[superdav42]

Summary

Site_Manager::lock_site() calls wp_die() without a response code for locked (inactive membership) and keep-until-live demo sites, so WordPress answers HTTP 500. These are deliberate access blocks, not server errors; the 500s trigger 5xx monitoring and tell crawlers the site is broken.

Both calls now pass ['response' => 403]. Message, redirects and the reactivation filter are unchanged.

Evidence

Production (tgc.church host): a blocked site returned 500 with "This site is not available at the moment"; it was the largest single 5xx source in the rolling 24h error audit.

Verification

• php -l inc/managers/class-site-manager.php

Summary by CodeRabbit

• Bug Fixes
  • Locked sites, including demo sites that are not yet live, now return a “Forbidden” (403) response when access is denied. This gives browsers and other clients a clearer indication that the site is intentionally unavailable, rather than presenting an unspecified error response.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 765f3b4e-5326-4151-99bd-ecdacdd20930

Commits

Reviewing files that changed from the base of the PR and between 58da122 and 7251977.

Files selected for processing: 1

• inc/managers/class-site-manager.php

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

Both denial paths in Site_Manager::lock_site() now pass HTTP 403 to wp_die().

Changes: Locked-site denials

Layer / File(s)	Summary
Set locked-site denial response codes inc/managers/class-site-manager.php	The keep-until-live demo denial and generic locked-site denial now pass HTTP 403 to wp_die().

Priority: Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Bug fix

Merge Risk: Minimal · up to 72519

Blocked site frontends return the intended 403 response instead of 500.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: locked and demo-mode site frontends now return HTTP 403 instead of HTTP 500.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

• Build: ultimate-multisite
• ⬇️ Download from GitHub Actions
• ⬇️ Download without Github Account (nightly.link)

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password