Odoo Security Best Practices: A Checklist

Your ERP holds customer data, prices, bank details and payroll. Securing it is not optional. Use this checklist for any Odoo system, with extra items for self-hosted servers.

Access and login

• Strong passwords for every user, and a password policy where available.
• Two-factor authentication for all users, at least for administrators and finance.
• Remove old users when people leave. Archive rather than delete, to keep history.
• No shared accounts. Every action should be traceable to a person.

Access rights

Give users only the rights they need. Do not make everyone an administrator to save time. Review groups and record rules before go-live and once a year after. Read our segregation of duties guide for finance roles.

The database manager

The /web/database/manager page can create, copy, drop and download databases. On production:

• Set a long, unique master password (admin_passwd)
• Disable the manager with list_db = False, or restrict it by IP
• Use dbfilter so only the right database is served

HTTPS and the network

• Serve Odoo only over HTTPS through a reverse proxy.
• Do not expose the Odoo port or PostgreSQL to the internet.
• Restrict SSH to key-based logins from known IPs.

API keys and integrations

Use API keys per integration, not user passwords. Give integration users the minimum rights needed. Rotate keys when staff or vendors change.

Updates

Apply Odoo security fixes and OS updates regularly. On self-hosted systems, pull the latest code for your version from the official repository and test on staging first.

Custom and third-party modules

Install modules only from trusted sources. Review custom code for unsafe use of sudo(), raw SQL and public routes without access checks.

Backups

Encrypted, off-site and tested. See our Odoo backup and restore guide.

Monitoring

Watch failed logins, server errors and unusual exports. Keep logs long enough to investigate incidents.

Quick wins this week

1. Enable two-factor for admins.
2. Lock down the database manager.
3. Remove users who have left.
4. Test a backup restore.

Want an independent review? Our ERP audit covers security, access rights and hosting.