|
|
| (21 intermediate revisions by 4 users not shown) |
| Line 1: |
Line 1: |
| − | WHMCS has many features built-in to help keep your data safe, but here are several simple extra steps you can take to secure your WHMCS installation even further. | + | WHMCS includes many features to help keep your data safe, but you can take recommended additional steps to secure your WHMCS installation further. |
| | | | |
| − | ==Secure the Writeable Directories== | + | == Recommended Steps == |
| | | | |
| − | We recommend moving all writeable directories to a non-public location to prevent web based access. There are three writeable directories required for WHMCS to function, they are: ''attachments'', ''downloads'' and ''templates_c'' | + | We recommend: |
| | | | |
| − | WHMCS needs to be given the new location of the writeable directories. This is done in two places:
| + | # Securing the writeable directories by [https://help.whmcs.com/m/installation/l/1650299-securing-writeable-directories moving them to a non-public location]. |
| | + | # Securing the <tt>configuration.php</tt> file by [https://help.whmcs.com/m/installation/l/1650301-securing-the-configuration-file adjusting its permissions]. |
| | + | # Securing the <tt>crons</tt> directory by [https://help.whmcs.com/m/installation/l/1650302-moving-the-crons-directory moving it to a non-public location]. |
| | + | # Protecting your Admin Area by [https://help.whmcs.com/m/installation/l/1650303-restricting-access-by-ip-address restricting access to a specific set of IP addresses] and [https://help.whmcs.com/m/installation/l/1650304-renaming-the-whmcs-admin-directory renaming the admin directory]. |
| | + | # Disabling any unneeded [[System_Environment_Guide#Database_Privileges|database privileges]]. |
| | + | # Protecting sensitive data by [https://help.whmcs.com/m/installation/l/1650306-enabling-ssl enabling SSL]. |
| | + | # If you are not using Apache, ensure against [[Nginx Directory Access Restriction|serving requests directly from the vendor directory]]. <div class="docs-alert-info">The <tt>.htaccess</tt> file within the <tt>vendor</tt> directory will suffice to protect against this for servers running on Apache.</div> |
| | + | # Defending against clickjacking by [https://owasp.org/www-community/attacks/Clickjacking always sending the proper Content Security Policy (CSP) frame-ancestors directive response headers]. |
| | + | # Performing general server hardening measures (for example, [https://docs.cpanel.net/knowledge-base/security/security-best-practices/ cPanel's] or [https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration OWASP's] best practices). |
| | | | |
| − | ===File Storage=== | + | == Additional Questions == |
| − | The ''attachments'' and ''downloads'' storage directories can be moved to a local location or stored remotely on an AWS S3-compatible service. If you are unfamiliar with the AWS S3 service we recommend using the local storage option.
| |
| | | | |
| − | # Create the storage location. This could be either:
| + | If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance. |
| − | #* A writeable directory on your server above the web-root
| |
| − | #* A non-public AWS S3-compatible storage bucket.
| |
| − | # Navigate to '''Setup > Storage Settings'''
| |
| − | # Use the interface to add the secure storage locations and switch to them.
| |
| − | | |
| − | For step-by-step guidance using this interface please refer to [[Storage Settings]].
| |
| − | | |
| − | ===Templates Cache===
| |
| − | The templates cache (''templates_c'') is used to improve performance of templated pages and emails.
| |
| − | | |
| − | # Create a ''templates_c'' directory in the desired location (a non-public location above your web root)
| |
| − | # Edit the ''configuration.php'' file and specify the path to the new location by adding a new line:
| |
| − | <source lang="php">
| |
| − | $templates_compiledir = "/home/username/templates_c/";
| |
| − | </source>
| |
| − | | |
| − | In the above example, "username" is the cPanel username and so the folder is located in the home directory, above public_html.
| |
| − | | |
| − | <div class="docs-alert-info">Note that if you are running suPHP or phpSuExec chmod 755 should be sufficient permissions to make the directories writeable as this is the highest permission available for both folders and files when running in that condition.</div>
| |
| − | | |
| − | ==Secure the `configuration.php` File==
| |
| − | | |
| − | We recommend adjusting the permissions set for the "configuration.php" file located in your WHMCS root directory. This file contains sensitive data that cannot be recovered without a backup of the file. To avoid accidentally overwriting, editing or deleting the file, change the permission setting of this file to `400`. This provides read only access to the file by the system and prevents anyone else from reading, editing or executing the file.
| |
| − | | |
| − | To change the permissions on this file, you can run the following command from shell while in your WHMCS root directory:
| |
| − | <pre>
| |
| − | chmod 400 configuration.php
| |
| − | </pre>
| |
| − | | |
| − | <div class="docs-alert-warning">
| |
| − | <span class="title">Attention!</span>
| |
| − | <p>Some systems may require you to set the permission to 440 or 444 depending on how the server is configured. For most, 400 should suffice, but if you encounter an error loading the application after setting the permission to 400, try 440 and then 444.</p>
| |
| − | </div>
| |
| − | <div class="docs-alert-warning">
| |
| − | <span class="title">License Key Updates</span>
| |
| − | <p>Should you need to ever update your license key, you must set the permissions on this file to 755 to allow the system to edit the file. Once the key is updated, you can revert the permissions to 400.</p></div>
| |
| − | | |
| − | ==Move the Crons Directory==
| |
| − | | |
| − | {{:Custom Crons Directory}}
| |
| − | | |
| − | ==Restrict Access by IP==
| |
| − | | |
| − | For increased protection, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:
| |
| − | | |
| − | <source lang="php">
| |
| − | order deny,allow
| |
| − | allow from 12.34.5.67
| |
| − | allow from 98.76.54.32
| |
| − | deny from all
| |
| − | </source>
| |
| − | | |
| − | You can specify as many different '''allow from''' lines as you require. Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.". This is called Htaccess IP Restriction.
| |
| − | | |
| − | ==Change your WHMCS Admin Folder Name==
| |
| − | | |
| − | Customising the url of your WHMCS admin area makes it harder for bots and malicious users to find it. It is not required, but if you wish to do so, find out how here: [[Customising the Admin Directory]]
| |
| − | | |
| − | ==Restrict Database Privileges==
| |
| − | For day to day use, only the following database privileges are required. All others may be disabled.
| |
| − | | |
| − | *DELETE
| |
| − | *INSERT
| |
| − | *SELECT
| |
| − | *UPDATE
| |
| − | *LOCK TABLES
| |
| − | | |
| − | Please note that installation, upgrading, activating, and deactivating modules require the following additional privileges.
| |
| − | | |
| − | *ALTER
| |
| − | *CREATE
| |
| − | *DROP
| |
| − | *INDEX
| |
| − | | |
| − | ==Enable SSL==
| |
| − | | |
| − | As a billing application that handles customer data, there is often private and sensitive data passing between it and end users browsers. Therefore having a valid SSL Certificate that enables the use of HTTPs and encrypted communication is essential.
| |
| − | | |
| − | Once you have an SSL Certificate configured, simply enter the https:// enabled URL in the WHMCS System URL field in Setup > General Settings to ensure it is used.
| |
| − | | |
| − | If you do not have an SSL Certificate, you may purchase one quickly and easily at: https://www.whmcs.com/ssl-certificates/
| |
| − | | |
| − | ==Vendor Directory==
| |
| − | WHMCS is distributed with a vendor directory ("/vendor"). This is a common directory for advanced scripts and applications, such as WHMCS, and is comprised of various common libraries. However, web servers should not serve file requests directly from this path. Only the controlling script or application should load these libraries in order to ensure appropriate context and prevent unexpected behavior.
| |
| − | | |
| − | Apache is the recommended web server software platform on which to run WHMCS. If you are using Apache, the .htaccess distributed by WHMCS in the /vendor directory should suffice. If you are running Apache and files remain accessible, then you will want to investigate if your Apache configuration has disabled the use of .htaccess files or if there is a parent configuration that is negating the directive in the provided .htaccess file.
| |
| − | | |
| − | While other web server technologies are not officially supported, we understand that some users do wish to run WHMCS in environments other than Apache. For those that do, you must ensure that files within the ''/vendor'' directory are not served based on your web server configuration.
| |
| − | | |
| − | If you are using NGINX as your web server, we have put together a general guideline to assist you and your system administrator here: [[Nginx Directory Access Restriction]]
| |
| − | | |
| − | | |
| − | [[Installation|<< Back to Installation Overview]]
| |
WHMCS includes many features to help keep your data safe, but you can take recommended additional steps to secure your WHMCS installation further.
If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance.