|
|
| (9 intermediate revisions by the same user not shown) |
| Line 1: |
Line 1: |
| − | WHMCS includes many features to help keep your data safe, but you can simple additional steps to secure your WHMCS installation further. | + | WHMCS includes many features to help keep your data safe, but you can take recommended additional steps to secure your WHMCS installation further. |
| | | | |
| − | ==Secure the Writeable Directories== | + | == Recommended Steps == |
| | | | |
| − | We recommend moving all writeable directories to a non-public location to prevent web based access. | + | We recommend: |
| | | | |
| − | For more information and steps to do this, see [https://help.whmcs.com/m/installation/l/1650299-securing-writeable-directories Securing Writeable Directories].
| + | # Securing the writeable directories by [https://help.whmcs.com/m/installation/l/1650299-securing-writeable-directories moving them to a non-public location]. |
| | + | # Securing the <tt>configuration.php</tt> file by [https://help.whmcs.com/m/installation/l/1650301-securing-the-configuration-file adjusting its permissions]. |
| | + | # Securing the <tt>crons</tt> directory by [https://help.whmcs.com/m/installation/l/1650302-moving-the-crons-directory moving it to a non-public location]. |
| | + | # Protecting your Admin Area by [https://help.whmcs.com/m/installation/l/1650303-restricting-access-by-ip-address restricting access to a specific set of IP addresses] and [https://help.whmcs.com/m/installation/l/1650304-renaming-the-whmcs-admin-directory renaming the admin directory]. |
| | + | # Disabling any unneeded [[System_Environment_Guide#Database_Privileges|database privileges]]. |
| | + | # Protecting sensitive data by [https://help.whmcs.com/m/installation/l/1650306-enabling-ssl enabling SSL]. |
| | + | # If you are not using Apache, ensure against [[Nginx Directory Access Restriction|serving requests directly from the vendor directory]]. <div class="docs-alert-info">The <tt>.htaccess</tt> file within the <tt>vendor</tt> directory will suffice to protect against this for servers running on Apache.</div> |
| | + | # Defending against clickjacking by [https://owasp.org/www-community/attacks/Clickjacking always sending the proper Content Security Policy (CSP) frame-ancestors directive response headers]. |
| | + | # Performing general server hardening measures (for example, [https://docs.cpanel.net/knowledge-base/security/security-best-practices/ cPanel's] or [https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration OWASP's] best practices). |
| | | | |
| − | ==Secure the configuration.php File== | + | == Additional Questions == |
| | | | |
| − | We recommend adjusting the permissions for the "configuration.php" file in your WHMCS root directory. This file contains sensitive data that you can't recover without a backup of the file. To avoid accidentally overwriting, editing or deleting the file, change the permission setting of this file to <tt>400</tt>. This provides the system with read-only access and prevents anyone else from reading, editing or executing the file.
| + | If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance. |
| − | | |
| − | To change the permissions on this file, you can run the following command while in your WHMCS root directory:
| |
| − | <pre>
| |
| − | chmod 400 configuration.php
| |
| − | </pre>
| |
| − | | |
| − | <div class="docs-alert-warning">
| |
| − | <span class="title">Attention!</span>
| |
| − | <p>Some systems may require you to set the permission to <tt>440</tt> or <tt>444</tt>, depending on the server's configuration. Usually, <tt>400</tt> should suffice, but if you encounter an error loading the application after setting the permission to <tt>400</tt>, try <tt>440</tt> and then <tt>444</tt>.</p>
| |
| − | </div>
| |
| − | <div class="docs-alert-warning">
| |
| − | <span class="title">License Key Updates</span>
| |
| − | <p>If you need to update your license key, you must set the permissions on this file to <tt>755</tt> to allow the system to edit the file. After the updating the key, you can revert the permissions to <tt>400</tt>.</p></div>
| |
| − | | |
| − | ==Move the Crons Directory==
| |
| − | | |
| − | {{:Custom Crons Directory}}
| |
| − | | |
| − | ==Restrict Access by IP==
| |
| − | | |
| − | For increased protection, if your staff uses fixed IP addresses, you can restrict access to a specific set of IPs. To do this, create a file with the name <tt>.htaccess</tt> in your WHMCS admin directory with the following content:
| |
| − | | |
| − | ===Apache 2.2===
| |
| − | <source lang="php">
| |
| − | order deny,allow
| |
| − | allow from 12.34.5.67
| |
| − | allow from 98.76.54.32
| |
| − | deny from all
| |
| − | </source>
| |
| − | | |
| − | ===Apache 2.4===
| |
| − | <source lang="php">
| |
| − | Require ip 12.34.5.67
| |
| − | Require ip 98.76.54.32
| |
| − | </source>
| |
| − | | |
| − | You can specify as many different <tt>allow from</tt> or <tt>Require ip</tt> lines as you require. You can allow entire IP subnets by specifying just the first part of an IP address (for example, <tt>12.34.</tt>). This is <tt>.htaccess</tt> IP restriction.
| |
| − | | |
| − | ==Change your WHMCS Admin Folder Name==
| |
| − | | |
| − | Optionally, customising the URL of your WHMCS [[Admin Area]] can make it harder for bots and malicious users to find it. For steps, see [[Customising the Admin Directory]].
| |
| − | | |
| − | ==Restrict Database Privileges==
| |
| − | | |
| − | Disable any unneeded database privileges.
| |
| − | | |
| − | Most tasks only require the following database privileges:
| |
| − | | |
| − | *<tt>DELETE</tt>
| |
| − | *<tt>INSERT</tt>
| |
| − | *<tt>SELECT</tt>
| |
| − | *<tt>UPDATE</tt>
| |
| − | *<tt>LOCK TABLES</tt>
| |
| − | | |
| − | Installation, upgrades, and activating and deactivating modules require the following additional privileges:
| |
| − | | |
| − | *<tt>ALTER</tt>
| |
| − | *<tt>CREATE</tt>
| |
| − | *<tt>DROP</tt>
| |
| − | *<tt>INDEX</tt>
| |
| − | | |
| − | ==Enable SSL==
| |
| − | | |
| − | As a billing application that handles customer data, there is often private and sensitive data passing between WHMCS and end users' browsers. Having a valid SSL certificate that enables the use of HTTPS and encrypted communication is essential.
| |
| − | | |
| − | After you configure an SSL certificate, enter the <tt>https://</tt>-enabled URL in the '''WHMCS System URL''' text box in the '''[[General Tab|General]]''' tab at '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > General Settings''' or, prior to WHMCS 8.0, '''Setup > General Settings''' to ensure that the system uses it.
| |
| − | | |
| − | If you do not have an SSL certificate, [https://www.whmcs.com/ssl-certificates/ purchase one].
| |
| − | | |
| − | ==Vendor Directory==
| |
| − | | |
| − | We distribute WHMCS with a vendor directory ("/vendor"). This is a common directory for advanced scripts and applications, such as WHMCS, and includes various common libraries. However, web servers should not serve file requests directly from this path. Only the controlling script or application should load these libraries in order to ensure appropriate context and prevent unexpected behavior.
| |
| − | | |
| − | Apache is the recommended web server software platform on which to run WHMCS. If you are using Apache, the .htaccess file that WHMCS distributes in the <tt>/vendor</tt> directory should suffice. If you are running Apache and files remain accessible, investigate whether your Apache configuration has disabled the use of <tt>.htaccess</tt> files or there is a parent configuration that is negating the directive in the provided <tt>.htaccess</tt> file.
| |
| − | | |
| − | While we don't officially support other web server technologies, we understand that some users do wish to run WHMCS in environments other than Apache. To do this, you must ensure that your web server configuration does not serve files within the ''/vendor'' directory.
| |
| − | | |
| − | If you are using NGINX as your web server, see [[Nginx Directory Access Restriction]].
| |
| − | | |
| − | [[Installation|<< Back to Installation Overview]]
| |
| − | | |
| − | ==Defending Against Clickjacking==
| |
| − | Clickjacking is a type of attack where the attacker commonly uses iframes and styling to load an external page (such as the WHMCS client area) and attempts to trick the user into performing an action that may, unknowingly to the user, give the attacker access to their information. Detailed information on how this type of attack works, the potential effects, and how to defend against it at the server-level by sending the proper Content Security Policy (CSP) frame-ancestors directive response headers that instruct the visitor's browser to not allow framing from other domains can be found in the OWASP [https://owasp.org/www-community/attacks/Clickjacking Clickjacking] article.
| |
| − | | |
| − | ==Server Hardening==
| |
| − | | |
| − | In addition to the above, it is always recommended to perform a general server hardening to help mitigate any possible server security issues, such as preventing unauthorized access.
| |
| − | | |
| − | For help in implementing best security practices, see [https://docs.cpanel.net/knowledge-base/security/security-best-practices/ Security Best Practices] and [https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration Security Misconfiguration].
| |
| − | | |
| − | Any questions or concerns regarding server security, or items beyond the above, are best addressed to a qualified system administrator. They will be best positioned to review the server, assess the installed software and configuration, and provide tailored recommendations and assistance based on that.
| |
WHMCS includes many features to help keep your data safe, but you can take recommended additional steps to secure your WHMCS installation further.
If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance.