Enable Break Glass
WARNING: Use this recovery process only when a CMSSPM setting has made the site or WordPress admin inaccessible. Break Glass disables active CMSSPM enforcement without deleting saved configuration, so protections may still appear enabled in the UI even though they are temporarily bypassed.
WARNING: If HTTPS enforcement is part of the problem, the generated must-use plugin for forced HTTPS can continue to affect access until it is removed. Use this guide only long enough to regain access, review the saved settings, and correct the underlying configuration.
Description of the control
Break Glass is an emergency recovery mode for CMSSPM. When enabled, it bypasses CMSSPM runtime enforcement but keeps the saved configuration in place so the administrator can regain access and review what was previously configured.
The control is stored in wp-config.php as define( 'CMSSPM_BREAKGLASS', true ); or define( 'CMSSPM_BREAKGLASS', false );. The CMSSPM interface also notes that if forced HTTPS is preventing access, the file wp-content/mu-plugins/cmsspm_mu_Force_https.php may need to be removed so HTTPS is no longer forced.
When to use
If the site becomes unavailable due to a new security control being enabled, configured, or modified within CMSSPM plugin. This will disable all security controls but keep the configuration screens accessible.
Procedure
- Documented here: https://cmsspm.com/dont-panic/break-glass/
Validation
After enabling Break Glass, confirm that the site or wp-admin becomes accessible enough to review settings. If wp-config.php is available, confirm that define( 'CMSSPM_BREAKGLASS', true ); is present and saved correctly.
If forced HTTPS was part of the issue, confirm that removing or renaming cmsspm_mu_Force_https.php stops the redirect behavior. After correcting the configuration, confirm that Break Glass is turned off again and that the site remains accessible with CMSSPM protections operating normally.