Self-hosted Odoo security is mostly boundary discipline.
Most production incidents come from exposed database managers, missing HTTPS, weak secrets, and backups that were never restored. Odoo’s deployment documentation emphasizes proxy mode, database filters, and remote backups for good reason.
Secure the platform before customizing apps
The direct answer: place Odoo behind a maintained reverse proxy with TLS, restrict which databases a hostname can load, disable public database creation on production, use strong unique passwords and store the master password offline, keep PostgreSQL private, patch OS and dependencies promptly, and verify backups through full restore drills.
Application-level permissions matter after the network boundary is sane. Field-level security and groups cannot compensate for a public database manager.
HTTPS and proxy configuration
Terminate TLS at Nginx, Caddy, or HAProxy with modern cipher settings and automated renewal. Redirect HTTP to HTTPS. Enable Odoo proxy mode only when the proxy sets trusted headers.
Firewall so only SSH and HTTPS reach the host publicly. Odoo and PostgreSQL should listen on private interfaces or localhost unless you have a deliberate multi-tier design.
dbfilter and the database manager
Configure dbfilter so each hostname maps to intended databases. On production, disable database listing and creation for anonymous visitors. Treat the master password like a root credential — not committed to Git.
Odoo’s deployment guide discusses securing the database manager and using filters on multi-database systems. Review it whenever you add a subdomain.
Patching, monitoring and backups
Apply OS, PostgreSQL, reverse-proxy, and Odoo security updates on a schedule tested in staging. Monitor disk, memory, failed cron jobs, certificate expiry, and backup job success.
Encrypt backups off-server; restore into an isolated environment quarterly. Security includes recovery: ransomware and operator error both require working backups. Read Community backup and restore.
When security labour should be outsourced
Managed providers should document the same controls in their checklist responses. Compare managed Odoo hosting if your team lacks security operations capacity.
Odin runs standard Community with HTTPS, off-server backups, patching, and staging — our commercial interest is managed hosting, but the controls in this article remain the baseline for any serious deployment.
FAQ
Is self-hosted Odoo secure by default?
No. Default installs must be hardened with HTTPS, dbfilter, private PostgreSQL, and secret management.
Should PostgreSQL be on the internet?
No for typical setups. Keep it on private network or localhost.
How often should I test Odoo backups?
At least quarterly for full database and filestore restores, plus after major changes.
Continue the hosting decision
Prefer security operations included?
Odin managed Community ships with HTTPS, off-server backups, patching and staging — compare against DIY security labour.