Further Security Steps

WHMCS has many features built-in to help keep your data safe, but here are several simple extra steps you can take to secure your WHMCS installation even further.

Secure the Writeable Directories

We recommend moving all writeable directories to a non-public directory above your web root to prevent web based access. There are three writeable directories required for WHMCS to function, they are: "attachments", "downloads" and "templates_c"

We recommend moving all writeable directories to a non-public location above your web root to prevent web based access.

When you move the directories, you need to provide WHMCS with the new paths to use them. You do this by adding (or updating if they already exist) the following lines in the configuration.php file within the root WHMCS directory.

$attachments_dir = "/home/username/attachments/";
$downloads_dir = "/home/username/downloads/";
$templates_compiledir = "/home/username/templates_c/";

In the above example, "username" is the cPanel username and so the 3 folders are located in the home directory, above public_html.

Note that if you are running suPHP or phpSuExec chmod 755 should be sufficient permissions to make the directories writeable as this is the highest permission available for both folders and files when running in that condition.

Secure the `configuration.php` File

We recommend adjusting the permissions set for the "configuration.php" file located in your WHMCS root directory. This file contains sensitive data that cannot be recovered without a backup of the file. To avoid accidentally overwriting, editing or deleting the file, change the permission setting of this file to `400`. This provides read only access to the file by the system and prevents anyone else from reading, editing or executing the file.

To change the permissions on this file, you can run the following command from shell while in your WHMCS root directory:

chmod 400 configuration.php

Attention!

Some systems may require you to set the permission to 440 or 444 depending on how the server is configured. For most, 400 should suffice, but if you encounter an error loading the application after setting the permission to 400, try 440 and then 444.

License Key Updates

Should you need to ever update your license key, you must set the permissions on this file to 755 to allow the system to edit the file. Once the key is updated, you can revert the permissions to 400.

Move the Crons Directory

By default, the system stores cron-related items in the /crons/ directory. We recommend moving the crons directory to a custom private directory above your web root. This will prevent web-based access and help to protect your WHMCS installation.

Moving the Crons Directory

When you customize this location, you must move the directory and update WHMCS's configuration.

For steps to do this, see Moving the Crons Directory.

Upgrades and Patches

Applying updates or patches after customizing your crons directory location requires an additional step. You must upload any updated crons files from the default location to your custom directory.

If you do not move the files, you will see errors and issues with WHMCS's automation.

Restrict Access by IP

For increased protection, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:

order deny,allow
allow from 12.34.5.67
allow from 98.76.54.32
deny from all

You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.". This is called Htaccess IP Restriction.

Change your WHMCS Admin Folder Name

Customising the url of your WHMCS admin area makes it harder for boths and malicious users to find it. It is not required, but if you wish to do so, find out how here: Customising the Admin Directory

Restrict Database Privileges

For day to day use, only the following database privileges are required. All others may be disabled.

• DELETE
• INSERT
• SELECT
• UPDATE
• LOCK TABLES

Please note that installation, upgrading, activating, and deactivating modules require the following additional privileges.

• ALTER
• CREATE
• DROP
• INDEX

Use HTTPS Connections

The admin area and client area are more secure when accessed over HTTPS with a valid SSL certificate in place. This can prevent sensitive information from being revealed via unencrypted connections.

The in WHMCS version 7.0.0 and later, the WHMCS SSL System URL field has been removed and only the WHMCS System URL field is available. It will automatically work with either HTTP or HTTPS URL structures.

<< Back to Installation Overview