Further Security Steps

WHMCS has many features built-in to help keep your data safe, but here are several simple extra steps you can take to secure your WHMCS installation even further.

Change your WHMCS Admin Folder Name

With many web based softwares, users know they can try visiting various common directory names to find admin control panels. So customising the location of your WHMCS admin area is one of many steps you can take in order to make the lives of malicious users looking for login forms that little bit more difficult. WHMCS needs to know what you call your admin directory however if you choose to rename it, so if you would like to do this, please refer to Customising the Admin Directory

Password Protect the Admin Directory

Add a second layer of protection to the admin directory by setting up .htaccess password protection. Most users can do this via the Password Protect Directories option in cPanel. Remember to keep your .htaccess username/password distinct and unique. You can use the Random Password Generation feature in cPanel to help.

Move the attachments, downloads & templates_c folders

The three directories "attachments", "downloads" and "templates_c" within the WHMCS root directory need to be writeable by WHMCS. They are used to store ticket attachments, file downloads and compiled versions of templates for improved performance respectively.

We recommend moving all writeable directories to a non-public location above your web root to prevent web based access.

When you move the directories, you must provide WHMCS with the new paths to them. You do this by adding (or updating if they already exist) the following lines in the configuration.php file within the root WHMCS directory.

$templates_compiledir = "/home/username/templates_c/";
$attachments_dir = "/home/username/attachments/";
$downloads_dir = "/home/username/downloads/";

In the above example, "username" is the cPanel username and so the 3 folders are located in the home directory, above public_html.

Note that if you are running suPHP or phpSuExec chmod 755 should be sufficient permissions to make the directories writeable as this is the highest permission available for both folders and files when running in that condition.

Move the crons folder

By default, the system stores cron-related items in the /crons/ directory. We recommend moving the crons directory to a custom private directory above your web root. This will prevent web-based access and help to protect your WHMCS installation.

Moving the Crons Directory

When you customize this location, you must move the directory and update WHMCS's configuration.

For steps to do this, see Moving the Crons Directory.

Upgrades and Patches

Applying updates or patches after customizing your crons directory location requires an additional step. You must upload any updated crons files from the default location to your custom directory.

If you do not move the files, you will see errors and issues with WHMCS's automation.

Restrict Access by IP

For added security, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:

order deny,allow
allow from 12.34.5.67
allow from 98.76.54.32
deny from all

You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.". This is called Htaccess IP Restriction.