I have been using CiviCRM for over five years. I am trying to encourage a local charity who provides care to vulnerable people to move to CiviCRM. I have been asked by the project manager the following "I am looking at the security of CiviCRM and wonder if there has been any security testing of the product that you are aware of e.g. hacking of the website or the database? Has there been any penetration of the site performed?" I would like to respond to them and would be grateful for any help, or advice on this.

Regards Graham Clarkson

  • 1
    This is a duplicate of How secure is CiviCRM?.
    – Demerit
    Mar 28, 2021 at 13:51
  • mostly i agree it is a duplicate, though this also specifically asks about what has been done in terms of penetration testing. we have had one client who funded such testing and am sure others have also, which is probably how the last vulnerability that got fixed was picked up. I don't think there is any one place you can find a full summary of those penetration tests as that info would belong to the client/owner who funded it. You may get some more interesting discussion on this in ~townsquare in the chat.civicrm.org/civicrm
    – petednz - fuzion
    Mar 29, 2021 at 4:09
  • Do you not think that is more a question for the hosting party rather than CiviCRM itself? The penetration tests I would do on my site tell a lot about my site but very little about CiviCRM on another site? Mar 29, 2021 at 15:21
  • Thank you for your comments. I did read the original issue before raising this. I thought that the penetration question and the time elapsed since the previous post warranted me raising it again. I will pass all this on and raise it on ~townsquare , as suggested.
    – gcpower
    Mar 31, 2021 at 16:15

1 Answer 1


Adapted from my response on MM:

In terms of penetration testing that's host specific, the point of penetration testing is to test the entire system, it's as much about your local/server configuration as the PHP code. The CiviCRM codebase has benefitted from several third party audits for security which have resulted in security releases but, and this is important. It's only as secure as your server is configured to be.

We could have the best, most secure PHP code in the world - but a minor misconfiguration on your hosting risks negating it entirely.

The security of CiviCRM, like any other application also relies on regular updates to maintain security - for example any version less than 5.35.1 or the latest ESR (5.33.3?) has known security holes unless manually patched (or updated to one of those supported versions)

Some organisations choose to maintain additional security by separating CiviCRM onto a separate host/server from their website or having CiviCRM behind their firewall in their LAN.

There is some information on our security processes and releases here: https://civicrm.org/security

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.