Revision as of 17:03, 16 March 2009

The guide below describes various extra steps you can take to further secure your WHMCS system.

Move the attachments, downloads & templates_c folders

The three folders "attachments", "downloads" and "templates_c" need to be writeable by WHMCS and therefore require the permissions 777 (writeable by all). When folders have this permission level it is safer to place the folders outside of the public accessible folder tree on your website. WHMCS allows you to do this. If you do move the folders, then you must tell WHMCS where they have been moved to by adding the following lines to your configuration.php file:

$templates_compiledir = "/home/whmcs/templates_c/";
$attachments_dir = "/home/whmcs/attachments/";
$downloads_dir = "/home/whmcs/downloads/";

Note that if you are running suphp or phpsuexec you should not make the mode changes as the folders will already be writeable. In fact, you cannot set folder or file permissions to be 777 when running suphp or phpsuexec - the highest permissions are 755 for both folders and files.

Change your WHMCS Admin Folder name

Malicious users who visit your site and recognise a WHMCS install will know that they can try logging into your admin area via the admin folder. To protect against this, you can rename the admin folder name to any name you like. You cannot move the folder - only rename it. You can then tell WHMCS what the name of that folder is for the links in admin notification emails by adding the following line to your configuration.php file:

$customadminpath = "myadminname";

Replace "myadminname" above with the new name you just gave to your admin folder.

Also remember to reissue your whmcs license after doing this, otherwise, you will be unable to login to your admin area. To do this, login to your client area at www.whmcs.com/clients, click on 'My Licenses', click on the edit icon next to your license and then on the 'Reissue License' button.

Finally, if you have already created a cron job, or one has been created for you, you will need to update the path on the cron as well.

php -q /home/mylogin/public_html/secure/myadminname/cron.php

Secure your template files

The index.php in the template directories only protects you if someone enters the root of a particular directory. However if they know the exact file name they are looking for, it is very possible that the contents of the file will be output into the browser. Particularly for Smarty .tpl files.

To stop access to your .tpl files into your .htaccess file in the web root of your site.

<Files ~ "\.tpl$">
Order allow,deny
Deny from all
</Files>

<< Back to Installation Overview