Skip to main content
Share Your Experience: Take the 2024 Developer Survey
8 votes

How secure is CiviCRM?

CiviCRM does not do anything special to either keep your data secure or insecure. It stores data in a MySQL database like lots of other applications. The security is more in the way you configure ...
ErikH - CiviCooP's user avatar
7 votes

Security approach

Besides keeping things up to date as you mentioned, a number of security principles can be helpful from steps needed for PCI Compliance. There are a couple of questions here about that topic: ...
Allen Hutchison's user avatar
6 votes

How secure is CiviCRM?

CiviCRM is a web-based tool and has no desktop component. It is thus as secure the server which hosts it, be that a local one or a remote one. There are occasionally security flaws found in the ...
Hershel's user avatar
  • 735
6 votes

How do I update CiviCRM following a security update?

First of all, I should say that this is a job for someone who is reasonably technically minded and comfortable with using the command line. If this doesn't sound like you, then I would suggest that ...
William Mortada's user avatar
6 votes
Accepted

Is automatic new Drupal user to existing CiviCRM contact linking a possible security vulnterability?

It is but isn't specific to civicrm - the problem in that scenario is allowing anonymous signup without either administrator approval or email verification. Set at least the setting in drupal user ...
Demerit's user avatar
  • 23.1k
5 votes

Does anyone use CiviCRM behind a Web Application Firewall?

we have a slightly different approach for an enhanced security architecture using a proxy-server plus vpn. If you are interested, please sind more information plus code on GitHub, there was also a ...
Fabian's user avatar
  • 3,597
4 votes

How do I update CiviCRM following a security update?

Please follow the steps in the link one by one Link: https://wiki.civicrm.org/confluence/display/CRMDOC/Upgrading+CiviCRM+for+Drupal+7#UpgradingCiviCRMforDrupal7-1....
Ramesh - ARTECH Consultancy's user avatar
4 votes

Need help in getting quote for security upgrades

It can be time consuming and thus expensive to do security upgrades, especially on a site that has custom code. Monitoring requires some setup and sometimes an ability to respond quickly when ...
Joe Murray's user avatar
  • 6,741
4 votes
Accepted

When using PayPal, we DON'T want to collect credit card info!

I've not tried all these options out, but looking at the documentation for Payment Processors (user guide and system administrators guide there is more than one PayPal payment processor. With PayPal ...
Mick Kahn's user avatar
  • 3,227
4 votes
Accepted

Get CiviCRM working without internet connection

Ok it turns out civicrm will work fine without internet when civicrm.org does not get resolved to an ip address. So in the normal scenario when there is simply no internet connection at all, ...
Gellweiler's user avatar
4 votes

Multi-Factor Authentification?

CiviCRM doesn't because it doesn't control logins. Whatever CMS you're using will have something for it (e.g. Drupal/Wordpress/Joomla).
Demerit's user avatar
  • 23.1k
3 votes

How do I prevent a user from adding contacts to ACL groups?

There is a useful little CiviCoop extension called group-protect to mark a group as protected. You can use this to protect your ACL groups and assign a permission to those who should edit them.
Aidan's user avatar
  • 13.5k
3 votes

Security approach

The key operative word is ofcourse 'reasonably' :-) I do not have in-depth knowledge of server security or configuration but I tend to explain that the most secure setup is the one where your public ...
ErikH - CiviCooP's user avatar
3 votes

Cron not working after forcing https

The most likely causes for breakage with this change are: Cron job is pointing to HTTP only curl by default will not follow 302 redirects, while wget will. If you're using curl, it won't work ...
Chris Burgess's user avatar
3 votes

GDPR and CiviCRM for a small but internationally operating and serving organisation

There is no individual resource as such that holds the answers to your question. There are currently still a significant amount of unknowns surrounding GDPR. Some of your issues can be resolved ...
remco's user avatar
  • 31
3 votes

How can I tell if Remote Profiles are in use?

It's not 100% but you can identify submissions that are local origin by referer in the web logs. Additionally, any POST that is not from an external form will have a preceding GET for the same form ...
Jon G - Megaphone Tech's user avatar
3 votes
Accepted

What are the security considerations before allowing access AJAX API to anonymous users?

Is the visibility for your field defined in the profile as Expose Publicly and also with the Searchable checkbox checked? You might not have to fiddle with permissions. Otherwise to directly answer ...
Demerit's user avatar
  • 23.1k
3 votes
Accepted

IDS causing site to fail for lots of visitors

The first problem can be avoided by checking 'Skip IDS check' in Drupal permissions. I have this checked for my clients, and it hasn't resulted in any problems. The second message is 'normal' - I'm ...
Andy Clark's user avatar
  • 4,845
3 votes

How secure is CiviCRM

Adapted from my response on MM: In terms of penetration testing that's host specific, the point of penetration testing is to test the entire system, it's as much about your local/server configuration ...
HomoTechsual's user avatar
  • 1,138
2 votes

How do I set up an API key for a user?

To add an API key to an existing contact in API Explorer v4: navigate to Support > Developer > API Explorer v4. In the "entity" drop-down menu select "contact", in the &...
Toby-fz's user avatar
  • 31
2 votes

How do I stop the new "Security Notifications" that civi pops up for upgrades

Marsh's answer is correct for Civi 4.6. For versions 4.7+, go to Administer menu » Administration Console » System Status and press "Hide" next to the version check message. You can choose to hide ...
Jon G - Megaphone Tech's user avatar
2 votes

Security Warning on Dashboard (pantheon / nginx)

Pantheon allows you to protect (a limited number of) webpaths, using a pantheon.yml file. protected_web_paths: - /example_directory (https://pantheon.io/docs/pantheon-yml/#protected-web-paths) It ...
user18099's user avatar
  • 121
2 votes

Is there a way to encrypt a single field in Civi database?

We were recently asked to 'Encrypt one CiviCRM custom field' for one of our clients who uses Webform CiviCRM module as a GUI to view/edit/add custom field values to CiviCRM for their clients. I ...
KarinG - Semper IT's user avatar
2 votes

Is civicrm-buildkit safe to use in production?

Buildkit is not designed for production use but I can't think of any reason it can't be used that way. As your second question suggests, the upgrade procedure will indeed be different. Steps for ...
Coleman's user avatar
  • 18.7k
2 votes
Accepted

Outdated CiviCRM, blind SQL injection risk on parameters? (PCI compliance failure)

CiviCRM 4.5.x branch has stopped receiving security updates a very long time ago. Best to upgrade to 4.6.x or 4.7.x as soon as possible! If you need help - find a partner near you in the partner ...
KarinG - Semper IT's user avatar
2 votes

Call to undefined function dl() error w/Joomla 3.5.1 & PHP 7

I learned that php7 is not supported yet. https://wiki.civicrm.org/confluence/display/CRMDOC/CiviCRM+PHP+Requirements
Greg's user avatar
  • 51
2 votes

Storing Personally Identifiable Information

Encryption is fascinating, but when you think it through, it's often not as attractive as you might want. Basically - you've got two kinds of encryption: symmetric encryption - a robust and fast ...
Alan Dixon's user avatar
  • 6,851
2 votes

Storing Personally Identifiable Information

Hitting the right keywords is always fun. Here's a partial answer, from the how-to side of the question. Is there a way to encrypt a single field in Civi database?
G H's user avatar
  • 1,146
2 votes

Storing Personally Identifiable Information

We're in Canada - but no we don't store SINs for any of our projects. We don't store Credit Card numbers (PCI compliance dictates that) - and one could argue that having your SIN/SSN stolen is far ...
KarinG - Semper IT's user avatar
2 votes

How do I perform a security update

Depends on your CMS - Here is the link https://wiki.civicrm.org/confluence/display/CRMDOC/Installation+and+Upgrades Always backup first - It is kind of like doing an instal except you do not need to ...
Josh Mailman's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible