CiviCRM Community Forums (archive)

Hey,

The more people can see and audit the code, the more bugs and security holes can be fixed. Be sure the webserver doesn't have write access to anything else than strictly needed, choose safe passwords, enforce that you users have safe password, use ssl, harden your php on the server, run rootkit checks, audit the logs, ban IP addresses that scan ports, be sure you don't share your server with compromised or badly installed programs...

Long list, and only the tip of the iceberg. Security is hard and even big banks running financial services get hacked.

This being said and assuming you don't have the technical knowledge and  time to install and run and verify

1) Be sure you update your software and follow the announcements about new versions
2) Use open source software that are widely used
3) Be damn sure your users know about never giving their password, and how to pick up a strong one, and change it

The last one is where you are more likely to get hacked through, and probably the hardest part to protect.

Good luck

X+