# Security hardening **URL:** \ **Category:** ℹ️ Support\ **Tags:** security, modsecurity\ **Created:** [October 20, 2024, 1:39pm UTC](https://help.nextcloud.com/t/security-hardening/207246 "2024-10-20T13:39:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![sdamico95](https://help.nextcloud.com/letter_avatar/sdamico95/32/6_22734026db12803ebb3e059622ac3534.png) [@sdamico95](https://help.nextcloud.com/u/sdamico95)\ **Post date:** [October 20, 2024, 1:39pm UTC](https://help.nextcloud.com/t/security-hardening/207246/1 "2024-10-20T13:39:47Z")
Hello, I installed Nextcloud using docker images and for the moment it is running fine. I installed nginx with WAF (mod\_security) in order to implement https on my cloud server, in order not to expose directly nextcloud to internet. However I had to disable some events preventing nextcloud to work well due to usage of specific HTTP methods such as PUT, PROPFIND, etc which mod security is blocking normally. Now I would like to enforce again security with MFA for NextCloud. Does someone have experience with this ? Thanks, Stéphane ---
**Author:** ![jtr](https://help.nextcloud.com/letter_avatar/jtr/32/6_22734026db12803ebb3e059622ac3534.png) [@jtr](https://help.nextcloud.com/u/jtr)\ **Post date:** [October 20, 2024, 1:45pm UTC](https://help.nextcloud.com/t/security-hardening/207246/2 "2024-10-20T13:45:54Z")
Note that officially `mod_security` [is not supported](https://docs.nextcloud.com/server/latest/admin_manual/issues/general_troubleshooting.html#web-server-and-php-modules) with Nextcloud. In any case, others have found some ways of using it, but my impression is so many rules have to be disabled that it’s debatable how useful it remains. Use the _search_ function here on the forums and you’ll find other people’s experiences. ---
**Author:** ![sdamico95](https://help.nextcloud.com/letter_avatar/sdamico95/32/6_22734026db12803ebb3e059622ac3534.png) [@sdamico95](https://help.nextcloud.com/u/sdamico95)\ **Post date:** [October 20, 2024, 2:11pm UTC](https://help.nextcloud.com/t/security-hardening/207246/3 "2024-10-20T14:11:34Z")
Hi, Thanks for your feedback John. This is exactly my current concern. I think it is still worth having it in place, I did not deactivate so many events by the way, but I don’t like to allow such methods as HTTP PUT, etc. on Internet without strict control. Today I made a strict restriction with firewall but that obliges to have fix IP address. That’s why I would really like to enforce security by other means, especially MFA. So I would really enjoy to know if people could implement MFA with Nextcloud and how they made it work. Best regards, Stéphane ---
**Author:** ![jtr](https://help.nextcloud.com/letter_avatar/jtr/32/6_22734026db12803ebb3e059622ac3534.png) [@jtr](https://help.nextcloud.com/u/jtr)\ **Post date:** [October 20, 2024, 6:10pm UTC](https://help.nextcloud.com/t/security-hardening/207246/4 "2024-10-20T18:10:30Z")
If my MFA you mean 2FA, see [here](https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/two_factor-auth.html). ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [October 20, 2024, 7:56pm UTC](https://help.nextcloud.com/t/security-hardening/207246/5 "2024-10-20T19:56:14Z")
please review [How to maintain, check and improve the security of your Nextcloud installation](https://help.nextcloud.com/t/how-to-maintain-check-and-improve-the-security-of-your-nextcloud-installation/152060) ---
**Author:** ![sdamico95](https://help.nextcloud.com/letter_avatar/sdamico95/32/6_22734026db12803ebb3e059622ac3534.png) [@sdamico95](https://help.nextcloud.com/u/sdamico95)\ **Post date:** [October 20, 2024, 9:40pm UTC](https://help.nextcloud.com/t/security-hardening/207246/6 "2024-10-20T21:40:50Z")
Hi Josh, Yes 2FA is a subset of MFA. Great, I’ll have a look at your link, thanks ! Stéphane ---
**Author:** ![system](https://help.nextcloud.com/user_avatar/help.nextcloud.com/system/32/29333_2.png) [@system](https://help.nextcloud.com/u/system)\ **Post date:** [January 18, 2025, 9:40pm UTC](https://help.nextcloud.com/t/security-hardening/207246/7 "2025-01-18T21:40:50Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.