Self-hosting an open-source CRM such as vTiger CRM or SuiteCRM gives you full control over your data and no per-user licence fees. It also makes you responsible for something important: the server that holds your entire customer database. A CRM is a valuable target for attackers, and an unmaintained installation is an easy one.
This checklist covers the essentials we apply to every CRM we host or audit. You don’t need to be a system administrator to use it — but if several items are unticked, it is worth asking whoever manages your server.
Security
Keep everything updated
Most break-ins exploit known weaknesses that already have a fix. Keep the operating system, web server, PHP, the database server and the CRM itself up to date. Remove plugins, extensions and old test installations you no longer use — they still run, even if nobody logs in.
Use HTTPS everywhere
CRM logins and customer data must never travel unencrypted. Install a valid certificate (free ones are widely available), redirect all HTTP traffic to HTTPS, and make sure integrations call the CRM over HTTPS too.
Protect logins
- Give every person their own account; never share logins.
- Enforce strong, unique passwords and change them when someone leaves.
- Limit administrator accounts to the people who really need them.
- If possible, restrict access to the admin area by IP address or VPN, and use two-factor authentication where your setup supports it.
- Block repeated failed logins at the server level.
Lock down the server
- Set correct file permissions so the web server can’t modify the CRM’s code.
- Keep configuration files, backups and logs out of publicly accessible folders.
- Disable PHP execution in upload folders, so an uploaded file can never run as code.
- Use a firewall that allows only the ports you need.
- Give the CRM’s database user only the permissions it needs, with a strong password.
Watch for signs of trouble
Compromised sites often show small clues first: unfamiliar files or plugins, admin accounts nobody created, unexpected scripts in pages, or outgoing spam. Run a malware scanner, review user accounts regularly, and investigate anything you don’t recognise rather than assuming it is harmless.
Backups
Back up the database and the files
A CRM backup has two parts: the database, which holds your records, and the files, which include uploaded documents, attachments and configuration. You need both to restore.
Follow the 3-2-1 approach
Keep at least three copies of your data, on two different types of storage, with one copy off-site — outside the server and ideally outside the hosting company. A backup stored only on the same server disappears along with the server.
Automate, and keep history
Run backups automatically every day, and keep enough history to go back several weeks. Some problems, such as accidental deletions or a slow-moving infection, are only noticed after a while.
Test your restores
A backup you have never restored is only a hope. Every few months, restore a backup to a separate server and confirm the CRM works and the data is complete.
Performance
Size the server for your users
A small team can run a CRM comfortably on a modest server, but performance drops as users, records and attachments grow. Monitor memory, CPU and disk use, and upgrade before staff start complaining about slow screens.
Tune PHP and the database
- Enable PHP’s OPcache, which avoids recompiling the CRM’s code on every request.
- Set sensible PHP memory and execution time limits for imports and reports.
- Give the database enough memory for its cache, and make sure tables are properly indexed.
Configure the scheduler
Both vTiger and SuiteCRM rely on a cron job to run scheduled workflows, send queued emails and clean up old data. If the scheduler isn’t running, automations quietly stop working. Check it is configured and that it actually ran recently.
Keep the data tidy
Large volumes of old logs, deleted records waiting in the recycle bin and unused attachments slow everything down. Schedule regular housekeeping, and archive data you no longer need day-to-day.
Monitoring and maintenance
- Uptime monitoring that alerts you if the CRM stops responding.
- Disk space alerts — a full disk can crash the database and corrupt data.
- Certificate expiry alerts, so HTTPS never lapses.
- A monthly maintenance routine: apply updates, review users, check backups and scan for malware.
Self-host or use managed hosting?
Self-hosting works well when someone owns the server and has time for the routine above. If that isn’t true for your business, managed CRM hosting can give you the same control over your data while someone else handles updates, backups, monitoring and security. Either way, the checklist is the same — the only question is who ticks the boxes.
We host and maintain vTiger CRM installations and can audit an existing server against this checklist, from updates and backups to performance tuning.
