Self-Hosted Bitrix24 Security Hardening: 25-Point Checklist

Why does on-premise Bitrix24 need explicit security hardening?

Self-hosted Bitrix24 deployments shift full security responsibility to your team, and audits of live installations consistently reveal seven critical gaps - including outdated OS environments, disabled 2FA, missing HSTS headers, and unrestricted admin panel access - that must be explicitly remediated.

Moving to a self-hosted CRM gives you full data sovereignty, but it shifts the entire security responsibility to your team. Cloud deployments benefit from vendor-managed patching and perimeter controls; on-premise portals do not. Based on security audits conducted on live Bitrix24 on-premise installations, the most common critical findings are:

• Outdated OS and web environment (nginx, Apache, PHP, database)
• PHP error display enabled in production
• Two-factor authentication (2FA) disabled for all users
• Missing HSTS headers and incomplete HTTP → HTTPS redirect
• Admin panel accessible from any IP address
• Outdated or unreviewed Bitrix24 modules
• Modified core files without documentation

The checklist below maps directly to these findings and orders items by priority: critical first, then high, then medium/low.

For context on why organisations choose on-premise in the first place, see Self-Hosted CRM: Why Choose Bitrix24 On-Premise for Data Sovereignty.

How the Checklist Is Organised

This checklist covers five security layers - OS and network, web server, database, application, and access control - ordered from outermost perimeter to innermost controls, with each layer's checks sequenced by priority: Critical first, then High, then Medium and Low.

The five security layers this checklist covers and how they relate to each other. Each layer's controls appear in priority order within its section.

The layered security model for a self-hosted Bitrix24 server: the OS and network form the outer perimeter, the web server and database sit in the middle tiers, and the Bitrix24 application layer - including access control and monitoring - forms the innermost rings.

Layer 1 - OS and Network (Checks 1-5)

Layer 1 contains 5 controls - upgrading to a supported OS, automating patches, configuring a firewall with an IP blocklist, restricting inbound ports to 80/443 plus trusted-IP SSH, and disabling root SSH login - with checks 1 and 2 rated Critical and checks 3-5 rated High priority.

Why it matters: In a representative audit of a production Bitrix24 portal, the server was running CentOS 7 with a web environment versioned 7.5.1 - three major releases behind the current 9.0.7. The OS itself had known CVEs with no available fixes on the end-of-life branch. The recommended path is to migrate to a supported OS release and redeploy using the official Bitrix24 virtual machine image, which ships with a pre-hardened environment.

Layer 2 - Web Server: nginx and Apache (Checks 6-10)

Layer 2 covers 5 web server controls - upgrading nginx and Apache, adding HSTS with a 31,536,000-second max-age, enforcing HTTP-to-HTTPS redirects, enabling clickjacking protection, and removing server version tokens - with check 6 rated Critical and checks 7-8 rated High priority.

HSTS in practice: The absence of HSTS allows protocol-downgrade attacks. Adding the header takes under five minutes - edit the nginx server block for the portal's HTTPS virtual host. Verify the existing HTTP → HTTPS redirect is unconditional; a common misconfiguration leaves direct IP access over HTTP unredirected.

Layer 3 - Database (Checks 11-15)

Layer 3 contains 5 database controls - upgrading MySQL/Percona, disabling local_infile and Query Cache, increasing innodb_log_file_size to at least 256 MB, and fixing DB structure errors - with check 11 rated Critical and checks 12-15 all rated High priority.

From a real audit: A 28 GB production database was running Percona Server 5.7 (recommended: 8.0), with local_infile = ON, query cache enabled, and innodb_log_file_size set to 64 MB. The Bitrix24 system check reported six database structure errors, five of which could be fixed automatically. The combination of an outdated engine and misconfigured parameters created both a stability and a security risk.

Note: Always take a full database backup before changing InnoDB log file parameters. Resizing innodb_log_file_size requires a clean server shutdown and file removal on older MySQL versions.

Layer 4 - Bitrix24 Application Layer (Checks 16-21)

Layer 4 covers 6 application controls - upgrading PHP, disabling display_errors in php.ini, updating and pruning modules, auditing modified core files, reviewing third-party components, and raising Proactive Protection to High - with check 16 rated Critical and checks 17 and 21 rated High priority.

PHP error exposure - a critical finding: With display_errors = On in production, a request that triggers an error can leak full file system paths, SQL query fragments, and internal configuration details to any visitor. This is classified as a high-severity finding because it turns routine application errors into active reconnaissance data for an attacker.

Core file integrity: In one audit, 23 files out of 109,188 had been modified (0.02%), spanning the CRM, IM, extranet, location, socialnetwork, tasks, and vote modules. While the overall modification level was rated "low", undocumented core changes are a supply-chain risk - they may break on the next platform update, or conceal backdoor logic. Every modified file should be compared against the vendor baseline and either justified in a change log or reverted.

If you are planning a fresh installation or migration to on-premise, the Bitrix24 Onboarding Questionnaire: 50+ Questions to Ask Before You Start covers the infrastructure decisions that affect your security baseline from day one.

Layer 5 - Access Control and Authentication (Checks 22-25)

Layer 5 contains 4 controls - enabling 2FA for all users, restricting admin panel access to an IP allowlist, configuring RBAC by role, and scheduling recurring Security Scanner runs - with checks 22-24 rated High and check 25 rated Medium priority.

2FA is the highest-ROI single control: It is rated "high importance / low effort" - implementation takes roughly 30 minutes for the whole portal using the Bitrix24 OTP application. Yet in practice it is frequently disabled on production portals, leaving credential-stuffing attacks unblocked.

IP restriction on the admin panel: Limiting /bitrix/admin/ (and ideally the entire portal) to a VPN or office IP range eliminates the entire class of brute-force and exploit-scanning attacks that target exposed admin interfaces. This is straightforward to implement in nginx with an allow/deny block.

RBAC matters beyond security: Proper role configuration - managers see only their own deals, team leads see their department, admins see everything - is also a data governance requirement under most regional data protection regulations. For CRM-specific role setup examples, see the Bitrix24 Implementation Cost & Timeline: Real Data from 1,200+ Projects article, which discusses scope decisions that affect role complexity.

Priority Summary Table

The priority summary table sequences all 25 checks into four tiers: 4 Critical items (checks 1, 6, 11, 16) requiring a planned maintenance window, roughly 20 High items completable in 1-3 days, Medium items running in parallel, and Low items schedulable at convenience.

Use this table to sequence remediation work. Address all Critical items before moving to High.

How do you run the built-in Bitrix24 security audit?

Bitrix24 on-premise ships with four built-in diagnostic tools - System Check, Security Scanner, Quality Monitor, and Proactive Protection settings - all accessible from the admin panel and should be run both before and after applying the hardening checklist to establish a baseline and confirm remediation.

Bitrix24 on-premise ships with several diagnostic tools accessible from the admin panel:

1. System Check (/bitrix/admin/site_checker.php) - validates web environment versions, PHP configuration, and database structure.
2. Security Scanner - scans for known threat signatures. Note: if the scanner terminates prematurely with a status error, resolve PHP configuration and cache issues first, then re-run. If the problem persists after environment updates, open a ticket with Bitrix24 support.
3. Quality Monitor - detects modified core files across all installed modules.
4. Proactive Protection settings - configure WAF-level rules, set the security level for the admin group, and enable the web antivirus module.

Run all four tools before and after applying the checklist to establish a baseline and confirm remediation.

How do you maintain Bitrix24 security after hardening?

Maintaining a hardened Bitrix24 on-premise posture requires six recurring processes: monthly platform and module patching, web environment upgrades within 90 days of major security releases, weekly IP blocklist reviews, quarterly access reviews, monthly backup restore tests, and an annual full security audit.

Security hardening is a point-in-time activity; maintaining posture requires process:

• Patch cadence: Check for Bitrix24 platform and module updates at least monthly.
• Web environment updates: Track nginx, Apache, PHP, and database release notes; plan upgrades within 90 days of a major security release.
• IP blocklist hygiene: Review and refresh firewall blocklists weekly; consider integrating a threat-intelligence feed.
• Access review: Quarterly review of user roles and admin-panel access lists; disable accounts for departed employees promptly.
• Backup verification: Monthly test restore from backup - a backup you have never restored is unproven.
• Re-audit: Schedule a full security audit annually, or after any significant customisation or infrastructure change.

For teams evaluating whether on-premise is the right choice compared to cloud, the Bitrix24 vs HubSpot: An Honest Comparison for SMBs article includes a total-cost and security-responsibility breakdown that is relevant to this decision.

Working with a partner on self-hosting. Want the control of self-hosted Bitrix24 without running the server yourself? ACP Group can deploy and operate it for you - see managed self-hosted Bitrix24, support & maintenance plans, or request a turnkey deployment quote.