FreePBX Security & Cost Risk Calculator

It scores your answers across three areas: the security controls you have in place, your outbound calling profile, and the operational scale of the phone system. Those scores map to bands, and the downtime figure applies the hourly impact you selected to an illustrative outage length. It reads nothing from your system and stores nothing, so treat it as an indication rather than an assessment of your actual configuration.

Any internet facing PBX can be attacked, and FreePBX is no exception. In practice the common routes in are weak or reused extension secrets, SIP ports exposed without firewall restrictions, trunks that accept traffic from any source, and unpatched versions. Most incidents come down to configuration rather than a flaw in FreePBX itself.

Toll fraud is when someone gains unauthorised use of your phone system and places calls through it, usually to expensive international or premium rate destinations. The traffic looks legitimate to the carrier because it leaves through your own trunk, so the charges land on your bill. It often runs overnight or across a weekend, before anyone notices.

In layers. Strong unique secrets on every extension and trunk, a firewall that only accepts SIP from where it should, trunks locked to the carrier IP ranges, brute force protection such as fail2ban, outbound routes that allow only the destinations the business actually calls, concurrent call limits, and a spending cap at the carrier so anything that does get through is capped in cost.

Start at the network edge and work inwards: restrict what can reach the SIP and management ports, configure the Responsive Firewall properly rather than simply enabling it, disable anonymous SIP, use TLS and SRTP where the handsets support it, keep FreePBX modules and Asterisk patched, and restrict outbound dialling to what the business needs. Then verify that the backups actually restore.

FreePBX is as secure as its configuration. The project ships sensible defaults and useful security modules, but a system is only protected once the firewall, authentication, trunk restrictions and outbound rules have been set for how the business actually uses it. A default install left open to the internet is the usual source of trouble.

Version and patch status for both FreePBX and Asterisk, which services are reachable from outside, authentication and secret strength, trunk configuration and IP restrictions, inbound and outbound route rules, international dialling controls, concurrency and spending limits, encryption settings, and whether backups restore. The findings should be written down and ranked by risk so you can act on them in order.

A short review once a year suits most businesses, plus a check after anything that changes the attack surface: a version upgrade, a new SIP trunk or carrier, new remote extensions, a firewall change, or a new integration.

Yes. A fixed scope audit works on the system as it stands, whoever originally built it. You get a written findings report with the issues ranked by risk, which you can either action yourself or hand back to us to implement.

Yes. We normally start with the audit so the work is scoped against what is actually there, then apply the firewall, authentication, trunk and outbound controls, document the resulting configuration, and verify the backups by restoring one.