Instance security score and checks

What the Security tab shows

Every instance has a Security tab in its console. It rates how well that Odoo database is protected, from 0 to 100, with a letter grade, and lists every check behind the rating with a short explanation and a fix for each one that fails.

The checks look at two things:

• Inside the database: who the administrators are, whether people use two-factor authentication, default passwords, API keys, failed logins, and data that visitors can reach without signing in. A scan collects these facts once a day, after every restart and after every upgrade.
• The instance's settings: the Odoo version, the Odoo configuration, the security switches, the SSL certificate and backups. These are read live, so they are always current.

Who can see it

The Security tab appears for the workspace owner, admins and members who hold Instance settings on that instance, the same permission that shows the Settings tab. See Member permissions and resource access.

Open the Security tab

1. Open the project and then the instance.
2. Click the Security tab (the shield icon). On narrow screens only the icon shows. A red dot on the tab means at least one critical check is failing.
3. The top card shows the score, the grade and how many checks fail at each severity: critical, high, medium and low. When nothing fails it shows No issues found.
4. Under the score you see when the database was last scanned. Settings checks are always current.
5. The Checks card lists every check, failing ones first and the most severe at the top.
6. The Administrators card lists each user with full Settings access in Odoo, whether they use two-factor authentication, when they last signed in (UTC), and the addresses they signed in from in the last 24 hours, partly masked.

You can also reach this tab from the workspace Security page by clicking an instance. See The Security page: every instance and member at a glance.

How the score works

Every instance starts at 100. Each failing check takes points off, more for a critical check than for a high one, and so on down to low. The grade follows the score:

• A: 90 or more
• B: 75 to 89
• C: 60 to 74
• D: 40 to 59
• F: below 40

Checks marked Advice cost no points. They are shown because they are worth considering, but the right answer depends on how the instance is used. For example, a public website cannot have an IP allowlist.

Read a check

Each check shows an icon:

• A green tick: the check passed.
• A red cross: the check failed. It shows a severity badge, a sentence explaining the risk and, after a light bulb, what to do about it. Click Show details to see the logins, addresses or files involved.
• A blue information icon: advice, which costs no points.
• A grey question mark: Not checked yet. The database has not been scanned, so the check is neither passed nor failed. It turns into a real result after the next scan.

What is checked

People and accounts in Odoo:

• Administrators without two-factor authentication (critical): an administrator who signs in with a password alone. A stolen password gives full control of the database.
• Administrators using a default password (critical): an administrator whose password is a well-known one such as "admin".
• Users without two-factor authentication (high): internal users who have not turned it on.
• Built-in "admin" account still active (medium): the original administrator still signs in as "admin", the first login anyone tries.
• Number of administrators (medium): more than 3 users with full Settings access.
• Odoo API keys (low): API keys that belong to administrators or never expire.
• Inactive user accounts (low): active users who have not signed in for 90 days.
• Public sign-up (low): anyone can create a portal account.
• Failed login attempts (medium, or high when it looks like password guessing): many failed logins in the last 24 hours. The details list the addresses they came from.

Data reachable without a login:

• Business records readable without a login (high): an installed module lets visitors who are not signed in read customer, sales, accounting or HR records.
• Public attachments on business documents (high): files attached to invoices, orders, contacts or HR records that are marked public, so anyone with the link can download them.

Instance settings:

• Odoo version support (high): the Odoo version no longer receives security fixes.
• Database manager exposed (medium): list_db is on in the Odoo configuration, which shows the web database manager.
• Security headers (medium): clickjacking and MIME-sniffing protections are off.
• Login rate limiting (low): nothing slows down password guessing on the login page.
• Content Security Policy (advice): no policy limits where scripts can load from. A strict policy can break parts of Odoo, so this is your call.
• IP allowlist (advice, production only): production is reachable from any address. Fine for a public website, worth restricting for a back-office-only database.
• SSL certificate (high, or critical once expired): the certificate expires within 14 days and has not renewed.
• Recent backup (high, production only): the newest backup is more than 48 hours old, or there is none.

Fix a failing check

Follow the hint under the check. Most fixes are in one of two places:

• In Odoo itself, for checks about users, passwords, 2FA, API keys, sign-up, modules and attachments. For example, each user turns on two-factor authentication under My Profile, Account Security, and Odoo 17 and later can enforce it for everyone in Settings, Permissions.
• In the instance's Settings tab, for the configuration checks: Security for security headers, rate limiting, CSP, the IP allowlist and blocked addresses; Odoo for list_db; Domain for the SSL certificate. See Instance settings explained. Backups are under the Backups tab. See Backups and restore.

When results update

• A fixed setting clears its check as soon as you reload the tab.
• A fix made inside the database (enabling 2FA, changing a password, archiving a user) shows after the next scan. Scans run daily and after every restart and upgrade. To scan right away, use the scan button on the Security page (see The Security page: every instance and member at a glance), or restart the instance.
• If the last scan is more than 3 days old, the tab says so, because the database checks may be out of date.
• An instance whose database is hosted elsewhere, such as an app node in a high-availability cluster, shows a note: user checks run where that database lives.

Tips

• Start with critical and high checks. Turning on two-factor authentication for administrators usually moves the grade the most.
• A low grade on a staging or development instance still matters: it is a working copy of your Odoo, reachable on the internet like production.

Related: Two-factor authentication (2FA), Instance settings explained, Member permissions and resource access, Backups and restore.

If you get stuck, open a support ticket from the Tickets page or the chat widget.