Your phone system holds your customer conversations, your call recordings and a direct line to your phone bill. That makes it worth protecting as carefully as your email. 3CX has published a security checklist for Version 20, and we've turned it into a plain-English guide to what matters and who looks after it.
Security on 3CX isn't one setting you switch on. It covers who can log in, how your network is set up, how calls travel, the phones on your desks, and what happens after go-live. If we host and manage your system, most of this is already done for you.
Control who can get into your phone system
A login to your phone system is a login to your business conversations, so treat it that way. Everyone should have their own login, and admin accounts should be kept separate from the accounts people use to make calls.
- Remove accounts for people who have left, and check access whenever someone changes role.
- Keep a short list of who can manage users or open the Admin Console.
- Treat setup files, QR codes, SIP passwords and voicemail PINs as sensitive. Anyone holding them can set up a phone on your system.
Resetting phone passwords or setup details usually means setting those phones up again, so plan the change instead of doing it on a busy morning.
Use your Microsoft 365 or Google login
If your team already signs in to Microsoft 365 or Google with multi-factor authentication, 3CX can use the same login through single sign-on (SSO). That's one fewer password for people to forget or reuse, and your phone system follows the same login rules as the rest of your business.
Console Restrictions
Only lets admins open the Admin Console from the office, your VPN or other locations you trust.
IP Blacklist
Blocks or allows traffic to the whole system, and works with 3CX's global list of known bad addresses.
Check that the address you're working from is allowed before you switch on Console Restrictions, or you can lock yourself out. Be careful with allow lists too, because anything on them skips 3CX's anti-hacking checks.
Lock down your network and firewall
If 3CX runs in your own building or on a server you host yourself, your firewall is part of your phone system's security. Only open what your setup and your SIP trunk provider actually need.
- Use a supported web address for your system and set up DNS correctly, inside and outside the office.
- Turn off SIP ALG on your router. It's a common cause of one-way audio and dropped calls.
- Run the 3CX Firewall Checker after setup and after any network change.
- Keep the phone system separate from networks that hold sensitive data it doesn't need to reach.
Who looks after what
If you host 3CX yourself, the server, firewall and network are your responsibility. When we host your system in our Equinix London private cloud, we look after that infrastructure for you. Logins, user roles and the phones on your desks still need care, and we help with those too.
Encrypt your calls and look after your phones
3CX can encrypt both the setup of a call and the voice itself, using Secure SIP with TLS and SRTP. Every device and service on the call path has to support it, so 3CX lets you run it in two modes.
Enabled
Encrypted and unencrypted calls work side by side while you test.
Enforced
Every call must be encrypted. Switch this on once all your phones have been tested.
Keep desk phone firmware up to date, protect each phone's web settings with a strong password, and never leave those settings open to the internet. 3CX also blocks addresses that keep failing to log in, so check those blocks as part of your regular reviews.
Keep security going after go-live
Most security problems start months after setup, when updates slip or nobody is watching the alerts. Keep 3CX and the system it runs on updated, and make sure your backups actually restore. A good recovery plan covers:
- A protected place for backups, and a named person responsible for recovery.
- Regular test restores, so you know the backup works before you need it.
- Everything your phones depend on: the server or cloud account, your SIP trunk provider, DNS and the phones themselves.
- What will happen when passwords, certificates or phone setup details change.
3CX can send alerts for blocked hacking attempts, network or DNS failures, trunk outages, available updates, backup status and low disk space. Send them to a mailbox someone checks every day. If you use a central security monitoring tool, 3CX Remote Syslog can forward security and admin events to it.
Our view
This checklist is a lot to keep on top of if phones are one of many jobs on your list. It's the work we do every day for the systems we manage: updates, backups, alerts, firewall rules and the questions that come after. If you'd rather know it's being handled, that's what we're here for.
If you work in healthcare, legal or finance, read how we keep call recordings and transcripts private on our regulated sectors page.
Talking to us about your 3CX security
If you'd like us to check your 3CX system against this list, book a free consultation and we'll tell you honestly what needs attention and what's already fine.