Emergency Mode - Completely Lock Down Website

Tom · 2026-08-13T17:23:43+00:00

Hallo zusammen, die Frage von Mirko habe ich mir in Bezug auf die Akeeba Admin Tools auch schon gestellt, insbesondere weil deren Emergency Shutdown offensichtlich mit der automatischen Wiederherstellung der htaccess-Datei von HTProtect kollidiert. Beim Emergancy Shutdown, ersetzen die Admin Tools die vorliegende htacess-Datei mit einer eigenen sehr restriktiven htaccess-Datei. Sobald HTProtect eine Modifikatin der htaccess-Datei feststellt, installiert es seinerseits wieder die eigene htaccess-Datei. Die beiden Erweiterungen arbeiten an dieser Stelle also gegeneinander. Deshalb habe ich entschieden, die Admin Tools zu deinstallieren. Gleichzeitig wäre es aber wünschenswert, wenn HTProtect einen eigenen Emergency Shutdown Button an prominenter Stelle (z.B. in rot im Dashboard) anbieten würde, damit man per HTProtect schnell einen nachhaltigen Emergence Shutdown auslösen kann. Gruß Tom

Tom

Hey everyone,

I’ve been wondering about Mirko’s question in relation to Akeeba Admin Tools as well, especially since their Emergency Shutdown seems to clash with HTProtect’s automatic htaccess file restoration. With Emergency Shutdown, Admin Tools replace the existing htaccess file with their own very restrictive version. Then, as soon as HTProtect detects any changes to the htaccess file, it reinstalls its own htaccess file. So basically, these two extensions are working against each other here.

That’s why I decided to uninstall Admin Tools. At the same time, it would be great if HTProtect offered its own Emergency Shutdown button somewhere prominent (like a red button on the dashboard) so you could quickly trigger a reliable Emergency Shutdown directly through HTProtect.

Cheers
Tom

Pascal

Hi Tom,

The emergency mode can be activated under backend access – this requires that the /administrator password protection has been set up via HTProtect.
It then simply extends to the frontend.

Cheers
Pascal

Tom

Hi Pascal,
this is great for people who have set up backend password protection using HTProtect. However, I wish it was also possible for those who don't have this because they protect the backend differently. I imagine it would just require a conditional check and two slightly different htaccess files, one with password protection and one without. For the latter, the htaccess from Admin Tools could serve as a model.
Cheers
Tom

Pascal

Tom Please take a look at the 2.6.10 - the emergency mode (under the Backend Access menu) has now been consistently redesigned with an access link and cookie setting.

Tom

Hi Pascal,

Not bad 😉. I tested it on my test website with the current 2.6.12. Here’s my test procedure and the results:

Verified that my admin email works 😀
Turned off HTProtect’s automatic monitoring (so I don’t get locked out in an emergency and can manually overwrite the .htaccess)
Activated Emergency Shutdown
Copied the secret site URL into a text editor (in case the email doesn’t arrive)
Checked email (emergency mode activated – your access link worked) 😀
Navigated to the website frontend
This message appeared:

Service Unavailable
The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.
Additionally, a 503 Service Unavailable error was encountered while trying to use an ErrorDocument to handle the request.

ERROR: The content of /htp-maintenance.html is not being interpreted 😒

Diff between the new .htaccess of the test site and the .htaccess of the official site

ERROR: Language of the official site’s .htaccess changed (was English before, now German) – probably due to an issue with one of the recent automated HTProtect updates on the official site 😒

In the test site’s .htaccess, section 0 was added at the start. At its end is the directive:

ErrorDocument 503 /htp-maintenance.html

ERROR: This HTML file obviously isn’t used. I myself add a different ErrorDocument directive later in the Custom Rules end, but that’s also not used (probably because it doesn’t call a fixed HTML file) 😒

Suggestion 1: Either the "ErrorDocument 503 ..." directive should be moved to the very end of the emergency .htaccess, or all Custom Rules should be removed. I’m also wondering if we even need any other sections of the .htaccess in emergency mode besides section 0? Maybe everything after that can be left out?

Suggestion 2: It would be great to make /htp-maintenance.html configurable in advance (so you can enter your own HTML code).

Admin log-out and log-in without closing the browser (without deleting cookies) works. 😀
Admin log-out, close browser (delete cookies), log-in doesn’t work as intended. 😀
Access via the secret URL

WARNING: This URL only takes you to the frontend, not the backend. To get to the backend, you have to open the backend URL afterwards without closing the browser (without deleting cookies). 😒

Suggestion: This should be clearly documented so people don’t feel like they’re “locked out.”

Generating a new link works (new email, log-out, close browser, log-in, 503 message, secret link works) 😀
Exiting emergency mode works 😀
Log-out, close browser, log-in works for both frontend and backend 😀
Turned automatic monitoring back on

Thanks for your effort. I hope this helps clear the last hurdles.

Cheers
Tom

Pascal

Hey Tom,

thanks for testing! 🙂

Turned off HTProtect’s Automatic Monitoring (so I don’t get locked out in an emergency and can manually overwrite the .htaccess)

The Automatic Monitoring (and thus the htprotectwatch system plugin) isn’t really meant to be turned off, since parts of the emergency mode rely on it. Anything that could cause a lockout is or can be caught.

The system plugin is basically HTProtect’s “central brain” and shows the fixed footer banner for active emergency mode in both frontend and backend – including a link in the backend to disable it – so it can’t be forgotten or overlooked.

So I think most of the points become irrelevant, right(?). Except maybe for a clear note about it.

For the description, I think a WYSIWYG editor field would be enough instead of a plain textarea, to allow the necessary flexibility (formatting, links)?

Maybe with a note that you could also just customize the whole /htp-maintenance.html file. After all, it’s just an emergency mode, where the #1 goal should be to disable it as quickly as possible.

Cheers
Pascal

Tom

Hi Pascal,

Now that the emergency mode has been reworked, I’ve taken my test as a beta test. With a test like this, I have to expect that things might not always go as planned. That’s why I turned off Automatic Monitoring before testing, just to be safe, and turned it back on afterward. That doesn’t mean I’d recommend doing this in regular use.

But I don’t think that makes most of the suggestions irrelevant. Or are you saying that disabling Automatic Monitoring would cause the large .htaccess file I saw—with all sections from 0 to 9 and B—to be replaced by a small one containing only section 0?

Also, I think it would be great if the Emergency Button was more prominently placed. From experience, I know that in a real emergency, you’re so stressed it’s hard to find the right spot to click. Having it at the top of the Overview page would be ideal, or at least at the top of the Backend Access page.

By the way, I really like the idea of setting an emergency cookie and having a secret link.

Cheers,
Tom

Pascal

Hi Tom,

That's true and it has now also pinpointed some uncertainties and potential errors.

From version 2.6.13 (probably later tonight), when you click "Disable automatic monitoring," a confirmation dialog will explicitly advise against disabling the automatic monitoring or the htprotectwatch system plugin.
ErrorDocument 503 is now placed at the end, after the Custom Rules, to make sure it kicks in properly.
Block 0 remains intact, as does the rest of the HTProtect .htaccess, since the site's behavior shouldn't change—aside from the minimally invasive block added.
You can now configure the emergency mode's headline and WYSIWYG text even before activating it.
There's now a subtle one-liner with a link to emergency mode on the overview page.

Cheers
Pascal

Pascal

Version 2.6.13 with the improvements is now available as an update.

https://htprotect.org/changelog#v2.6.13

Tom

Pascal There's now a subtle one-liner with a link to Emergency Mode on the overview page.

Hi Pascal,
sorry for the late reply. Everything’s fine so far, but the one-liner with the link to Emergency Mode is all the way at the bottom of the overview page. So for me, after scrolling, it’s pretty easy to miss:

Honestly, that’s not a very prominent spot that catches your eye right away in an emergency (i.e. when you’re stressed). I was thinking more along the lines of something like the notice on the Backend Access page with the big red button:

But that would need to be at the top of the overview page so you can find it quickly without much thought. Alternatively, maybe just moving that section from the bottom to the top of the Backend Access page would do the trick.

Cheers
Tom

Pascal

Hi Tom,

I think making the emergency mode more prominent isn’t the best idea. HTProtect is supposed to prevent those situations – having an emergency button always visible upfront sends the opposite message. Plus, it’s rarely needed and just takes up space the rest of the time.

I’d rather see it added where people actually click in an emergency: the Joomla offline mode. That’s often used in these cases but only helps so much against a hack. So a note right there would be perfect:

“Offline blocks visitors, but not attackers. → HTProtect emergency mode”

That way it’s easy to find in a panic, without getting in the way day-to-day.

What do you think?

Cheers
Pascal

Tom

Hi Pascal,

I think placing the emergency mode more prominently isn’t the best idea. HTProtect is meant to prevent those situations – having an emergency button always visible front and center sends the opposite message. Plus, it’s rarely needed and just takes up space the rest of the time.

HTProtect has tons of great, useful features and really stands out positively compared to other extensions. Still, from my experience, no software has ever been 100% secure. And honestly, I’m skeptical that will ever change. With an automated startup tool like HTProtect, I worry about things like “supply chain attacks.” Any admin with some experience should realize there’s no such thing as perfect security. That’s why I think it makes sense to prepare even a top-notch suite like HTProtect for the unlikely emergency. Experienced admins will see this not as a weakness but as a smart, forward-thinking addition to the suite.

For example: Akeeba’s Admin Tools put the Emergency Offline mode right at the top of the Control Panel, very visible, and it’s still highly respected and popular.

I’d prefer if the emergency mode was also placed where people actually click in a real emergency: the Joomla offline mode.

Honestly, I never would have thought to use Joomla’s offline mode in an emergency. Maybe that’s because before I ever had to deal with an emergency, I’d already read the Admin Tools manual and even generated and checked out an emergency htaccess file with it.

So, the one-liner with a link to the emergency mode at the very bottom of HTProtect’s overview page is a nice idea, but in my opinion, it probably won’t get found in a real emergency and just takes up space. I’d remove it from there.
The Joomla offline mode can be found with one click from the dashboard (Global Configuration) and activated with a second click without scrolling. That’s already pretty good. If there was a red button or something labeled “HTProtect Emergency-Offline Mode” right above or below that, it would definitely help those used to using Joomla’s offline mode.
When I log into the backend as an admin, I land on the dashboard, where under the “System” category there’s the new green “HTProtect - protection active & up to date” button. Next to that, I’d like to see a red “HTProtect - emergency offline” button. It wouldn’t have to trigger the emergency mode immediately; it could just take the user to the page where the actual emergency offline button is. That way, there’d be a safeguard against accidentally triggering it.

Cheers
Tom

Pascal

Hi,

Emergency Offline is now placed directly in the Components menu right after Overview (2nd item) and also in the System Configuration:

If someone doesn’t notice it there or read the docs at the start, well, tough luck. 😉

Adding more than a system quick icon to the control panel would be just as annoying as having it up top in the HTProtect overview – that would eat up about 1/6 of the screen on mobile.

Cheers
Pascal