Break glass

Break glass

Being permanently locked out of your own site is also a security failure. Erfort ships two ways back in, and neither is a backdoor: both require access you would already need to own the site.

If you can still reach a shell

wp erfort off      # stand every lockout protection down
wp erfort on       # restore them
wp erfort status   # read the current state, changes nothing

wp erfort off disables the login guard, two-factor, and the idle-timeout logout. The passive protections (probe block, headers, version cloak) stay on, because they cannot lock anyone out.

If you cannot reach a shell but can edit files

Add this to wp-config.php:

define( 'ERF_SHIELD_OFF', true );

Same effect, and it survives a database that is not cooperating. Remove the line once you are back in.

The constant keeps its original ERF_SHIELD_ name even though the plugin is now called Erfort. Renaming a live constant would lock out exactly the people who need it most.

Locked out by two-factor specifically

Every enrolment generates ten single-use recovery codes. If those are gone too, use break glass above, then reset enrolment from your profile screen.

Locked out by the login guard

Lockouts are stored as transients and expire on their own after fifteen minutes. If you can wait, waiting works.

Do not test break glass on production

Turning protections off on a live site to "see if it works" leaves that site unprotected for as long as you forget to turn them back on. wp erfort status is read-only and safe.