Security Tab

Required Password Strength

Set to 0 to disable the password strength checker on the order form. Ensure your clients enter strong passwords by setting this to 50; use a higher number to force even more secure client area passwords.

Failed Admin Login Ban Time

Set to 0 to disable the login ban feature. If someone makes 3 incorrect attempts to login to your WHMCS admin, this is the time in minutes before they can try to login again (dictionary attack protection).

Disable Credit Card Storage

By default a client's credit card number is encrypted and stored in your database. Enabling this option means the number will not be stored and clients will need to re-enter their number for each invoice they pay.

Allow Customers CC Delete

When unticked only admins can remove credit card details from a client's account. When ticked, an option will appear in the client area for the same.

Disable MD5 Clients Password

For security client area passwords are irreversibly encrypted and cannot be viewed by admins, enabling this option will switch to reversible encryption allowing admins to view the password. When switching from irreversible to reversible clients will all be emailed a new password.

Disable Session IP Check

This is used to protect against cookie/session hijacking and ideally should remain unticked. However it can cause problems for users with dynamic IPs or using mobile devices (iPhones etc) so can be disabled by ticking the checkbox.

API IP Access Restriction

Advanced. If using the WHMCS API from an off-server location, you must specify the IP address here, otherwise access will be denied.