Answers.Body: <p>There are a couple of other methods that would be worth checking</p>
  
  <ul>
  <li><a href="https://civicrm.org/blog/jamie/display-civicrm-forms-on-any-web-site-anywhere" rel="nofollow noreferrer">RemoteForms</a></li>
  <li><a href="https://github.com/CiviMRF" rel="nofollow noreferrer">CiviMRF</a></li>
  </ul>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-06-13T19:56:40.903Z
Answers.LastActivityDate: 2019-06-13T19:56:40.903Z
Answers.UserDisplayName: petednz - fuzion
Body: <p>When remote profiles are enabled for a CiviCRM site, it says the following:</p>
  <blockquote>
  <p>Warning: External profile support (aka &quot;HTML Snippet&quot; support) is enabled in system settings. This setting may be prone to abuse. If you must retain it, consider HTTP throttling or other protections.</p>
  </blockquote>
  <p><a href="https://civicrm.org/advisory/civi-sa-2016-17-manage-csrf-overrides-for-external-profile-forms" rel="nofollow noreferrer">A page on civicrm.org</a> says the following about &quot;HTML Snippets&quot; (remote profiles):</p>
  <blockquote>
  <p>if your system has used the &quot;HTML Snippet&quot; technique, then you should evaluate measures such as:</p>
  <ul>
  <li>Configure HTTP firewalling to prevent POSTs to CiviCRM from unrecognized referrers</li>
  <li>Replace the &quot;HTML Snippet&quot; with a custom integration that uses a more secure data-flow based on APIv3 and REST.</li>
  </ul>
  </blockquote>
  <p>Using the API for some of our related sites isn't a great option considering how easy it is to add a form to other domains.</p>
  <p>What is HTTP firewalling? Does that require scanning referrers of POST requests, and ensuring that the originate from the CiviCRM instance or trusted sites? Is it possible to do this with a CiviCRM extension? Does such an extension already exist?</p>
  <p>Thanks for your help. : )</p>
  
Tags: <profile><forms><security>
Title: How should a CiviCRM site that uses remote profiles be protected?
ThreadText: # How should a CiviCRM site that uses remote profiles be protected?
  
  (Asked by: username_0 on 2019-06-13)
  
  When remote profiles are enabled for a CiviCRM site, it says the following:
  
  > Warning: External profile support (aka "HTML Snippet" support) is enabled in system settings. This setting may be prone to abuse. If you must retain it, consider HTTP throttling or other protections.
  
  [A page on civicrm.org](https://civicrm.org/advisory/civi-sa-2016-17-manage-csrf-overrides-for-external-profile-forms) says the following about "HTML Snippets" (remote profiles):
  
  > if your system has used the "HTML Snippet" technique, then you should evaluate measures such as:
  >
  > * Configure HTTP firewalling to prevent POSTs to CiviCRM from unrecognized referrers
  > * Replace the "HTML Snippet" with a custom integration that uses a more secure data-flow based on APIv3 and REST.
  
  Using the API for some of our related sites isn't a great option considering how easy it is to add a form to other domains.
  
  What is HTTP firewalling? Does that require scanning referrers of POST requests, and ensuring that the originate from the CiviCRM instance or trusted sites? Is it possible to do this with a CiviCRM extension? Does such an extension already exist?
  
  Thanks for your help. : )
  
  **Tags:** profile, forms, security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-06-13. Score: 1
  
  There are a couple of other methods that would be worth checking
  
  * [RemoteForms](https://civicrm.org/blog/jamie/display-civicrm-forms-on-any-web-site-anywhere)
  * [CiviMRF](https://github.com/CiviMRF)
  
  
  ---
  
  