Securing Odoo: disable the /website/info page exposed by default

By default, every Odoo website publishes a page anyone can reach without authentication, at /website/info. It lists every application installed on your instance. Many companies don't know it exists. Yet it's an information leak you can close in a few minutes. Here is what it exposes, why it's a risk, and how to disable it cleanly.

What the /website/info page reveals

Go to your-domain/website/info (or the language variant /en/website/info). With no password at all, the page shows:

• The full list of installed applications: sales, accounting, CRM, e-commerce, HR, payroll, project, and so on.
• Your custom modules and connectors: bespoke integrations, banking or tax connectors, internal business apps.
• The enabled localisations: charts of accounts and country packs (Switzerland, Portugal, Germany…), which give away your markets and regulatory obligations.

Why it's a security risk

This page falls under the information disclosure category. On its own it grants no access. But it hands an attacker a valuable map:

• Attack surface: knowing every installed module lets an attacker target known vulnerabilities (CVEs) specific to those modules instead of probing blindly.
• Attack prioritisation: the presence of a payment module, a messaging app or an external connector points the attacker at the most sensitive spots.
• Competitive intelligence: your competitors learn for free which tools you run, which markets you serve, and part of your internal setup.

The security principle at stake is simple: disclose only what is strictly necessary. A public page that inventories your system works against it.

Check whether your instance is exposed

Open a private browsing window, so you're not authenticated, and visit https://your-domain/website/info. If an "Installed Applications" page appears, your instance is exposed. Test the language variants too, such as /en/website/info and /fr/website/info.

How to disable the page (3 methods)

Pick one based on your profile. The first two are done inside Odoo; the third, at the server level, is the most robust.

Method 1 — Disable the view in Odoo

1. Enable developer mode (Settings > General > Developer Tools).
2. Go to Settings > Technical > User Interface > Views.
3. Search for the view website.website_info (or "Show Website Info").
4. Open it and untick Active to archive it.

The page then returns an error instead of exposing your modules. Downside: a module update can re-enable the view, so re-check after every version upgrade.

Method 2 — From the website editor

On some versions, open the site in edit mode, go to the Customize tab, and switch off the Odoo Information option. Handy with no technical skill, but the option isn't present in every version.

Method 3 — Block it at the reverse proxy (recommended)

The most reliable method returns a 404 before Odoo even processes the request. It survives updates and covers every URL variant.

• Nginx: add a location ~ /website/info { return 404; } block to your site config, then reload Nginx.
• Apache: block the /website/info path and its language variants to return a 404 (a rewrite rule or a <Location> directive).

Reload the server config, then re-test the URL: you should get a 404 page.

Go further: harden your Odoo

The /website/info page is just one link. Serious hardening also covers:

• The database manager: cut public access to /web/database/manager with list_db = False and a strong admin_passwd in odoo.conf.
• Developer mode: never left on in production.
• Two-factor authentication for every internal account.
• Security updates applied regularly, ideally under a managed maintenance plan.

Need a locked-down, up-to-date Odoo?

We deploy and run hardened Odoo instances, hosted in Switzerland, with security updates applied continuously. If you'd rather not manage the infrastructure, our outsourced back office runs your Odoo for you. Book a free technology audit: we'll check your instance's exposure and hand you a hardening plan.