Technical Anshu
Tutorials Blog
🔒 OrangeHRM Security

Secure Your OrangeHRM Server with HTTPS Backups and Access Rules

Salary-adjacent details, ID numbers, home addresses, leave history — your OrangeHRM database is the one file in the office an attacker would frame. Securing it is not advanced work; it is four habits done consistently.

✍️ Technical Anshu🔒 HTTPS and Backups🛡️ Access Rules
🎥 Watch the complete OrangeHRM server setup in the video, step by step

People lock the office door every night and then run the HR database over plain HTTP with a shared admin password and no backup. This guide fixes that imbalance with the four controls that actually matter for a small-office OrangeHRM server: HTTPS, accounts, backups and updates — in that order of urgency.

What you are protecting — the honest inventory (illustration)
ORANGEHRM DATABASE CONTAINS Names, addresses, phone numbers ID and document attachments Joining dates, job and pay-grade data Leave, attendance and timesheet history Emergency contacts of every employee

Read this list before deciding how much security is "enough" for your HR server.

1

HTTPS — Even Inside the Office

Without HTTPS, every OrangeHRM login crosses the network readable — including the admin password, on office Wi-Fi, every morning.

  1. On a LAN-only server, use a certificate for your internal name or IP — a self-signed certificate users accept once, or a proper certificate if the server has a domain name
  2. If staff reach OrangeHRM from outside the office, HTTPS is not optional at all — and reconsider whether it should be reachable from the internet directly; a VPN into the office is the safer pattern for a small setup
  3. After enabling HTTPS, confirm the plain HTTP address no longer serves the login page
2

Accounts — the Cheapest Security You Will Ever Buy

  1. Individual admin accounts only (see the roles guide) — no shared logins, ever
  2. Strong, unique passwords for admins; the OrangeHRM password must not be the Wi-Fi password or the email password
  3. Disable leavers' accounts the day they leave
  4. Audit the Users list quarterly — delete test accounts and forgotten logins
  5. The database user OrangeHRM connects with should have rights only over the OrangeHRM database, and the database itself should not be reachable from the network — only the web server talks to it
3

Backups — Database Plus Files, Off the Machine

An OrangeHRM backup is two things, and taking one without the other is the classic half-backup:

  1. The MySQL/MariaDB database — a scheduled dump, for example with mysqldump on Linux or your backup tool on Windows
  2. The uploaded files — employee document attachments live in the OrangeHRM folder on disk, not in the database
  3. Copy both off the server — an external drive kept elsewhere, or cloud storage the office controls
  4. Test a restore once on a spare machine. A backup you have never restored is a hope, not a backup

Ransomware and disk failure do not check whether your data is "only HR". The office that can restore last week's OrangeHRM shrugs; the one that cannot, rebuilds from memory and paper.

4

Updates — Boring, Scheduled, Done

  1. OrangeHRM, PHP, the database and the operating system all release security fixes — put them on one monthly maintenance slot
  2. Back up before every OrangeHRM upgrade, and read the upgrade notes for your version jump
  3. Remove the installer leftovers and sample/test accounts from the original setup if any remain
  4. Keep the server's own login (Windows/Linux) restricted to the people who maintain it
5

If You Suspect a Leak — the First Hour

  1. Change the admin passwords and disable any account you do not recognise
  2. Take the server off the network while keeping it powered — evidence first, cleanup second
  3. Check the Users list for new accounts and the records for unexpected changes
  4. Tell the owner plainly and early — HR data incidents handled quietly in hour one become office scandals in week two
  5. Restore from a known-good backup only after you understand how access happened, or the same door stays open
🔴 Honest framing: none of this makes a server invincible — it makes your office a hard, unrewarding target with a way back if something still goes wrong. For HR data, that combination is what "secure enough" honestly means.

🎥 Watch the Complete Setup Video

See the full OrangeHRM server setup on screen — installation, configuration and the first login, step by step.

▶️ Watch Full Video
❓ Common Questions (FAQ)

Do we need HTTPS if OrangeHRM is only used inside the office?

Yes, once real data is in. Office Wi-Fi and LANs are not as private as they feel — anyone on the network can potentially read unencrypted logins. HTTPS on an internal server is a one-time setup; a captured admin password is a permanent problem.

What exactly should we back up for OrangeHRM?

Two things together: the MySQL or MariaDB database (the records) and the OrangeHRM folder's uploaded files (document attachments). Keep copies off the server machine, on a schedule, and test restoring them once — an untested backup is only a hope.

Is it safe to let employees log in from home?

It can be, with the right pattern: HTTPS always, and preferably access through the office VPN rather than exposing the OrangeHRM server directly to the internet. Individual ESS accounts make remote access manageable; a shared login makes it unauditable. Decide as policy, with the owner, not as a favour to one person.

This guide is based on the Technical Anshu OrangeHRM video • Stuck on a step? Ask in the video comments 🙏