We're looking at deployment for a client who's sensitive to being hacked, so we want to put CiviCRM behind, say, nginx running mod_security2. Has anyone used a WAF with CiviCRM that can share recommendations?

2 Answers 2


we have a slightly different approach for an enhanced security architecture using a proxy-server plus vpn. If you are interested, please sind more information plus code on GitHub, there was also a session on last year's CiviCon.

Let me know if you have any questions regarding CiviProxy.

Kind Regards Fabian


I've configured CiviCRM behind both Pound and NginX. Both worked perfectly well, no complaints. If there were any special configurations required, they can't have been troublesome enough to remember :)

You will need to ensure CiviCRM is capable of "accessing itself", since some requests (eg dashboard contents) are made to the current CiviCRM website. This includes DNS / web access from the webserver CiviCRM is running on - see this answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.