Security and reversibility
Every write is preceded by a snapshot. Every error is reversible. But the scope has limits: six WordPress core tables, no more.
Reversible or not
Covered by rollback
posts
postmeta
options
terms
term_taxonomy
term_relationships
Out of scope
Extension tables
HPOS orders
Payment tables
Text equivalent: Rollback covers six WordPress core tables: posts, postmeta, options, terms, term_taxonomy and term_relationships. Extension-specific tables (notably WooCommerce orders in HPOS mode and payment tables) are neither captured nor reversible. This is a scope, not a defect.
Grouping and ceiling
Text equivalent: Each write operation generates one or more snapshots. Operations are grouped under an operation_id. The recommended ceiling is 700 accumulated snapshots. An alert is issued at 500 snapshots. Beyond 1000 snapshots, a known defect (fix planned in 1.9.1) may cause partial restoration without warning.
Security measures
Bearer token
Every request must include a bearer token (wpab_****). Without a token, the request is rejected. The token is generated in the WordPress admin.
READONLY by default
The plugin starts in READONLY mode. All writes are impossible until an APPLY window is explicitly opened.
Time-limited window
The APPLY window lasts 15 to 240 minutes. On expiry, the site automatically reverts to READONLY. No write persists beyond the window.
Loopback verification
After each write, the plugin verifies the site responds with HTTP 200. If the site is broken, the operation is rolled back and the snapshot restored.
Options allow-list
Only 37 options are editable. API keys, passwords and SSL configuration are excluded.
File sandbox
File reading is limited to themes, plugins, mu-plugins and uploads directories. Sensitive files are excluded.
Known defect
Version 1.8.3: beyond 1000 accumulated snapshots, a multi-snapshot operation may be partially restored without warning. Fix planned in 1.9.1.
Recommendation: stay under 700 snapshots. An alert is issued at 500 snapshots.