Skip to main content

Incident response

Incident response​

Last verified: 2026-06-16.

When you suspect a breach, every minute counts. Awthy's Incident Response tools let an administrator slam the door shut in seconds — lock out the accounts at risk, force a password reset, and sign people out everywhere — without losing their own way back in. Incident Response is a paid feature. You will find it under its own Awthy Security → Incident Response tab.

These are powerful, deliberately high-friction actions. Awthy asks for confirmation in proportion to the blast radius and labels clearly what can and cannot be undone.

Locking logins​

A lockdown stops the targeted accounts from signing in until you lift it.

  • Role-scoped lockdown (the default). Lock just the roles you choose — for example administrators and shop managers — while customers keep shopping. The default blast radius is administrators only; you opt in to anything wider.
  • All-users lockdown. Locking everyone, including WooCommerce customers, is a much bigger hammer. Because of that, Awthy requires a type-to-confirm step (you type a confirmation word) before it will activate an all-users lockdown. This is a guardrail against an accidental site-wide lockout.

While a lockdown is active, the Incident Response tab shows a persistent "LOCKDOWN ACTIVE" banner with an obvious End lockdown / restore button. A lockdown is reversible: lifting it lets the affected accounts sign in again.

You can never lock yourself out​

This is a firm, structural guarantee — not just a warning message. When you activate a lockdown, your own account is always excluded from the block, so you can always sign back in to manage or lift it. On top of that, Awthy never locks out the last administrator, so a site can never be left with no way in.

If something still goes wrong, the recovery paths below always get you back in.

Mass password reset​

When credentials may be compromised, you can reset passwords for a whole role group at once. Awthy never emails anyone a plaintext password. You choose how the reset is delivered:

  • Force reset on next login (the default). Each affected account is required to set a new password the next time they sign in, via a single-use, short-lived link. This is the OWASP-aligned default and the safest option for most incidents.
  • CSV download (opt-in). For out-of-band delivery, you can download a CSV so you can hand credentials over through your own secure channel. Use this only when you have a deliberate, secure way to distribute them.

A mass password reset cannot be undone, and Awthy labels it that way before you confirm.

Forced logout across every login method​

Forcing logout signs the targeted group out everywhere Awthy can reach, in one action. It revokes, per account:

  • WordPress sessions (password, passkey, and interactive logins),
  • application passwords,
  • trusted devices, and
  • linked external OAuth/OIDC identities.

Honest limits (residual-window caveats)​

Forced logout is thorough, but no tool can promise to kill every token the instant you click. Awthy tells you the truth instead of overpromising:

  • Already-issued tokens may persist briefly. Awthy destroys WordPress session tokens immediately. A credential that is not tied to a WordPress session token may keep working for a short residual window.
  • Application passwords and XML-RPC. XML-RPC access via an application password stops only once that application password is revoked — which forced logout does — so revocation order matters and Awthy handles it as part of the same action.
  • Upstream identity providers. Awthy can unlink an external login (Google, Microsoft, etc.), but it cannot end the session held by that provider itself. If you use an external identity provider, also sign accounts out there.

Like the mass reset, forced logout cannot be undone.

Notifying affected users​

Every incident action is always written to the audit log with who did it, the scope, the affected count, and your reason. Separately, you can opt in per action to email the affected users. Those emails are deliberately phishing-resistant: they never ask for a password or a one-time code, come from a stable sender, and are clearly labeled as a security action. An Awthy security email never asks you for credentials.

Recovery — if you are ever locked out​

A misconfigured lockdown is always recoverable. There are two break-glass paths, the same shape as Awthy's other recovery hatches:

  • wp-config constant. Add this line to your site's wp-config.php:

    define( 'AWTHY_DISABLE_INCIDENT_LOCKDOWN', true );

    With the constant defined, the lockdown is bypassed for everyone, so you can sign in. This needs no login — it works even if every account is locked. Remove the line once you have recovered.

  • WP-CLI command. If you have shell access, run:

    wp awthy incident unlock

    This lifts the lockdown and also prints the current lockdown state so you can see what was configured before you cleared it.

Both recovery paths are recorded in the audit log, so a break-glass recovery is never invisible.

Last updated on