How the emergency rescue file works, and how to use it safely

If you're reading this, here's a quick explanation of one of SecurityCheck Pro's recovery options: the emergency "rescue file" (FTP recovery).

It exists for one specific situation: you're locked out of your site by the firewall, and you can't get back in through the normal rescue email or the backend. The Control Panel shows you a unique file name and a secret (both generated per site); to recover access, you drop a plain text file with that exact name and content into the component's rescue/ folder and reload the site once. The firewall detects it, removes your IP from the dynamic blacklist, grants it a short grace period, and deletes the file automatically — it's single-use.

This is a two-step process that happens at two very different times, and it's important not to mix them up:

• Save the file name and secret now, while you still have backend access — write them down somewhere safe (a password manager works well). You won't be able to reach that panel screen once you're actually locked out, so this has to be done in advance.
• Only create and upload the actual file when you're actually locked out, right before reloading the site — never before, never "just in case."

Why the second part matters: the file doesn't check who is using it, only that the requesting IP is currently blocked. That's fine if you upload it right when you need it. But if it's left sitting in the folder afterward, or created ahead of time as a standing precaution, it becomes a race: whichever blocked IP requests the site next gets unblocked — and that could be an attacker who just got blocked by the firewall for something like a SQL injection attempt, instead of you. This isn't theoretical — it's exactly what happened in a case a user recently reported to us: an attacker's IP was blocked by the firewall, and their very next request consumed a rescue file that had been left in place from an earlier, unrelated use.

To be clear, this doesn't compromise your site's protection in general — the WAF keeps inspecting every request regardless, and the rescue file only affects the dynamic IP blacklist. But it's an easy mistake to make, so the latest version makes the timing requirement a lot more visible: there's now a highlighted warning directly on the Control Panel screen and in the rescue folder's instructions.

Summary:

• Note down the file name and secret today, before you ever need them.
• Don't place the file on the server until the moment you're genuinely locked out.
• Delete it immediately afterward if it isn't consumed automatically.

Full details in the manual: scpdocs.securitycheckextensions.com/troubleshooting/rescue_link