn safe mode off. Stay logged in while you do it.

1. Log in while safe mode is on. Login limits does not run, so nothing refuses you.
2. Fix what locked you out. For example, add your address to Never lock out these addresses in Login limits, set up the proxy in front of the site, or switch off the setting that broke a page.
3. Turn safe mode off in the same way you turned it on:
   • wp shouse safe-mode off (it removes both safe mode files; if SHOUSE_SAFE_MODE is still in wp-config.php, it warns "SHOUSE_SAFE_MODE is still defined in wp-config.php.")
   • or delete wp-content/shouse-safe-mode
   • or remove the SHOUSE_SAFE_MODE line from wp-config.php
4. While still logged in, go to SafeHouse → Modules → Login limits → Details and select Lift all lockouts. Lockouts recorded before safe mode are still there; this clears them.

The safe mode notice disappears. The header shows the usual number of running modules.

If the notice stays, look for a file named wphouse-safe-mode in wp-content. Sites that ran SafeHouse under its earlier name, WPHouse, may still have it, and it turns safe mode on too.

Last resort: rename the plugin folder

If none of the routes above is possible, rename wp-content/plugins/shouse to something else, such as shouse-off. WordPress then deactivates SafeHouse. Rename it back and activate SafeHouse again on the Plugins screen when you are done. Your settings stay in the database.

Prefer safe mode: it keeps signed updates running and does not need reactivation.

Prepare before you need this page

• Make sure you can reach the site's files (SFTP, FTP or a file manager) or run WP-CLI. Every route above needs one of them, unless another administrator can help.
• If you log in from a fixed address, such as an office, add it to Never lock out these addresses in Login limits.
• If the site is behind Cloudflare or another proxy, set that up first: Behind Cloudflare or a proxy. Without it, Login limits can mistake the proxy for one visitor.

Related pages

• Login limits
• Troubleshooting
• Command line reference
• Configuration constants