Archive of Our Own is back online after 17 days, and its operators want you to change your password before you start reading.
The site went dark on October 29 after a reported security incident. The Organization for Transformative Works (OTW), the volunteer-run nonprofit behind AO3, had estimated the cleanup could take up to a month. It reopened early by switching off some features. Icon displays and external importing are disabled, and works can be downloaded only as HTML. OTW said no AO3 data was deleted. Automatic deletion of drafts older than 30 days is paused until November 29.
OTW said it has hired a security firm to review the incident and analyze the site. It declined to share what changes it is making. It does not believe user data was compromised, but it "cannot rule out that possibility." Its advice: change your AO3 password, change it anywhere else you reused it, and check that your email address is current.
That advice is the sensible hedge. If exposure cannot be ruled out, the real danger is reuse, because one leaked password can unlock other accounts. The silence on specifics is defensible while fixes are underway, but it leaves users weighing their own risk with little to go on.
The early return also looks like a trade. OTW chose a faster reopening with fewer features over a longer wait with everything intact, a pragmatic call for a nonprofit with a huge, impatient audience. Expect friction at first: AO3 is using traffic controls, which sent one visitor through a Cloudflare waiting room for two minutes, and logins may throw a bad gateway error under heavy load.
The open question is how much OTW will say once the outside review wraps up. Right now, users have a to-do list but no account of what actually happened.