Further Security Steps

WHMCS includes many features to help keep your data safe, but you can simple additional steps to secure your WHMCS installation further.

Secure the Writeable Directories

We recommend moving all writeable directories to a non-public location to prevent web based access. There are three required writeable directories: attachments, downloads and templates_c

You must specify the new location of the writeable directories in WHMCS. This is done in two places:

File Storage

You can move the attachments and downloads storage directories to a local location, or you can store them remotely on an AWS S3™-compatible service. If you are unfamiliar with the AWS S3 service, we recommend using the local storage option.

To do this:

1. Create the storage location. This could be either:
   • A writeable directory on your server above the web root.
   • A non-public AWS S3-compatible storage bucket.
2. Navigate to Configuration () > System Settings > Storage Settings or, prior to WHMCS 8.0, Setup > Storage Settings.
3. Use the interface to add the secure storage locations and switch to them.

For step-by-step guidance using this interface, see Storage Settings.

Templates Cache

You can use the templates cache (templates_c) to improve performance of templated pages and emails.

To do this:

1. Create a templates_c directory in the desired location (a non-public location above your web root).
2. Edit the configuration.php file and specify the path to the new location by adding a new line:

$templates_compiledir = "/home/username/templates_c/";

In the above example, "username" is the cPanel username and the folder is in the home directory, above public_html.

If you are running suPHP or PHP suEXEC, chmod 755 should be sufficient permissions to make the directories writeable. This is the highest permission available for both folders and files when running in that condition.

Secure the configuration.php File

We recommend adjusting the permissions for the "configuration.php" file in your WHMCS root directory. This file contains sensitive data that you can't recover without a backup of the file. To avoid accidentally overwriting, editing or deleting the file, change the permission setting of this file to 400. This provides the system with read-only access and prevents anyone else from reading, editing or executing the file.

To change the permissions on this file, you can run the following command while in your WHMCS root directory:

chmod 400 configuration.php

Attention!

Some systems may require you to set the permission to 440 or 444, depending on the server's configuration. Usually, 400 should suffice, but if you encounter an error loading the application after setting the permission to 400, try 440 and then 444.

License Key Updates

If you need to update your license key, you must set the permissions on this file to 755 to allow the system to edit the file. After the updating the key, you can revert the permissions to 400.

Move the Crons Directory

By default, the system stores cron-related items in the /crons/ directory. We recommend moving the crons directory to a custom private directory above your web root. This will prevent web-based access and help to protect your WHMCS installation.

Moving the Crons Directory

When you customize this location, you must move the directory and update WHMCS's configuration.

For steps to do this, see Moving the Crons Directory.

Upgrades and Patches

Applying updates or patches after customizing your crons directory location requires an additional step. You must upload any updated crons files from the default location to your custom directory.

If you do not move the files, you will see errors and issues with WHMCS's automation.

Restrict Access by IP

For increased protection, if your staff uses fixed IP addresses, you can restrict access to a specific set of IPs. To do this, create a file with the name .htaccess in your WHMCS admin directory with the following content:

order deny,allow
allow from 12.34.5.67
allow from 98.76.54.32
deny from all

You can specify as many different allow from lines as you require. You can allow entire IP subnets by specifying just the first part of an IP address (for example, "12.34."). This is .htaccess IP restriction.

Change your WHMCS Admin Folder Name

Optionally, customising the URL of your WHMCS admin area can make it harder for bots and malicious users to find it. For steps, see Customising the Admin Directory.

Restrict Database Privileges

Disable any unneeded database privileges.

Most tasks only require the following database privileges:

• DELETE
• INSERT
• SELECT
• UPDATE
• LOCK TABLES

Installation, upgrades, and activating and deactivating modules require the following additional privileges:

• ALTER
• CREATE
• DROP
• INDEX

Enable SSL

As a billing application that handles customer data, there is often private and sensitive data passing between WHMCS and end users' browsers. Having a valid SSL certificate that enables the use of HTTPS and encrypted communication is essential.

After you configure an SSL certificate, enter the https://-enabled URL in the WHMCS System URL text box in Configuration () > System Settings > General Settings or, prior to WHMCS 8.0, Setup > General Settings to ensure that the system uses it.

If you do not have an SSL certificate, purchase one at https://www.whmcs.com/ssl-certificates/.

Vendor Directory

We distribute WHMCS with a vendor directory ("/vendor"). This is a common directory for advanced scripts and applications, such as WHMCS, and includes various common libraries. However, web servers should not serve file requests directly from this path. Only the controlling script or application should load these libraries in order to ensure appropriate context and prevent unexpected behavior.

Apache is the recommended web server software platform on which to run WHMCS. If you are using Apache, the .htaccess file that WHMCS distributes in the /vendor directory should suffice. If you are running Apache and files remain accessible, investigate whether your Apache configuration has disabled the use of .htaccess files or there is a parent configuration that is negating the directive in the provided .htaccess file.

While we don't officially support other web server technologies, we understand that some users do wish to run WHMCS in environments other than Apache. To do this, you must ensure that your web server configuration does not serve files within the /vendor directory.

If you are using NGINX as your web server, see Nginx Directory Access Restriction.

<< Back to Installation Overview

Defending Against Clickjacking

Clickjacking is a type of attack where the attacker commonly uses iframes and styling to load an external page (such as the WHMCS client area) and attempts to trick the user into performing an action that may, unknowingly to the user, give the attacker access to their information. Detailed information on how this type of attack works, the potential effects, and how to defend against it at the server-level by sending the proper Content Security Policy (CSP) frame-ancestors directive response headers that instruct the visitor's browser to not allow framing from other domains can be found in the following OWASP article: Clickjacking

Server Hardening

In addition to the above, it is always recommended to perform a general server hardening to help mitigate any possible server security issues, such as preventing unauthorized access. Below are some resources that may be helpful in implementing best security practices:

https://docs.cpanel.net/knowledge-base/security/security-best-practices/

https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration

Any questions or concerns regarding server security, or items beyond the above, are best addressed to a qualified system administrator. They will be best positioned to review the server, assess the installed software and configuration, and provide tailored recommendations and assistance based on that.