XenForo security checklist for forum owners
Ten checks that protect your forum: two-step verification for staff, fewer administrators, updates, backups and trusted add-ons only.
Updated 3 min read By the D.C Style team
On this page
Most forum break-ins don't use clever exploits. They use a staff password that leaked, an administrator account nobody needed, or software that was never updated. These ten checks close those doors. Most take a few minutes, and none needs a developer.
Protect staff accounts
1. Require two-step verification for the Admin CP
Turn on Setup > Options > Admin control panel > Require two-step verification to access the admin control panel. Administrators then can't reach the Admin CP until they've set up an authenticator app, so a stolen password alone isn't enough.
2. Require it for moderators too
Moderators can see and change a lot. In Groups & permissions > User group permissions, edit your moderator groups and set Require two-step verification (in General permissions) to Yes.
3. Keep administrators few, and limited
Review Groups & permissions > Administrators. Remove anyone who no longer needs access. For the rest, untick Super administrator and give only the admin permissions they use: someone who manages users doesn't need Manage add-ons or Manage options.
Keep software up to date
4. Update XenForo
XenForo releases include security fixes. Tools > Check for upgrades tells you when one is out. Apply them promptly, after a backup.
5. Update your add-ons
Add-ons run with the same access as XenForo itself. Keep them current, and remove the ones you no longer use. Each D.C Style product page can email you when a new version is out. How to upgrade an add-on.
Keep src/config.php tidy
6. Leave debug mode off on a live forum
$config['debug'] = true; is for development. It shows technical details to anyone who hits an error. Make sure the line is absent, or set to false, on your live forum.
7. Switch off the archive installer when you're not using it
Installing from a zip needs $config['enableAddOnArchiveInstaller'] = true;, and for that the web server needs write access to your forum's code folders. XenForo itself warns this may be considered insecure on some hosts. Remove the line once you've finished installing, or use the upload method instead. How to install a XenForo add-on covers both.
8. Treat config.php as a secret
It holds your database password. Never paste it into a ticket, a forum post or a screenshot. If you think it has leaked, change the database password and update the file.
Know what's happening, and be ready to recover
9. Review your logs
Logs > Admin log records what each administrator did in the Admin CP, and XenForo keeps it for 60 days by default. Glance at it now and then, and at Logs > Server error log: a sudden run of errors can be the first sign that something is wrong.
10. Keep backups, and install only trusted add-ons
A recent backup turns any disaster into a restore. Back up your forum and keep at least one copy off the server. Download add-ons only from their developer. "Nulled" or re-shared copies are a common way malware gets onto forums, and there is no way to know what was changed inside them.
Tip: After any scare, run Tools > File health check. It lists files that are missing or have been changed, which is a quick way to spot tampering. Using the file health check.
Still stuck? Open a support ticket if you think a D.C Style add-on is involved in a security problem. Describe what you saw, but don't include passwords or your config.php.