Skip to content

Early-bird lifetime licence: $199 once, for the first 200 buyers only. See the offer

What happens when a snippet goes wrong.

Everyone ships a typo eventually. Snipfire is built so that a typo costs you a minute, not a white screen and a panicked FTP session.

Four checkpoints between a typo and a white screen.

A bad snippet in most plugins takes the whole site with it. Here it gets caught, switched off, and pointed out to you, usually before a single visitor sees a thing.

  1. Before you save

    Every PHP snippet is syntax-checked, and Snipfire warns you before you declare a function or class that already exists: the classic "Cannot redeclare" white screen.

  2. When you switch it on

    Snipfire test-loads your site first. If the page crashes, the snippet is switched straight back off.

  3. While your site runs

    Errors and fatal errors, even ones thrown later from a hook, switch the snippet off automatically and record the exact line.

  4. If all else fails

    Safe mode, from a secret link or one line in wp-config.php, gets you back in. The Snipfire editor never runs your snippets, so you can always fix them.

What your visitors see.

Straight answers, because this is what you're really asking.

A syntax error
Nothing. It's caught when you save, and the snippet isn't saved until it's fixed.
A snippet that crashes the site when switched on
In practice, nothing. Snipfire test-loads the site the moment you switch it on, and a crash sends the snippet straight back off.
An error that only happens later, on a certain page
The visitor who hits it sees WordPress's error page asking them to reload. By then the snippet is already switched off, so the reload works. You get a notice with the exact line.
A broken edit to a live SCSS stylesheet
Nothing. The last version that compiled stays live until you fix it (Pro).

Safe mode: always a way back in.

If something ever gets past the checks, safe mode stops every snippet from running so you can fix it in peace.

Snipfire's own screens and API never run your snippets, so the editor always opens, even while a snippet is broken.

For you only: the secret link

Open your secret safe-mode link and snippets stop running in your browser only. Visitors see the site as normal.

For the whole site: one line in wp-config.php

define( 'SNIPFIRE_SAFE_MODE', true );

From the command line

$ wp snipfire safe-mode           # status and your links
$ wp snipfire safe-mode new-key   # old links stop working

Changing a live site, calmly.

The best crash is the one that never reaches the public site.

  • History and one-click restore Every save keeps the version before it, with who saved it and when. Restoring is checked and test-loaded like any save, and can itself be undone.
  • Testing mode Pro Run a snippet only for admins and anyone with the preview link. Preview pages are never cached, so a page cache can't leak a test to visitors.
  • The right access for each person Pro Designers can edit CSS, JavaScript and HTML without ever touching PHP. The server checks every change, so they can't sneak PHP into an HTML snippet either, and their SCSS and LESS stylesheets can't read files on the server.
  • Pro settings fail safe If Pro is removed or a licence ends, a script waiting for consent doesn't run, a snippet in testing mode runs for nobody, a scheduled snippet or one placed next to an element doesn't run, and SCSS keeps its last compiled CSS. Network snippets on multisite wait for the Agency plan, and PHP that reads a secret should check function_exists( 'snipfire_secret' ).
  • API keys out of your code Pro Keep keys and tokens in the encrypted secrets vault and read them with snipfire_secret(). Their values never reach the browser, an export, a Git repository or the activity log.
  • AI only when you ask Pro The AI assistant sends nothing until you click, strips secret values from the code first, shows fixes as a diff you apply yourself, and never saves or switches on a snippet on its own.
  • Code from Git or the agency hub is checked too Agency plan Snippets pulled from GitHub or GitLab, or pushed from your agency hub, are checked and test-loaded like any save. One that would break a site stays off on that site.

Stored as files, guarded.

Snippets live in plain files with one compiled index, not in the database.

  • Snippet files are protected from direct web access.
  • Edits take effect immediately, even on hosts with aggressive PHP caching.
  • Loading snippets costs one cached file read and no database queries.
  • Only administrators manage snippets by default, and uninstalling keeps your files unless you say otherwise.
  • Hosts and careful agencies can add SNIPFIRE_DISABLE_PHP to wp-config.php: no PHP snippets run for anyone, while CSS, JavaScript and HTML keep working. With WordPress's DISALLOW_UNFILTERED_HTML, snippets become view-only for everyone; administrators keep Tools, safe mode and system info.

Signed updates.

A plugin that runs code on your site has to be careful about where its own code comes from. Every Snipfire release is signed with our release key, which is never stored on this website's server.

  • From version 0.17.0, Snipfire checks the signature itself before it installs an update, and refuses one that doesn't match the release key built into the plugin, or isn't newer than the version you have. Nothing changes then.
  • So even someone who took over this website couldn't push code to your site through an update.
  • A refused update shows a notice on the Plugins and Updates screens, and in the activity log with Pro.
  • You can check a download yourself: the download page has the zip's SHA-256, its signature file and the release key's fingerprint. Download page
  • Found a vulnerability? Tell us privately, and we'll fix it fast. Security policy

Move your snippets over this afternoon.

Importing changes nothing until you switch over, and your old shortcodes keep working.

Get Snipfire Try the live demo