Chapter 1 

Introduction to

FileMaker Pro web security

FileMaker

 Pro software enables you to create powerful database solutions and publish them to 

your intranet or the Internet, so that users browse, search, and update the databases through a 

browser. 

When FileMaker Pro databases are used individually, shared on a peer to peer basis, or shared 

using FileMaker Server, FileMaker Pro security consists of 

passwords

 and

 access privileges

. 

Passwords protect access to your databases, and the access privileges associated with those 

passwords determine your guests' ability to create, edit, delete, or export records, design layouts, 

and so forth. This is a security model that is both simple and powerful. Because sharing with 

FileMaker Pro guests or the Local and Remote Data Access Companions should only take place 

within the protected environment of a local area network, there is virtually no risk of an outside 

attack; data shared in these situations is very secure.

When you share your FileMaker Pro databases over the Web or over an intranet, your networking 

environment is more complex, and your security needs are typically more complex as well. In those 

situations, you can use either access privileges or the FileMaker Pro 

Web Security Database

 with 

Custom Web Publishing to protect your databases. Before you publish your databases on the Web, 

carefully consider your security needs, and follow the security procedures explained in this 

document. As the primary purpose of this document is to provide guidelines for FileMaker Pro web 

security, other aspects of web security are identified more generally. For more information about 

these topics, consult your network administrator, third party documentation, or other network 

professional.

The security concerns for your web published databases can be divided into two broad categories: 

the need to protect your database files from outside attacks, and the need to protect your actual data 

from being improperly viewed, manipulated, or deleted.

Protecting your databases from outside attacks

Physical security

First, consider the physical security of your host machine. The host computer should be a dedicated 

machine stored in a locked room, where it is secured to an immovable object such as a large desk, 

computer cabinet, or specialty anchoring hardware. The machine should be secured so that its hard 

drive cannot be removed. Also consider the physical security of backup copies of files and 

databases that may be stored on portable media, such as tapes and diskettes. Finally, access to the 

host machine should be controlled, and only the minimum number of people necessary to deploy 

and maintain your databases should have access to it. 

You may not need this degree of security, but be aware that each step removed from the ideal 

represents an increase in the physical vulnerability of your host machine.