Chapter 2 

How to secure your data in 

FileMaker Pro web publishing

You can publish FileMaker Pro databases to the Web or to an intranet by using either FileMaker Pro

Instant Web Publishing

 or FileMaker Pro

 Custom Web Publishing

. 

Protecting data for Instant Web Publishing 

To secure your database for Instant Web Publishing, you must use FileMaker Pro access privileges 

to define one or more passwords for users who will be accessing your database over the Web/

intranet. 

Important

  When you use access privileges as the only means of securing your database, any valid 

password is potentially available for use when guests access your database over the Web/intranet. 

The Web Companion permits you to enter any password defined in your database. If someone is 

aware of a valid password, they can enter that password through a browser's password dialog box. 

This includes master passwords, which provide access to the entire file. Even if you define unique 

passwords for web only users, there is no way to disable your master password(s). Make sure that 

any master passwords you define are difficult to guess and are known only to those who need to 

use them. As FileMaker Pro access privileges are the only means of providing security through 

Instant Web Publishing, you should use Custom Web Publishing and the Web Security Database if 

you require a different level of security.

For more information about FileMaker Pro access privileges, see the 

FileMaker Pro User's Guide

and the FileMaker Pro online Help.

Defining passwords

To define a web access password using FileMaker Pro access privileges:

1. 

Open your database file, then choose 

File

 menu 

> Access Privileges > Passwords.

If you see the 

Change Password

 command instead of the

 Access Privileges 

command, you have 

opened the file as a guest, or with a password that provides limited access. To create additional 

passwords, you must reopen the file as the host, with a master password.

2. 

In the Define Passwords dialog box, type a password in the 

Password

 box.

If you want web users to have access to your database without being prompted for a password each 

time they access it, you can define a 

blank

 or empty password. This password can be given the same 

restrictions as any other password, for example, no modification or deletion privileges. 

When users access a database that contains a blank password from the Instant Web Publishing 

home page, they will not be prompted for a password and will automatically be assigned the blank 

password's privileges. This minimizes the ability to use master passwords. It also provides a way 

for all web users to access the database without being given passwords in advance. The 

disadvantage is that users who do need to log in with an alternate password will not be able to do so.