I am new to CiviCRM and want to use it on a Joomla website.

The question I have is how is the best way to make sure, that the CiviCRM user data is secure?

I am thinking about installing CiviCRM in an second Joomla installation on an separate hosted account so that the main website and the CiviCRM data is completely separated and therefore the attack vector is as small as possible. Is this a too big overhead? How do others do that? Mainly I want to use CiviCRM for global member / participants management.

  • @Acurius: StackExchange's format is designed for a single question per post. Could you post your second and third questions separately: "Secondly I want that event participants are registered automatically in CiviCRM. For that I already tried out the events registration forms, which is functioning well. Third I want to have more people working in CiviCRM but if possible I don't want to give them administrator access in Joomla. Is this possible and if so how?"
    – Joe Murray
    Jan 19 '16 at 22:56
  • yes i understand. Its just that as newcomer its good to describe what you want to do with CiviCRM to get best practices how to do. Because things are interconnected. I think in the old forum there was a place for newcomers, but now the forum seems to be deprecated...
    – Arcurus
    Jan 21 '16 at 15:06

Generally when evaluating security, you need to balance likelihood and severity of threats against the resources available to counter them. A human rights organization that was a client of mine had information on activists in their CiviCRM instance who could be imprisoned or killed by their governments, with sophisticated, well-resourced governments interested in getting that contact information: high threat, high consequences. In that kind of a context it might make sense to avoid exposing your CiviCRM system to the public web. Another client of ours, Nader for President 2008, also used an instance of CiviCRM hosted on a hardened server that was not exposed on the web, using custom software to migrate relevant contact information into CiviCRM.

For the last several years, the supported and generally available releases of CiviCRM require a CMS to be installed on the same server to manage user accounts and permissions.

In your case, I would recommend putting CiviCRM and Joomla! on the same VPS/server, and keeping your Joomla! software up to date with all security upgrades/patches. Follow the Joomla security best practices listed at https://docs.joomla.org/Security_Checklist. A more in-depth practical guide developed for Drupal but containing many generic sections can be found at http://openconcept.ca/drupal-security-best-practices-practical-guide.

  • thx for your answer. I think I will try to install CiviCRM on an separate server and then open the event sign up forms in an pop-up box. So or so I need now to connect two different Joomla websites to one CiviCRM database.
    – Arcurus
    Jan 21 '16 at 15:01

There is an advantage of having Civi on a separate server. The software setup on the main website may not be compatible with Civi. I ran into this problem, and regretted the move. The main website was Drupal 7 so should have been OK, but with hundreds of added modules - at least one of which caused Civi problems. Better to have Civi on a separate server, in my experience.

  • Conflicts in modules or extensions can happen, so that's not a concern specific to CiviCRM IMO - if you identify a conflict you can report the issue via Drupal.org submit issue or CiviCRM's JIRA to help it get addressed. If the main site is overloaded with hundreds of modules, I see sense in start afresh for the CRM, but that advice doesn't necessarily apply generally. Jan 20 '16 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.