As someone responsible for IT-security, I have to state that everything has been done that can reasonably be expected to keep people’s data safe.

Therefore I want to ask in the round:

Did you do anything further to protect your CiviCRM installation as:

  • keep CiviCRM up to date
  • keep the CMS up to date
  • keep the operating system up to date
  • encrypt the site via SSL
  • block unused ports
  • keep client computer up to date?

Thanks in advance, Benedikt

2 Answers 2


Besides keeping things up to date as you mentioned, a number of security principles can be helpful from steps needed for PCI Compliance. There are a couple of questions here about that topic:

Here is another helpful question/answer about security and Civi, but with reference to Joomla (same principles apply really): Installing CiviCRM - best security practices

Agreeing with Erik, using SSL is at the top of the best practices list (you can check your site's security for free with https://www.ssllabs.com/ssltest/). With "SSL" as a practice though, you will want to adjust your ciphers to disallow known vulnerabilities. Limiting your server to just TLSv1.1 and TLSv1.2 is becoming the standard (and just TLSv1.2 is preferred if you don't need to support older browsers). Our payment vendor (iATS) requires the use of a service like TrustWave that scans our setup once per month (and ad hoc as needed) and lets us know of any vulnerabilities and updates needed to maintain PCI Compliance.

As a piece of that, you will also want to make sure your whole site defaults to HTTPS, not just the Civi sections. Google's search results looks favorably on sites which are entirely HTTPS, and with HTTP/2 now becoming a reality for folks, the speed hit should be mitigated (somewhat). Lullabot has a great deep dive on the topic: HTTPS Everywhere: Security is Not Just for Banks

As far as server practices go, keeping OpenSSL and OpenSSH updated are crucial. Closing ports that are not used, or limiting them based on IP address, is another helpful step to take.

A perhaps obvious step to take is to double and triple check your Drupal and Civi permissions and make sure access to data is limited to only those parties who need it and nothing more. This is especially pertinent if it's been a while since the CMS and Civi were first installed. Time often creates complacency.


The key operative word is ofcourse 'reasonably' :-) I do not have in-depth knowledge of server security or configuration but I tend to explain that the most secure setup is the one where your public facing website and CiviCRM are on separate servers. The first should be in the WWW, the second in a VPN. Ideally the two communicate via CiviProxy so you can configure which API calls will be acceptable and which not etc.

Obviously this is also the most costly alternative, and it also means you can just use CiviCRM Webform out of the box as it assumes CiviCRM and Drupal are on the same server.

Generally I advise organizations to check every security patch, and decide if installation is required or not. Ideally with the new LEXUM approach the security releases should not also have new and exciting functionality which then requires you to re-test some of your vital processes. But always take an informed decision on your environment would be my recommendation, not necessarily automatically install every update without doing your own thinking.

And I would certainly recommend usign SSL.

Good luck, share you decision with us if you can?

  • I'm curious to know if you found a way to run Webforms across 2 servers as you described.
    – Coleman
    Commented Jan 18, 2017 at 21:21
  • 1
    No I wish we had Coleman! as more organizations are interested in this approach I do believe there is a good chance of getting a co-funded project together. Björn and I have tentatively named it CiviMcRestFace.... Commented Jan 19, 2017 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.