Your Matomo Security Checklist

Your analytics hold real business data, so it deserves real protection. But security can feel like an IT job you are not sure how to start. This checklist makes it simple. It turns Matomo security into a clear list you can tick off, from two-factor authentication to API tokens.

Not technical? No problem. Download it and forward it to your IT team in one click. Every item shows a difficulty level and links to the exact documentation, so nobody has to guess.

Download the checklist and lock down your Matomo setup:

What the checklist covers

It is split so you always know what applies to you:

• Cloud and On-Premise: the fundamentals every Matomo instance needs, like least-privilege roles, two-factor authentication, anti-intrusion settings and secure API tokens.
• On-Premise only: the server-level hardening you own, like updates, HTTPS, database security, monitoring, secure cron and locked-down directories.

Built to be actioned, not just read

Every item carries a difficulty level, from easy to advanced, so you can start with quick wins and leave the deeper work for your IT team. Each section links straight to the relevant Matomo documentation, so there is no hunting for how-to steps. Tick as you go, and you end up with a record of what is done.

Security without the trade-off

This is the same principle behind Matomo itself. You protect your data without giving up control of it. Matomo holds ISO/IEC 27001:2022 certification, the most recognised standard for information security, so the platform already meets a high bar. The checklist helps you cover the part that sits with your own team.

Who it is for

Marketers and site owners who want peace of mind, IT and technical teams who own the server side, and anyone inheriting a Matomo account who needs to know it is safe. Start with the Cloud and On-Premise section today, then pass the On-Premise steps to whoever manages your server.

Download the checklist and start with two-factor authentication today.