Being in recovery mode is easy to not realise you are in it

[karmatosed]

Currently, the way recovery mode is indicated and left, is through a simple text link in the toolbar. This could be easy to forget you are in that mode and know how to leave.

I began exploring a few options you can see in attachments. The first attachment shows our current state.

1. Add a message to say what state in: If this is dismissable it's easy to get into the same situation of not knowing. This does come down to finding out when it's ok to assume someone knows the mode.

2. Add a message and put action button to exit in that message: I took an extreme version of this into mocks, including showing not dismissable.

3. Button in toolbar and message: This brings back dismissable message and makes the toolbar link into a button. I think this is our best balance for now.

My current feeling is going with option 3 and making the link a button in the toolbar. I would love others to explore this but I realise we have limited time.

[mapk]

I really like number 3. Anything in the black topbar gets lost. I feel the other notifications leave me searching again for the exit button/link, but number 3 presents it all together in a nice little package for me.

I wonder if the notification message should have a yellow/orange left border? But I do get that it's really just an information msg.

[joyously]

Is there any downside to being in recovery mode? If so, I would want to make it even more prominent that you are in there. Maybe the notice is yellow or button is red or both. Or put a red border on the admin bar.
If there is no downside, maybe put a red bubble on the Dashboard link, and show the info message.

[melchoyce]

How about orange? It stands out as more noticeable in the admin than blue, and we generally use it as "hey, look at me."

[TimothyBlynJacobs]

Thank you for these explorations!

Is there any downside to being in recovery mode?

I would say there isn't a significant downside to being in recovery mode. The possible concern in my mind would be if they were on a shared computer. Someone might be able to bypass a security related plugin by causing it to fatal, making it easier to login since the recovery mode cookie would still be there. But being in recovery mode shouldn't be used as a substitute for any auth checks.

Outside of being on a shared computer, the worst that could happen is a plugin gets unexpectedly paused for causing a fatal error. Since this is local to the current user, it shouldn't be a significant issue, but it isn't ideal.

---

One advantage of having it in the menu bar is it could be something visible on the front end of the site. Additionally, right now if a plugin is paused on the front end, the user won't see any notice until they go back into the admin. This isn't there in core at the moment, but conceivably, we could add a notification of some kind to the admin bar that a plugin was just paused, or have a quick way of displaying all the paused plugins. Of course, the admin bar isn't showing on the front-end for all sites, but I think it might be worth exploring forcing the admin bar to display when in recovery mode.

An additional note is that recovery mode isn't cleared when the user logs out. If it did, it'd be difficult to test/reproduce errors that occur during the login process ( which is one of the most important actions ).

[karmatosed]

How about orange?

I really like that. I chose blue as it felt an action to me but orange also works well and calls attention nicely. I would like to have an information notice combined still as a first 'hey just so you know'.

An additional note is that recovery mode isn't cleared when the user logs out. If it did, it'd be difficult to test/reproduce errors that occur during the login process ( which is one of the most important actions ).

Could the information notice re-appear once log back in again?

[TimothyBlynJacobs]

Could the information notice re-appear once log back in again?

Yep!

[spacedmonkey]

I like the dialog from 04.png and the button from Exit-Orange.png.

We could even put a message in the footer, just in case you missed it....

[knutsp]

Since WordPress, at this visit, is in a special state, meant to be temporary, I think it's important it's also visible on the front (when the the client who initiated it is logged in). So toolbar, and orange is fine.

[spacedmonkey]

Thinking about this more a couple of things to consider.

• Any colour of buttons in the admin bar is going to need to consider that admin themes will change the colour of the bar. We will likely new high colours for all the existing themes.
• What if developers have hidden the admin bar (which is possible and I have seen done). Should also include a link to exit recovery mode at the bottom of the site. Is this good for accessibility as well?
• The login page ( and maybe front end) should also have some sort of highlight to note you in recovery mode.
• Front end could have highlight to note you in recovery mode by force the admin bar on the front end if recovery mode is active.

I think there are some questions about accessibility here as well...

[karmatosed]

I began to explore this, however, a few points came to mind.

• If the front doesn't show a toolbar, I am not totally convinced we should show a message or indication of recovery mode. In thinking about this, it's an active choice and may be due to theme or site configurations.
• I think as it does use an orange used in schemes, it should be able to be swapped out in admin schemes, but that does need exploring and wide testing.

I haven't explored what copy should be used yet, so that would be a good next step.

[SergeyBiryukov]

Moving to 5.2, per the ​latest #core-php chat.

[azaozz]

[Recovery mode is] a special state, meant to be temporary

I agree. Thinking we should "shout" loudly enough so recovery mode is turned off as soon as possible. There may not be many disadvantages in running in recovery mode for now, but that may change in the future or by plugins.

An "always displayed" notice on all admin pages and a big orange button sound really good. Was wondering if it should be even more drastic, like changing the admin background color/color scheme perhaps? IMHO the user has to be fully aware at all times that something "special" is going on :) (Prior art: opening a private window in browsers).

[melchoyce]

Should we using an informational, or a warning notice? I think warning might make a little more sense in this context.

re: admin color schemes — let's use the highlight color for alternate color schemes, in place of orange, in the wp-admin admin bar. Since the front-end still uses dark grey, we can always use the orange background there.

[azaozz]

Replying to melchoyce:

Should we using an informational, or a warning notice?

I'd say a warning. It is a temporary state that requires an action (turning off) by the user, and may cause problems to leave on.

There is some other usability "oddness" that would need fixing (perhaps when polishing this later on): triggering recovery mode by having a fatal error in a plugin, then fixing the code still shows the error notice/paused plugin screen, etc. A better user experience would be to re-check the plugin on loading the paused plugins screen, and offer to turn recovery mode off if all seems OK.

Another time to offer to turn recovery mode off would be on clicking "Resume" and ensuring the site works OK now.

[melchoyce]

A better user experience would be to re-check the plugin on loading the paused plugins screen, and offer to turn recovery mode off if all seems OK.

+1

[afercia]

From an accessibility perspective, I'd say a link in the admin bar is not sufficient. I'd agree with @azaozz: it needs something more drastic. At the very least, I'd recommend an admin notice after the main H1, that's the place that is more visible for everyone and also easy to navigate to for screen reader users.

Also, I’d consider to change the document title: that’s the very first thing screen readers announce when navigating to a new page. This would be a very nice touch.

I wouldn't recommend color alone: that could be an optional signal but wouldn't be sufficient.

[spacedmonkey]

So reviewing recovery mode, we already have some signally. See login page and dashboard.

From the feedback the only feedback that is actionable, is making that exit recovery mode button orange and adding (Recovery Mode) in the title tag of the page.

[spacedmonkey]

Uploaded a first patch at 46608.diff, so can get the ball rolling.

This patch add to the <title> for admin header and login page.
This patch also changes the colour of the exit recovery mode.

[flixos90]

In today's PHP meeting we discussed the following (in addition to the great suggestions here):

• When the user logs out, should we automatically exit recovery mode then? Three arguments for this:
  • We can't really integrate with the frontend of WordPress, as we don't know what the theme looks like, and we shouldn't auto-show the admin bar in the frontend, as many plugins likely don't expect that and run their custom code unconditionally.
  • A user might forget to manually exit recovery mode, possibly even expecting that logging out also logs out of recovery mode. If they want to re-enter recovery mode, they can do so, because the rate limit for getting a recovery email is reset when they exit recovery mode.
  • While recovery mode is technically entered before the user logs in, they are expected to log in in the next step. So from a user standpoint, it already feels like it is tied to login.

@karmatosed @melchoyce Thoughts?

[azaozz]

I've tested/played with recovery mode a bit more during the weekend. It is really easy/straightforward to enter it, but for now it's not easy or straightforward to exit it :)

When the user logs out, should we automatically exit recovery mode

+1. That should be one of the ways to exit recovery mode. It won't be very "reliable" exit as users may stay logged in ("Remember me" checkbox on the login screen).

Another way should be on clicking "Resume" or "Deactivate" (should we also have "Delete" there?) for a paused plugin. We reload WP and re-check the plugin. If there aren't any other problems, there is no point to stay in recovery mode.

Yet another way (IMHO) should be on visiting the Paused Plugins screen. We can do the same checks as when the user clicked "Resume".

In all cases there should be an "info" message when recovery mode has ended (if possible). Keeping the user informed of what's happening with their site is best :)

[TimothyBlynJacobs]

One possibility is that when we logout, we shorten the recovery mode cookie expiration to something very short, like an hour ( or even less ). If someone logs back in, we can remove that shortened duration. That'd allow for people to easily test logging in with recovery mode active, which I think is one of the main use cases.

It'd also simplify some UX flows that @spacedmonkey brought up in chat about logging into the wrong user

What if you login to the wrong user and to login again as an admin

If there aren't any other problems, there is no point to stay in recovery mode.

Determining if there aren't any more problems will be difficult. For example, if the error occurs on the login page or anywhere besides plugins.php or on every admin page load.

[azaozz]

Determining if there aren't any more problems will be difficult.

I haven't looked much "in depth", just testing the UI. Do we store the URL that triggered recovery mode in the first place? Seems "sensible" to re-test it before exiting.

Also, if there is still a problem, we can trigger recovery mode again as @flixos90 points out above.

[TimothyBlynJacobs]

Do we store the URL that triggered recovery mode in the first place? Seems "sensible" to re-test it before exiting.

Currently we do not.

Also, if there is still a problem, we can trigger recovery mode again

To me this sounds like it might be confusing to keep having to re-enter recovery mode multiple times, but might just be me.

[karmatosed]

When the user logs out, should we automatically exit recovery mode then?

This is ok for version one, I do think the flows and pitfalls where people could get trapped need to be eased and fixed in later versions. For example, unless I am mistaken there is a possibility someone could be stuck as a result of logging out if it does remove them from recovery mode.

[flixos90]

During WCLDN we created 46608.2.diff​ which iterates on the previous patch. It includes the following changes:

• Provide the Exit Recovery Link background color in a way that it covers all possible scenarios (with WordPress's often way too specific CSS selectors :) ).
• Provide an alternate background color for hover/focus. This color hasn't been used in WordPress before and is based on the "Fire Orange (Shade 10%)" from ​https://codepen.io/hugobaeta/pen/RNOzoV (the regular color is "Fire Orange", so to get from that color to the new one, in Sass you need to use mix( black, srcColor, 10%).
• Add Exit Recovery Link style support to the different color schemes (using the above Sass function), in a way that is backward-compatible with all color schemes (also custom ones) without them being required to define a new variable.
• Exit recovery mode when logging out.
• Display an admin notice informing about recovery mode and exit opportunities with the following content: "You are in recovery mode. This means there may be an error with a theme or plugin. To exit recovery mode, log out or use the Exit button."
• Ensure login title is also adjusted when already in recovery mode from before.

After discussion, we decided to not exit recovery mode when resuming a plugin or theme for the first iteration. Making this a more intelligent process is however something to improve post-5.2.

[flixos90]

Latest Patch: Exit Recovery Mode link and admin notice

[flixos90]

Latest Patch: Edge case of having as many admin notices as possible specific to recovery mode

[spacedmonkey]

Latest patch is looking good +1

[tinkerbelly]

This looks good to me from a visual design/orangeness perspective. 👍

[flixos90]

In 45117:

Administration: Improve user experience and clarify when in recovery mode.

This changeset introduces several changes around usability when recovery mode is active:

• Display a notice in the admin clarifying that the user is in recovery mode.
• Use a highlight color for the admin bar link to exit recovery mode.
• Exit recovery mode automatically when logging out.
• Include a recovery mode indicator in the title tag.

Props aandrewdixon, azaozz, dhanukanuwan, flixos90, henrywright, karmatosed, mapk, melchoyce, spacedmonkey, TimothyBlynJacobs, tinkerbelly.
See #46608.

[TimothyBlynJacobs]

#46818 was marked as a duplicate.

[JeffPaul]

Input from @xkon in today's bugscrub is that the last commit covers the ticket's purpose.

[afercia]

Quickly discussed during today's accessibility bug-scrub, just a quick thing: we'd recommend to add Recovery Mode at the beginning of the document title instead of at the end, as it's way more important than the page title.

[desrosj]

In 45175:

Administration: Move “Recovery Mode” to the beginning of the document title.

This improves accessibility, ensuring users utilizing screen readers are informed that the site is in recovery mode.

Props: afercia, TimothyBlynJacobs.
See #46608.

[desrosj]

I believe everything in this ticket has been updated. I'm going to close this out. Let's open separate tasks as new changes are required.