Default security settings in Confluence

We provide pre-configured solutions with the most secure settings as default. Our mission is to unleash the potential of every team, prioritizing security every step of the way. Confluence comes with a set of default settings that provide administrators with the assurance that the product is secured immediately after installation, without requiring any additional steps.

All our Data Center products offer exceptional flexibility in terms of configuration. Many settings can be adjusted during the installation or pre-configuration process. In our commitment to strengthen security measures, we've implemented a range of default settings to mitigate the most common threats and vulnerabilities, thus reducing the risk of unintentionally exposing critical systems due to misconfiguration.

The following settings list with corresponding documentation will assist you in elevating the security level of your Confluence instances. Some of the documents below contain child pages. Refer to them as well to enhance the security of your instance.

1. Deployment

This documentation covers the process of deployment and includes: supported platforms, requirements, end-of-life policies, network setup, security protocols, infrastructure configurations, and the installation and configuration of software components such as Java, Tomcat, and databases.

• Confluence security overview

• Security advisories

• Supported Platforms

• Bundled Tomcat and Java versions

• End of support announcements:

  • End of Support Announcements for Confluence

  • Atlassian Support End of Life Policy

• Installing Java for Confluence that was installed via zip file

• Configurable system properties and their defaults

2. Setup

This documentation focuses on configuring Confluence after deployment. It includes guides on setting up environments, configuring connection settings, managing data storage, and ensuring that all components support the instance.

• Proxy and HTTPS setup for Confluence

• Configuring Synchrony for collaborative editing

• Database Configuration

• Secure a database password

• Attachment Storage Configuration

• Backup and Restore

• Configuring Mail

• Configuring HTTP Timeout Settings

3. Authentication, authorization, user management, and security

This documentation relates to securing applications and managing user access. It covers authentication and authorization mechanisms, user management, permissions, and security best practices.

• Managing Site-Wide Permissions and Groups

• Configuring User Directories

• Manage Users

• Single Sign-On (SSO) documentation:

  • SSO for Atlassian Data Center

  • SSO for Confluence Data Center

• Configuring Captcha for Failed Logins

• Using Fail2Ban to limit login attempts

• Using Personal Access Tokens

• Confluence Data Model and user authentication table

• Profile settings: password settings, profile’s data, and access tokens

• Permissions and restrictions

• Permissions best practices

• Global Permissions Overview

• Space Permissions Overview

• Page Restriction

• Setting Up Public Access

• Anonymous Access to Remote API

• Configuring Secure Administrator Sessions

• User Email Visibility
  

• Encrypting passwords in server.xml

• Configuring the Allowlist

• GDPR support guides for Confluence Data Center

4. Runtime, performance monitoring, and troubleshooting

This documentation focuses on monitoring and maintaining instances after setup. It includes guides on performance monitoring, handling runtime issues, and troubleshooting common problems.

• Improving instance stability with rate limiting

• Checking audit log of administration events via Universal Plugin Manager

• Auditing in Confluence

• Working with logs

• Disaster recovery

• Data pipeline, security considerations, and access

• Data Collection Policy

• Hiding External Links From Search Engines

• Knowledge Base articles related to Tomcat:

  • Proxying Atlassian server applications with Apache HTTP Server (mod_proxy_http)

  • Securing your Atlassian applications with Apache using SSL

5. Integrations and third-party apps

This documentation covers integrating Confluence with other Atlassian products and creating and integrating third-party apps with Confluence.

• Connecting to Crowd or Jira for User Management
• Confluence mobile app

• Use Jira applications and Confluence together

• Install apps from Atlassian Marketplace

• Managing System and Marketplace Apps

• Security implications while writing user macro

• Integrating Confluence with Other Applications

• Administering the Atlassian Companion App

• Managing and storing mails

• Use a WebDAV Client to Work with Pages

• Developer documentation that is targeting Marketplace partners and app and ecosystem development:

  • How to secure your macro

  • Anti-XSS documentation

  • Enable XSS protection in your app

  • Enable XSRF protection in your app

  • Confluence OAuth 2.0 provider API

  • How to make REST API endpoints available for JWT authentication

  • HTTP authentication with Seraph