# AI access switch and read-only mode

> Stop every AI app at once, limit all connections to reading, or show visitors a maintenance page while you work. Where each control is and what it does.

Three controls are always in your hands. The **AI access switch** stops every AI app at once. **Read-only mode** lets apps look but not change anything. **Maintenance mode** shows visitors a "back soon" page while you or your AI app work on the site.

## AI access switch

The switch refuses every AI app immediately. Use it in an emergency, or when you want to be sure nothing changes while you check something.

You find it in two places:

- In the header of every PowerWP AI screen, next to the label **AI on** or **AI off**. Its tooltip reads **Pause AI access** or **Resume AI access**.
- Under **Settings › General › AI access**.

When access is paused:

- Every AI app that sends a valid key gets the answer "AI access to this site is paused by the site administrator (PowerWP AI). Try again later." This includes apps that signed in.
- The PowerWP AI screens keep working, so you can still roll back, restore or switch access on again.
- Connections, permissions and settings stay as they are. Switching access on again lets the apps carry on.
- The switch is written to the activity log as a warning.

After an incident, revoke the affected connections under **PowerWP AI › Connections** and look at the activity log with the channel **Security**.

If you cannot log in to wp-admin, add this line to `wp-config.php`. It turns AI access off whatever the setting says, and the switch on the screen then shows as locked:

```
define( 'WPAI_MCP_DISABLED', true );
```

See [wp-config constants](/docs/reference/constants/).

A separate setting, **Sign-in for AI apps** under **Settings › Connection security**, pauses only the apps that connected by signing in. Connections with a key keep working.

## Read-only mode

Read-only mode limits every connection to reading and diagnostics, whatever permissions it has. Switch it on under **Settings › General › Read-only mode**. The dashboard card **Access mode** shows **Read-only** while it is on.

What changes for your AI apps:

- Tools that need a write permission disappear from the tool list, and any call that tries to change something is refused. The refusal mentions that the site is in global read-only mode.
- The app is told in its instructions that only read tools are available.
- Creating backups and rolling back through the app are blocked too, because both need a write permission. Use the **Backups** and **Changes** screens instead.
- The permissions of each connection are not changed. When you switch read-only mode off, they apply again.

Sites on the Free plan are limited in the same way, whatever this setting says: the AI apps can read but not change anything. See [Plans and limits](/docs/concepts/plans/).

## Maintenance mode

Maintenance mode shows visitors a page that says the site is down for maintenance, with the HTTP status 503 and a Retry-After header, which tells search engines it is temporary. The page is marked noindex. It shows your message, or "We are performing scheduled maintenance and will be back shortly."

Logged-in administrators, IP addresses you allow, wp-admin, the REST API, WP-Cron and WooCommerce payment and webhook callbacks keep working, so orders in progress are not lost.

It always ends by itself, so a live store is never left closed by accident.

:::steps
1. Open **PowerWP AI › Dashboard** and find **Maintenance mode** under **Quick actions**.
2. Choose a duration, from 15 minutes to 8 hours, and optionally write a message for visitors.
3. Choose **Enable** and confirm.
:::

While it is on, the card shows when it ends. **+30 min** extends it and **Turn off** ends it now. Administrators also see **Maintenance mode: N min left** in the admin bar.

Your AI app can switch it on with [`maintenance_mode`](/docs/reference/tools/#maintenance_mode): `action` is `status`, `enable` or `disable`, `minutes` is 1 to 1,440 (30 by default), and `allow_ips` lists addresses that still see the site. Enabling and disabling need the Settings & maintenance permission. The change log records it as **Irreversible**. That only means you switch it off instead of rolling it back.

A restore turns maintenance mode on for you while it runs.

## Which one to use

| Control | Stops | Where | Ends |
|---|---|---|---|
| AI access switch | Every AI app, including reading | Header of every screen, **Settings › General** | When you switch it on again |
| Read-only mode | All changes by AI apps | **Settings › General** | When you switch it off |
| Maintenance mode | Visitors seeing the site | **Dashboard › Quick actions**, or `maintenance_mode` | By itself, after its time |

## Example prompts

```
Switch on maintenance mode for 30 minutes with the message "We are updating our kitchenware catalog. Back soon." Then continue with the price update.
```

```
Check the site for problems. Don't change anything.
```

The second prompt works best with a connection set to Read-only diagnostics.

:::cards
- [Keys and access control](/docs/security/access-control/) — Expiry, IP allow-lists and lockouts.
- [Permissions and presets](/docs/concepts/permissions/) — What each connection may do.
- [Rescue mode](/docs/safety/rescue-mode/) — When a plugin crashes the site.
:::

Source: https://powerwp.ai/docs/safety/access-switch/