Difference between revisions of "Further Security Steps"

From WHMCS Documentation

m (Moved Note into body of text it referenced. Added a new NOTE for the folder path which can vary from what is shown)
 
(72 intermediate revisions by 13 users not shown)
Line 1: Line 1:
−
The guide below describes various extra steps you can take to further secure your WHMCS system.
+
WHMCS includes many features to help keep your data safe, but you can take recommended additional steps to secure your WHMCS installation further.
  
−
==Move the attachments, downloads & templates_c folders==
+
== Recommended Steps ==
  
−
The three folders "attachments", "downloads" and "templates_c" need to be writeable by WHMCS and therefore require the permissions 777 (writeable by all).  When folders have this permission level it is safer to place the folders outside of the public accessible folder tree on your website.  'Note that if you are running suphp or phpsuexec you should not make the mode changes as the folders will already be writeable. In fact, you cannot set folder or file permissions to be 777 when running suphp or phpsuexec - the highest permissions are 755 for both folders and files.  WHMCS allows you to move these files to better safeguard these folders.  If you do move the folders, then you must tell WHMCS where they have been moved to by adding the following lines to your configuration.php file:
+
We recommend:
  
−
$templates_compiledir = "/home/whmcs/templates_c/";   
+
# Securing the writeable directories by [https://help.whmcs.com/m/installation/l/1650299-securing-writeable-directories moving them to a non-public location].
−
$attachments_dir = "/home/whmcs/attachments/";
+
# Securing the <tt>configuration.php</tt> file by [https://help.whmcs.com/m/installation/l/1650301-securing-the-configuration-file adjusting its permissions].
−
$downloads_dir = "/home/whmcs/downloads/";
+
# Securing the <tt>crons</tt> directory by [https://help.whmcs.com/m/installation/l/1650302-moving-the-crons-directory moving it to a non-public location].
 +
# Protecting your Admin Area by [https://help.whmcs.com/m/installation/l/1650303-restricting-access-by-ip-address restricting access to a specific set of IP addresses] and [https://help.whmcs.com/m/installation/l/1650304-renaming-the-whmcs-admin-directory renaming the admin directory].
 +
# Disabling any unneeded [[System_Environment_Guide#Database_Privileges|database privileges]].
 +
# Protecting sensitive data by [https://help.whmcs.com/m/installation/l/1650306-enabling-ssl enabling SSL].
 +
# If you are not using Apache, ensure against [[Nginx Directory Access Restriction|serving requests directly from the vendor directory]]. <div class="docs-alert-info">The <tt>.htaccess</tt> file within the <tt>vendor</tt> directory will suffice to protect against this for servers running on Apache.</div>
 +
# Defending against clickjacking by [https://owasp.org/www-community/attacks/Clickjacking always sending the proper Content Security Policy (CSP) frame-ancestors directive response headers].
 +
# Performing general server hardening measures (for example, [https://docs.cpanel.net/knowledge-base/security/security-best-practices/ cPanel's] or [https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration OWASP's] best practices).
  
−
Note: The path to your moved folders will vary from those shown. Before moving these directories be certain of the complete path to the new location, and enter this complete path into your configuration.php file.
+
== Additional Questions ==
  
−
==Change your WHMCS Admin Folder name==
+
If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance.
−
 
 
−
Malicious users who visit your site and recognise a WHMCS install will know that they can try logging into your admin area via the admin folder.  To protect against this, you can rename the admin folder name to any name you like.  You cannot move the folder - only rename it.  You can then tell WHMCS what the name of that folder is for the links in admin notification emails by adding the following line to your configuration.php file:<br />
 
−
 
 
−
$customadminpath = "myadminname";
 
−
 
 
−
Replace "myadminname" above with the new name you just gave to your admin folder.
 
−
 
 
−
Also remember to reissue your whmcs license after doing this, otherwise, you will be unable to login to your admin area. To do this, login to your client area at www.whmcs.com/clients, click on 'My Licenses', click on the edit icon next to your licence and then on the 'Reissue License' button.
 
−
 
 
−
Finally, if you have already created a cron job, or one has been created for you, you will need to update the path on the cron as well.
 
−
 
 
−
Example: php -q /home/mylogin/public_html/secure/myadminname/cron.php
 
−
 
 
−
[[Installation|<< Back to Installation Overview]]
 

Latest revision as of 20:04, 14 February 2023

WHMCS includes many features to help keep your data safe, but you can take recommended additional steps to secure your WHMCS installation further.

Recommended Steps

We recommend:

  1. Securing the writeable directories by moving them to a non-public location.
  2. Securing the configuration.php file by adjusting its permissions.
  3. Securing the crons directory by moving it to a non-public location.
  4. Protecting your Admin Area by restricting access to a specific set of IP addresses and renaming the admin directory.
  5. Disabling any unneeded database privileges.
  6. Protecting sensitive data by enabling SSL.
  7. If you are not using Apache, ensure against serving requests directly from the vendor directory.
    The .htaccess file within the vendor directory will suffice to protect against this for servers running on Apache.
  8. Defending against clickjacking by always sending the proper Content Security Policy (CSP) frame-ancestors directive response headers.
  9. Performing general server hardening measures (for example, cPanel's or OWASP's best practices).

Additional Questions

If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance.

Retrieved from "http://3.17.75.209/index.php?title=Further_Security_Steps&oldid=33915"