Difference between revisions of "Security Tab"
(New page: ===Required Password Strength=== Set to 0 to disable the password strength checker on the order form. Ensure your clients enter strong passwords by setting this to 50; use a higher number ...) |
(→Disable MD5 Clients Password) |
||
| Line 12: | Line 12: | ||
===Disable MD5 Clients Password=== | ===Disable MD5 Clients Password=== | ||
| − | For security client area passwords are irreversibly encrypted and cannot be viewed by admins, enabling this option will switch to reversible encryption allowing admins to view the password. When switching from irreversible to reversible clients will all be | + | For security client area passwords are irreversibly encrypted and cannot be viewed by admins, enabling this option will switch to reversible encryption allowing admins to view the password. When switching from irreversible to reversible clients will all be assigned a new password. |
===Disable Session IP Check=== | ===Disable Session IP Check=== | ||
Revision as of 10:36, 8 October 2009
Contents
Required Password Strength
Set to 0 to disable the password strength checker on the order form. Ensure your clients enter strong passwords by setting this to 50; use a higher number to force even more secure client area passwords.
Failed Admin Login Ban Time
Set to 0 to disable the login ban feature. If someone makes 3 incorrect attempts to login to your WHMCS admin, this is the time in minutes before they can try to login again (dictionary attack protection).
Disable Credit Card Storage
By default a client's credit card number is encrypted and stored in your database. Enabling this option means the number will not be stored and clients will need to re-enter their number for each invoice they pay.
Allow Customers CC Delete
When unticked only admins can remove credit card details from a client's account. When ticked, an option will appear in the client area for the same.
Disable MD5 Clients Password
For security client area passwords are irreversibly encrypted and cannot be viewed by admins, enabling this option will switch to reversible encryption allowing admins to view the password. When switching from irreversible to reversible clients will all be assigned a new password.
Disable Session IP Check
This is used to protect against cookie/session hijacking and ideally should remain unticked. However it can cause problems for users with dynamic IPs or using mobile devices (iPhones etc) so can be disabled by ticking the checkbox.
API IP Access Restriction
Advanced. If using the WHMCS API from an off-server location, you must specify the IP address here, otherwise access will be denied.