HOME / RECOVERY
Recovery that works when wp-admin doesn’t
The worst failures take the admin down with the site. FaultPilot’s recovery architecture is built for exactly that moment: Safe Mode isolation, single-use signed recovery links, recovery points and verified treatments.
The sequence
From failure to verified recovery
This is the recovery flow FaultPilot performs for a plugin or theme fatal — including one that breaks wp-admin entirely.
A component takes the site down
A plugin fatal at bootstrap, a theme fatal during rendering — front-end and wp-admin may both be gone.
FaultPilot catches the incident
Observation runs before plugins load on recovery paths; the failure is fingerprinted, grouped and attributed even if the admin never rendered.
The single-use recovery link
A previously generated link — 256-bit random, HMAC-SHA256 hashed at rest, expiring in 24h, rate-limited per IP — arms Safe Mode. The link is the credential for exactly one action.
Problematic component isolated
The drop-in reads its quarantine option and filters the active plugin list. No secrets inside, no remote commands accepted; deleting the file disables the feature entirely.
Rollback to a recovery point
If the incident traces to an update, the pre-update recovery point — captured automatically before the change — restores the previous plugin set.
Health is re-measured
Post-recovery checks confirm front-end and admin respond, the error stream stays quiet, and scheduled jobs drain. Verification is measured, not assumed.
Back to business — audit-logged
The token is consumed and cannot be reused; every step is written to the activity log; the incident is marked resolved with its full evidence trail.
Safe Mode quarantine
Safe Mode is a must-use drop-in that loads before regular plugins. When armed, it reads its quarantine list and filters the active plugin set — the failing component stops loading while the rest of the site runs normally.
- No secrets, no backdoor — the drop-in contains no tokens and accepts no remote commands
- Deletable at any time — removing the file removes the feature; nothing else breaks
- Rate-limited — token validation attempts are limited per IP; only failures count against the budget
↓ bootstrap, before plugins
✓ HMAC hash matches stored record
✓ not expired · not used · rate limit ok
→ arm safe mode: quarantine plugin-set
→ serve site normally, admin available
✓ token consumed (1/1) · audit logged
Recovery points & rollback
Before every plugin, theme or core update, FaultPilot captures the active component set as a recovery point. When an incident correlates with an update, one click rolls the component set back — no file editing, no database surgery, no downtime windows guessed by hand.
Recovery points are application-level snapshots of what was active and how — the complement to your file/database backups, not a replacement. FaultPilot is explicit about this distinction.
Boundaries
What recovery can and cannot do
A tool that claims to fix everything will waste your worst hour. Here is the honest matrix.
- A plugin fatal at bootstrap — quarantined via Safe Mode / recovery link
- A theme fatal during rendering — component isolated, recovery point restore
- A bad plugin update — rollback to the pre-update recovery point
- Broken wp-admin — recovery works outside the admin entirely
- wp-config corruption or bootstrap-level failure
- Database server corruption or data loss — restore from backups
- Host-level outages and infrastructure failure
- Hacked sites — use dedicated security tooling; FaultPilot is not an antivirus
See a full recovery cycle
The demo’s Recovery tab replays the sequence with a realistic incident.