Further Security Steps
WHMCS includes many features to help keep your data safe, but you can simple additional steps to secure your WHMCS installation further.
Contents
Secure the Writeable Directories
We recommend moving all writeable directories to a non-public location to prevent web based access.
For more information and steps to do this, see Securing Writeable Directories.
Secure the configuration.php File
We recommend adjusting the permissions for the configuration.php file in your WHMCS root directory. This file contains sensitive data that you can't recover without a backup of the file.
For steps to do this, see Securing the Configuration File.
Move the Crons Directory
We recommend moving the crons directory to a private directory above your web root in order to prevent web-based access.
For steps to do this, see Moving the Crons Directory.
Restrict Access by IP
For increased protection, if your staff uses fixed IP addresses, you can restrict access to a specific set of IP addresses.
For steps to do this, see Restricting Access by IP Address.
Change your WHMCS Admin Folder Name
Optionally, customising the URL of your WHMCS Admin Area can make it harder for bots and malicious users to find it.
For steps to do this, see Renaming the WHMCS Admin Directory.
Restrict Database Privileges
Disable any unneeded database privileges.
Most tasks only require the following database privileges:
- DELETE
- INSERT
- SELECT
- UPDATE
- LOCK TABLES
Installation, upgrades, and activating and deactivating modules require the following additional privileges:
- ALTER
- CREATE
- DROP
- INDEX
Enable SSL
As a billing application that handles customer data, there is often private and sensitive data passing between WHMCS and end users' browsers. Having a valid SSL certificate that enables the use of HTTPS and encrypted communication is essential.
After you configure an SSL certificate, enter the https://-enabled URL in the WHMCS System URL text box in the General tab at Configuration () > System Settings > General Settings or, prior to WHMCS 8.0, Setup > General Settings to ensure that the system uses it.
If you do not have an SSL certificate, purchase one.
Vendor Directory
We distribute WHMCS with a vendor directory ("/vendor"). This is a common directory for advanced scripts and applications, such as WHMCS, and includes various common libraries. However, web servers should not serve file requests directly from this path. Only the controlling script or application should load these libraries in order to ensure appropriate context and prevent unexpected behavior.
Apache is the recommended web server software platform on which to run WHMCS. If you are using Apache, the .htaccess file that WHMCS distributes in the /vendor directory should suffice. If you are running Apache and files remain accessible, investigate whether your Apache configuration has disabled the use of .htaccess files or there is a parent configuration that is negating the directive in the provided .htaccess file.
While we don't officially support other web server technologies, we understand that some users do wish to run WHMCS in environments other than Apache. To do this, you must ensure that your web server configuration does not serve files within the /vendor directory.
If you are using NGINX as your web server, see Nginx Directory Access Restriction.
<< Back to Installation Overview
Defending Against Clickjacking
Clickjacking is a type of attack where the attacker commonly uses iframes and styling to load an external page (such as the WHMCS client area) and attempts to trick the user into performing an action that may, unknowingly to the user, give the attacker access to their information. Detailed information on how this type of attack works, the potential effects, and how to defend against it at the server-level by sending the proper Content Security Policy (CSP) frame-ancestors directive response headers that instruct the visitor's browser to not allow framing from other domains can be found in the OWASP Clickjacking article.
Server Hardening
In addition to the above, it is always recommended to perform a general server hardening to help mitigate any possible server security issues, such as preventing unauthorized access.
For help in implementing best security practices, see Security Best Practices and Security Misconfiguration.
Any questions or concerns regarding server security, or items beyond the above, are best addressed to a qualified system administrator. They will be best positioned to review the server, assess the installed software and configuration, and provide tailored recommendations and assistance based on that.