Security Tab

reCAPTCHA Uses Google's reCAPTCHA[1] service. You will need to register for a set of keys to use this service, this can be done here. Once you have your keys, you can enter them in the appropriate boxes on this tab. There is some additional configuration that can be done using the reCAPTCHA option, please see reCAPTCHA for more details.

Required Password Strength

Set to 0 to disable the password strength checker on the order form. Ensure your clients enter strong passwords by setting this to 50; use a higher number to force even more secure client area passwords.

For a password strength of 90 the user would be required to enter at least 3 numbers, 2 lowercase & 3 uppercase letters and 3 special characters. More detailed information can be found by reviewing the includes/jscript/pwstrength.js file.

Failed Admin Login Ban Time

Set to 0 to disable the login ban feature. If someone makes 3 incorrect attempts to login to your WHMCS admin, this is the time in minutes before they can try to login again (dictionary attack protection).

Admin Force SSL Access

When unticked the administration area can be access via both http and https connections. Ticking this option forces all connections to use https for increased security.

Disable Credit Card Storage

By default a client's credit card number is encrypted and stored in your database. Enabling this option means the number will not be stored and clients will need to re-enter their number for each invoice they pay.

Allow Customers CC Delete

When unticked only admins can remove credit card details from a client's account. When ticked, an option will appear in the client area for the same.

Disable MD5 Clients Password

For security client area passwords are irreversibly encrypted and cannot be viewed by admins, enabling this option will switch to reversible encryption allowing admins to view the password. When switching from irreversible to reversible clients will all be assigned a new password and will need to use password recovery.

Disable Session IP Check

This is used to protect against cookie/session hijacking and ideally should remain unticked. However it can cause problems for users with dynamic IPs or using mobile devices (iPhones etc) so can be disabled by ticking the checkbox.