Archive of Our Own, commonly called AO3, is accessible again after a two-week shutdown prompted by evidence of a security incident. The return is not yet a full restoration: the Organization for Transformative Works, the nonprofit that operates the fan-fiction repository, has reopened the service with selected functions disabled while further mitigation and review work continues.
For readers and writers, the immediate upside is straightforward. Existing works, bookmarks and kudos remain available, and the organization says none of that material was deleted. But the relaunch comes with limits intended to get the archive back online earlier than the upper end of its originally projected two-to-four-week downtime window. Users may also encounter slow page loads as traffic returns.
What is working, and what remains limited
AO3’s core archive is back: users can browse and read works, and account-held material including works, bookmarks and kudos remains intact. That distinction matters because a prolonged interruption at an archive is not merely an inconvenience; for authors, it can cut off access to ongoing projects and readership, while for readers it removes saved reading lists and community history from daily reach.
Several features have been temporarily switched off as part of the reduced-functionality return:
For more context, explore How to Check Whether a Car Has Apple CarPlay—and What to Do If It Doesn’t.
- Icons are currently disabled.
- External work importing is unavailable.
- Works can presently be downloaded only in HTML format.
The organization says these restrictions are temporary. It also specifically clarified that icons have not been removed or deleted; they are simply not active while the site operates in this interim state.
HTML, or HyperText Markup Language, is the standard format used to structure pages on the web. In practical terms, an HTML download provides a web-page-style copy of a work. The current restriction means people who normally save works in other offered formats will need to wait for those options to return. The availability of HTML still gives readers a way to retain a local, browser-readable copy when downloading is permitted.
Expect possible loading delays
AO3 has also put an intentional traffic-management measure in place. Users may see delays while pages load and can refresh to keep trying. This is not presented as an accidental return of the outage; it is a deliberate part of bringing a high-demand service back in stages.
Related coverage includes AO3 Returns After Two-Week Security Outage With Some Features Disabled.
Traffic management refers to controls used to regulate how requests reach a website or service. The aim can be to prevent a sudden rush of visitors from overwhelming systems that have only just been restored or that are operating with temporary safeguards in place. With a large community returning after two weeks away, slower access may be frustrating, but it is consistent with a cautious restart rather than an all-at-once reopening.
That caution is especially understandable when the platform has not described the precise nature of the incident or the mitigating changes being made. The organization has said it will not share those specifics at this time. The absence of technical detail means users should avoid filling the information gap with assumptions about what happened, what systems were affected, or what changes are permanent. What is established is narrower: AO3 was taken offline at the end of October because of evidence of a security incident, and the service has returned with temporary restrictions.
Works, bookmarks and kudos are reported safe
The strongest reassurance in the update concerns archive content. The organization says it did not delete site data and that users’ works, bookmarks and kudos are safe. For a fan-work platform, those categories cover both creative output and much of the activity surrounding it: authors’ published work, readers’ saved references and community appreciation recorded through kudos.
There is an important practical difference between content remaining safe and every feature being immediately available. A work can remain present in the archive even while an icon display, an import tool or a preferred offline file format is unavailable. The present situation is therefore best understood as a partial service restoration, not as a statement that all normal workflows have resumed.
Drafts received a temporary reprieve
AO3 also paused its draft-deletion process during the shutdown so that drafts would not be removed while users could not access the site. That pause will end on November 29, when the usual deletion behavior resumes for drafts that are more than 30 days old.
Writers should log in, find their drafts and review them before that date. A draft is not the same thing as a published work: it is an in-progress or not-yet-posted item, so it can be subject to a separate retention rule. Anyone with a draft approaching or beyond the 30-day threshold should either complete the needed work within AO3 or preserve the text elsewhere before the deletion process resumes.
A sensible checklist for returning users is short:
- Sign in to confirm account access is working.
- Check drafts promptly, particularly older unfinished posts.
- Save an additional copy of important draft text outside the platform.
- Verify that published works, bookmarks and other key account material appear as expected.
- Be patient with loading delays and retry by refreshing when necessary.
Keeping a separate copy of unpublished writing is useful even outside an outage. It does not imply that the archive has lost material; rather, it gives the writer direct control over a manuscript while a web service is under maintenance or operating with limited functions.
Password changes are the immediate account-security step
The organization says it has no reason to believe the user database was compromised, while also making clear that it cannot rule that possibility out. That uncertainty is why it recommends that users change their AO3 passwords, update linked email accounts and change credentials on any other services where the same password was used.
This recommendation is a prudent response to an unresolved security event, not confirmation that individual accounts or the database were accessed. Users should keep that distinction in mind. “No reason to believe” is reassuring, but it is not a definitive declaration that exposure is impossible; “cannot rule out” means investigation and caution remain warranted.
For anyone who reused an AO3 password elsewhere, the priority extends beyond AO3 itself. Password reuse creates a chain of risk: if one set of credentials is ever exposed, attackers may try the same combination on other sites. Changing passwords on other accounts that shared the same password breaks that chain. Updating the password on the linked email account is particularly important because email is often used for password resets and account recovery.
Use a distinct, strong password for AO3 and for every other important account. A password manager can help generate and store unique credentials, reducing the temptation to reuse a familiar password. Users should also watch their account email for legitimate service messages and be wary of unexpected requests to provide a password or reset account details. During outages and security discussions, convincing-looking scams can exploit confusion even when they are unrelated to the event itself.
Why the limited return matters
The restoration reflects a trade-off between access and caution. Waiting until every function was ready could have extended the disruption, while reopening every feature immediately could have conflicted with the organization’s mitigation work. Bringing back reading and account access first, while holding back selected functions, offers a middle path.
External work importing is one example of a feature where a temporary pause can be meaningful. Import tools bring material from outside a service into that service, which can involve additional processing and handling of content. The organization has not said why that feature was disabled, so it would be wrong to assign a specific security rationale. Still, its absence signals that this is a deliberately constrained return rather than an ordinary maintenance completion.
The same applies to download choices. HTML access preserves one avenue for readers who want a local copy, but the restricted set of formats means AO3 is not yet back to its normal feature breadth. The organization says restoration is planned, without offering a precise schedule in the available update.
What happens next
AO3’s operator has brought in a security firm to review the incident and analyze the site with the goal of preventing future incidents. That outside review is the clearest indication that the work did not end when the archive became reachable again. Users should expect the near-term experience to remain somewhat uneven: pages may be slow, some tools will be absent, and details of the underlying incident may remain undisclosed.
For now, the actionable picture is clear. AO3 is online after two weeks, archive data is reported safe, draft deletion was paused but resumes November 29 for drafts older than 30 days, and users should refresh through traffic delays. They should also take the account-security advice seriously: change the AO3 password, secure the linked email address and replace any reused password on other services.
The platform’s return restores the essential connection between readers and the archive, but it is a phased return. Until the disabled features are restored and the security review progresses, users should treat the service as operational with temporary limits—not as though the interruption never happened.
