How to secure your WHMCS [METHODS-EXPLAINED] 100% SECURE

WHMCS is an all-in-one client management tool used for billing and support for online businesses. We can discuss some of the methods to secure WHMCS.

WHMCS is a secure platform but it is better to add some extra security measures for preventing the attacks.

How to secure your WHMCS [EXPLAINED]100% SECURE

Customizing WHMCS Settings [IMPORTANT]

We can change the default WHMCS settings to improve the security. This includes:

1. Changing admin directory: Change the name of the admin directory from ‘admin’ to another one which is hard to guess.

2. IP address restriction:

For increased protection, we can set a limit for accessing the admin area only to the staffs. That allows staffs IP address only to WHMCS admin area. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:

order deny, allow
allow from 102.34.5.167
allow from 198.76.54.132
deny from all

3. Restrict Database Privileges: Set limit of the database user’s permissions to DELETE, INSERT, SELECT, UPDATE and LOCK TABLES. Only the following database privileges are required. All others may be disabled.

4. Secure Writable Directories:

We recommend moving all writeable directories to a non-public location to prevent web-based access. There are three writeable directories required for WHMCS to function, they are: attachments, downloads, and templates_c

WHMCS needs to be given the new location of the writeable directories.

5. Move Cron Directory:

The files within the crons directory need to know where to find your WHMCS installation, and your WHMCS installation needs to know where to find the crons directory, so the relocation process involves editing two files.

1. Begin by choosing a new location for your crons directory and move the entire /crons/ folder and contents to it.

2. Open the config.php file within the crons directory and follow the instructions within it to uncomment the WHMCS path line and provide the full path to your WHMCS installation. For example:

$whmcspath = '/home/username/public_html/whmcs/';

The above example assumes cPanel is being used, where “username” is the account username and “whmcs” is the directory containing the WHMCS installation.

3. Open the configuration.php file within your WHMCS installation root directory and add the following line to the bottom of the file so that WHMCS is able to locate your custom crons directory location and show you the correct paths you need to use for cron and piping command configuration within the admin interface.

$crons_dir = '/home/username/whmcs_crons/';

The above example assumes cPanel is being used, where “username” is the account username and “whmcs_crons” is the custom crons directory.

6. Enable SSL: As a billing application that handles customer data, there are often private and sensitive data passing between it and end user’s browsers. Therefore having a valid SSL Certificate that enables the use of HTTPS and encrypted communication is essential.

7. Password Protect Directory: As WHMCS is a billing application that handles customer data and all sensitive information passing between it and end-users so it is very much essential to password protect your Directory.

8. Secure Configuration.php file:

We recommend adjusting the permissions set for the “configuration.php” file located in your WHMCS root directory. This file contains sensitive data that cannot be recovered without a backup of the file. To avoid accidentally overwriting, editing, or deleting the file, change the permission setting of this file to `400`. This provides read-only access to the file by the system and prevents anyone else from reading, editing, or executing the file.

To change the permissions on this file, you can run the following command from the shell while in your WHMCS root directory:

chmod 400 configuration.php

We hope this article was clear enough to make you understand how to secure your WHMCS.

You can also watch the video tutorial on how to secure your WHMCS on our YouTube Channel.

If you have any questions or queries, feel free to leave them in the comments section below.

Thanks for Reading!!!