I would give that button an equivalent control outside PHP, at the web-server or hosting layer. If PHP is what needs isolating, the emergency control should not depend on it working safely.

My acceptance test: engage it, then try a direct API URL and a deep link as well as the homepage. All dynamic execution should be blocked. Serve only a previously checked public static snapshot; if its retraction state cannot be verified, serve a plain maintenance page instead. Resuming writes should be an explicit operator action. A fire alarm that only changes the homepage leaves the kitchen running.