A self-hosted CRM holds names, emails, phone numbers and deal history, so it deserves the same care as any system with personal data. Work through this list before real customers go in.
Server and network
- Force HTTPS with a valid certificate (Let's Encrypt is free, and many hosts such as Hostinger can set one up). Redirect all HTTP to HTTPS.
- Close everything you do not need. Expose only ports 80 and 443 publicly; keep the database private.
- Use a firewall and key-based SSH login. Disable password SSH where possible.
- Keep the OS, web server and runtime patched (PHP, Node, Python, Java).
The application
- Update the CRM when security releases appear. Subscribe to the project's release notifications.
- Change default credentials immediately and remove demo accounts.
- Turn on two-factor authentication for admins if the CRM supports it.
- Use roles and least privilege. Not everyone needs export rights.
- Turn off debug mode in production. Debug output can leak paths, queries and secrets.
Secrets and configuration
- Keep config files with passwords outside the public web root, or make sure the web server cannot serve them.
- Never commit passwords, SMTP credentials or API keys to Git. Use environment variables.
- Use unique, long passwords per service and rotate them if they were ever pasted into a chat, email or ticket.
- Block direct access to data folders,
.json,.logand backup files.
Backups that actually work
- Follow 3-2-1: three copies, two different media, one off-site.
- Back up the database and uploaded files daily, and keep several generations.
- Test a restore on another machine every quarter. An untested backup is a hope, not a backup.
- Encrypt backups that leave your server.
Monitoring
- Set up uptime monitoring and disk-space alerts.
- Review login logs for repeated failures.
- Keep server logs long enough to investigate an incident.
Privacy and compliance
- Only collect the personal data you need and say why in your privacy policy.
- Be ready to export or delete a person's record on request (relevant under laws such as GDPR and India's Digital Personal Data Protection Act, 2023).
- Record who has admin access and remove it when people leave.
Security is ongoing work, not a one-off task. If that sounds like too much, consider an official hosted plan from the project, then move to your own server when you are ready. Browse options in the directory.
Affiliate disclosure: the Hostinger link in this article is an affiliate link. If you buy through it we may earn a commission at no extra cost to you. See our disclaimer.