Component (Tuning)
The Component tab (labelled Tuning in the configuration XML) contains general settings that affect how SecurityCheck Pro operates across the whole component.
Options
| Option | Default | Description |
|---|---|---|
| Memory Limit | 512M | PHP memory limit applied during file scans. Set this to a value equal to or higher than your PHP memory_limit directive to avoid out-of-memory errors during large scans. |
| Secret Key Length | 20 | Length of random keys generated by SecurityCheck Pro (e.g. the backend URL secret key). Options: 5, 10, 15, 20 characters. |
| Scan Executables Only | No | When enabled, File Manager and File Integrity scans are restricted to executable file types (PHP, JS, HTML, and similar). Non-executable files (images, fonts, media) are skipped. Reduces scan time significantly on large sites. |
| Remove Meta Tag | Yes | When enabled, removes the Joomla generator meta tag from frontend pages, hiding the Joomla version from view-source reconnaissance. |
| Check ACL Security | Yes | When enabled, checks Joomla ACL group assignments during vulnerability and security checks. |
| Trust IP Overrides | No | When enabled, SecurityCheck Pro reads the client IP from X-Forwarded-For and similar proxy headers instead of the remote IP. Only enable this if your site is behind a trusted reverse proxy or CDN. |
| Trusted Proxies (CSV) | (empty) | Comma-separated list of proxy IP addresses or CIDR ranges that are trusted to set the X-Forwarded-For header. Only used when Trust IP Overrides is enabled. |
| Allow Overrides when Remote is Private | No | When enabled, IP overrides are accepted from requests where the remote IP is a private network address (10.x.x.x, 192.168.x.x, etc.). |
| Rescue Link | Yes | Enables the email rescue link, which lets a Super User unblock an IP accidentally blocked by the dynamic blacklist. Replaces the old OTP unlock (removed in 5.2.0). See I have been blocked - recovery methods for details. |
| Rescue Link Mode | Strict | Strict: the unblock link only works from the blocked IP that requested it. Approval: the Super User can confirm the unblock from any device. |
| Rescue Grace Period (minutes) | 30 | After a successful rescue, the unblocked IP cannot re-enter the dynamic blacklist for this number of minutes. The firewall filters keep inspecting its requests. |
| Rescue Link Base URL | (empty) | Base URL used to build the unblock link sent by email. If empty, Joomla's global Site URL is used instead; if both are empty, the rescue feature is automatically disabled. |
| Proactive Rescue Email | Yes | Automatically emails a recovery link to a privileged user with an active session who gets blocked, without them needing to request it. |
| Extra Groups Eligible for Rescue | (none) | Additional user groups, beyond backend-capable ones, that also receive the proactive rescue email. |
| Rescue File (FTP Recovery) | Yes | Allows recovering access via FTP/File Manager by dropping a per-site secret file, without email or a working login page. See I have been blocked - recovery methods for the procedure. |
| Checkbox Position | Right | Position of the row-selection checkboxes in list tables: Right (last column) or Left (first column). |
| Include Exceptions in Database | Yes | When enabled, files and paths added as exceptions in File Manager and File Integrity are stored in the database and displayed in the Exceptions filter. When disabled, exceptions are stored but not shown in the filter view. |
