Tuning

• Memory limit

Sets the maximum amount of memory (in bytes) that Securitycheck Pro is allowed to allocate. If you have a large site and File Manager or File Integrity scans do not complete, try increasing this value.

• Secret key length

Determines the length of the secret key generated when using the "Backend protection" feature under .htaccess Protection. Available values are 5, 10, 15 or 20 characters. The default is 20 characters.

• Scan executable files only

When enabled, scans will only process executable files and exceptions will not be stored in the database. This reduces CPU and memory usage and produces lighter scans. Enable this option if you have hosting resource restrictions.

• Remove meta tag

Removes Joomla's generator meta tag from the page source code. When this option is disabled, the following tag is visible in the HTML source, which attackers can use to fingerprint your Joomla installation:

• Check ACL

When enabled, Securitycheck Pro performs a basic Access Control List (ACL) security check. It inspects the ACL settings for the Public and Guests groups and displays a warning in the backend whenever an administrator logs in if any insecure configurations are detected:

• Trust client IP headers (IP overrides)

Allows Securitycheck Pro to honour IP override headers sent by reverse proxies or CDN services such as Cloudflare (for example, CF-Connecting-IP or X-Forwarded-For) when determining the real client IP address. Enable this option only when your site is behind a trusted proxy or CDN. Enabling it without a trusted proxy can allow attackers to spoof their IP address.

• Trusted proxies

A comma-separated list of IP addresses or CIDR ranges that are considered trusted proxies. Client IP override headers will only be accepted when the request originates from one of the addresses listed here.

• Allow overrides when remote IP is private

When the connecting IP address belongs to a private range (such as 10.x.x.x or 192.168.x.x), allows IP override headers to be accepted even if the proxy is not listed in the trusted proxies field. This is useful in environments that use internal load balancers or reverse proxies.

• Rescue link

Enables the email rescue link (available since 5.2.0, replacing the old OTP unlock), which allows a Super User to unblock an IP accidentally blocked by the dynamic blacklist without manual database intervention. See the Troubleshooting section for details.

• Rescue link mode

Strict (default): the unblock link only works when opened from the blocked IP that requested it. Approval: the Super User receiving the email can confirm the unblock from any device, which also allows unblocking other blocked administrators.

• Rescue grace period (minutes)

After a successful rescue, the unblocked IP cannot re-enter the dynamic blacklist for this number of minutes (default 30). The firewall filters keep inspecting and blocking individual malicious requests during this period.

• Rescue link base URL

Base URL of your site (e.g. https://www.example.com) used to build the unblock link sent by email. If left empty, Joomla's global "Site URL" setting is used instead. If both are empty, the unblock link cannot be built safely and the rescue feature is automatically disabled — there is intentionally no fallback to the request URL, which an attacker could spoof via the Host header. Enter the site root only, without /administrator.

• Proactive rescue email

When a privileged user with an active session is blocked (session protection, a hijack attempt, or a firewall false positive), automatically emails that user a recovery link, without them needing to request it. The email is sent to the address of the blocked account, and only to accounts allowed into the backend plus any extra groups selected below.

• Extra groups eligible for rescue

By default the proactive email is sent only to users who can log into the administrator area (Super Users, Administrators, Managers and any custom backend group). Select here any additional user groups that should also receive it, for example front-end editors. Leave empty to keep only backend-capable users.

• Rescue file (FTP recovery)

Allows recovering access without any web form: whoever has FTP or hosting access can drop a file containing a per-site secret into the component's rescue/ folder, and the firewall unblocks their IP on the next request and deletes the file. Useful when the rescue email cannot be delivered or the backend is hidden or password-protected. See I have been blocked - recovery methods for the full procedure.

• Checkbox position

Configures the position of the selection checkbox (left or right) on the File Integrity, Permissions and Malware screens.

• Include exceptions in database

Controls whether exception entries are stored in the database. Storing exceptions gives you finer-grained control over your files but uses more server resources. Set this to "No" on servers with limited resources if you have your files fully under control.

• Memory limit

Sets the maximum amount of memory (in bytes) that Securitycheck Pro is allowed to allocate. If you have a large site and File Manager or File Integrity scans do not complete, try increasing this value.

• Scan executable files only

When enabled, scans will only process executable files and exceptions will not be stored in the database. This reduces CPU and memory usage and produces lighter scans. Enable this option if you have hosting resource restrictions.

• Remove meta tag

Removes WordPress's generator meta tag from the page source code. When this option is disabled, the version tag is visible in the HTML source and can be used by attackers to identify your WordPress version.

• Disable RSS and ATOM feeds

Disable RSS and Atom feeds if your site does not have readers who consume content through feed readers. Keeping these endpoints active unnecessarily increases the attack surface of your site.

• Avoid proxies

When enabled, proxy headers are ignored when determining the offending IP address, which is the more secure option. When disabled, the X-Forwarded-For header is used to determine the IP address. This is less secure because this header can be forged by an attacker. Note: private and reserved IP ranges are not accepted even when this option is disabled.

• Include exceptions in database

Controls whether exception entries are stored in the database. Storing exceptions gives you finer-grained control over your files but uses more server resources. Set this to "No" on servers with limited resources if you have your files fully under control.