Further Security Steps

WHMCS includes many features to help keep your data safe, but you can take recommended additional steps to secure your WHMCS installation further.

Recommended Steps

We recommend:

1. Securing the writeable directories by moving them to a non-public location.
2. Securing the configuration.php file by adjusting its permissions.
3. Securing the crons directory by moving it to a non-public location.
4. Protecting your Admin Area by restricting access to a specific set of IP addresses and renaming the admin directory.
5. Disabling any unneeded database privileges.
6. Protecting sensitive data by enabling SSL.
7. If you are not using Apache, ensure against serving requests directly from the vendor directory.
   The .htaccess file within the vendor directory will suffice to protect against this for servers running on Apache.
8. Defending against clickjacking by always sending the proper Content Security Policy (CSP) frame-ancestors directive response headers.
9. Performing general server hardening measures (for example, cPanel's or OWASP's best practices).

Additional Questions

If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance.