# WordPress Maintenance Mode Does Not Isolate a Compromised Site ## Claim When responding to a confirmed WordPress malware infection, WordPress's own maintenance mode is not a real isolation step, because it doesn't block direct URL access to backdoor files — actual isolation requires cutting network access entirely, e.g. by DNS-forwarding the domain to a static placeholder page with no application code behind it. <!-- atomicity: 1 idea ✓ --> ## Evidence [[3. Resources/Literature Notes/Cleaning WordPress Malware Infections With AI]] documents this as Step 1 of Hasin Hayder's 8-step incident-response process — the [[3. Resources/Literature Notes/Cleaning WordPress Malware Infections With AI#Maintenance mode doesn't block direct malware file access|H2 atom]]: he explicitly warns maintenance mode is insufficient because malware files can still be accessed directly by URL while it's active, and recommends DNS-forwarding to a bare "back soon" page with zero application code as the actual first isolation step. ## Scope & conditions - Holds specifically for WordPress's built-in maintenance-mode mechanism (and functionally similar "coming soon" plugin toggles) on a site already suspected or confirmed compromised. - Doesn't address whether a hosting-level takedown, firewall rule, or reverse-proxy block would achieve real isolation faster than a DNS change — those weren't compared in the source. - The underlying principle generalizes past WordPress: any application-layer "mode" toggle that still routes requests through the vulnerable application doesn't isolate it — only removing the application from the request path does. ## Links - [[3. Resources/Permanent Notes/Prose Configuration Cannot Substitute for a Real Access Boundary]] — because extends: both are about a soft, application-level control (a mode flag, a prose rule) being mistaken for a hard boundary that actually removes access. - [[3. Resources/Permanent Notes/A Single Human Supervising Automation Absorbs Liability the System Created]] — because contrasts: unrelated mechanism, but the same shape of mistake — assuming a visible, named control (a toggle, a supervisor) is doing structural work it isn't actually doing. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — because applies-in: a concrete, checkable first-response step for any WordPress incident-response runbook. ## Maintenance - Last tended: 2026-08-19 - Next review: 2026-11-19 <!-- atomicity: 1 idea ✓ -->