CMS Security for ProcessWire

Security is our number one priority with ProcessWire. Make it your number one priority too. In this section we attempt to cover some of the more important aspects in maintaining a secure installation.

Beyond just using ProcessWire to power your site or application, a big part of maintaining good security involves securing your web server and file system, writing secure code in your template files, installing only the modules/plugins that you need, securing your admin panel, and adhering to security best practices. In this section we attempt to cover some of the more important aspects in maintaining a secure installation.

  • Securing file permissions

    Getting your file permissions right is one of the most important factors in maintaining the security of your ProcessWire installation, particularly in non-dedicated/shared environments.
  • Securing your admin

    Information about the design and purpose of the admin environment and how to protect it. Overview of securing your admin, preventing attacks, SSL certificates, tracking logins, enabling 2FA, managing page edit access and other security best practices.
  • Web hosting security

    When possible, your production sites running ProcessWire (or any CMS) should ideally be in a dedicated environment. This doesn't necessarily mean a dedicated server…
  • Migrating to production

    Unless the production server is a completely dedicated environment, don't assume that what was safe on your development server will also be safe on the production server.
  • Remove unnecessary files

    ProcessWire comes with several files that you will no longer need after installation.
  • Database-driven sessions

    Database-driven sessions offer potentially better security since the session information is not stored on the file system.
  • Running ProcessWire alongside other software

    ProcessWire will happily run alongside almost any other PHP application, including other CMSs. However, security on your site will only be as good as the weakest link.
  • Third party modules

    We can vouch for the security of the code that we write in the ProcessWire core, but we can't vouch for the security of third party modules. Follow these guidelines to maximize your security with third party modules.
  • Template files

    While ProcessWire handles a lot of the common security considerations before your template files are even loaded, you should also follow security best practices within your template files as you would in any other PHP framework.
  • 2-factor authentication

    Two factor authentication gives you an extra layer of account security relative to just using a password. ProcessWire comes built-in with support for 2-factor authentication, and this page provides more information on how to enable and use it.

Twitter updates

  • Happy New Year! Today I’ve bumped the version on the dev branch to 3.0.170, and it’s quite a lot of updates. This post covers most of them. In this post, there’s also a question for you: what would you like to see in ProcessWire in 2021? More
    1 January 2021
  • In this week’s blog post we’ll take a brief look at a powerful new ProFields module for ProcessWire that’s just around the corner—the Combo field: More
    4 December 2020
  • There’s a new modules directory on the ProcessWire site now up and running. In this post we’ll cover a few details about what’s changed and what’s new—More
    20 November 2020

Latest news

  • ProcessWire Weekly #347
    In the 347th issue of ProcessWire Weekly we'll check out ProcessWire 3.0.170, introduce the PDF Fieldtype/Inputfield module, and more. Read on!
    Weekly.pw / 2 January 2021
  • ProcessWire 3.0.170 core updates
    Happy New Year! Today I’ve bumped the version on the dev branch to 3.0.170, and it’s quite a lot of updates. This post covers most of them. In this post, there’s also a question for you: what would you like to see in ProcessWire in 2021?
    Blog / 1 January 2021
  • Subscribe to weekly ProcessWire news

“To Drupal, or to ProcessWire? The million dollar choice. We decided to make an early switch to PW. And in retrospect, ProcessWire was probably the best decision we made. Thanks are due to ProcessWire and the amazing system and set of modules that are in place.” —Unni Krishnan, Founder of PigtailPundits