WHMCS has many features built-in to help keep your data safe, but here are several simple extra steps you can take to secure your WHMCS installation even further.
Change your WHMCS Admin Folder Name
With many web based softwares, users know they can try visiting various common directory names to find admin control panels. So customising the location of your WHMCS admin area is one of many steps you can take in order to make the lives of malicious users looking for login forms that little bit more difficult. WHMCS needs to know what you call your admin directory however if you choose to rename it, so if you would like to do this, please refer to Customising the Admin Directory
Password Protect the Admin Directory
Add a second layer of protection to the admin directory by setting up .htaccess password protection. Most users can do this via the Password Protect Directories option in cPanel. Remember to keep your .htaccess username/password distinct and unique. You can use the Random Password Generation feature in cPanel to help.
Move the attachments, downloads & templates_c folders
The three directories "attachments", "downloads" and "templates_c" within the WHMCS root directory need to be writeable by WHMCS. They are used to store ticket attachments, file downloads and compiled versions of templates for improved performance respectively.
When you move the directories, you must provide WHMCS with the new paths to them. You do this by adding (or updating if they already exist) the following lines in the configuration.php file within the root WHMCS directory.
$templates_compiledir = "/home/username/templates_c/"; $attachments_dir = "/home/username/attachments/"; $downloads_dir = "/home/username/downloads/";
In the above example, "username" is the cPanel username and so the 3 folders are located in the home directory, above public_html.
Move the crons folder
The crons folder may be moved to any place above or below the docroot.
The files within the crons directory need to know where to find your WHMCS installation, and your WHMCS installation needs to know where to find the crons directory, so the relocation process involves editing two files.
1. Begin by choosing a new location for your crons directory and move the entire /crons/ folder and contents to it.
2. Open the config.php file within the crons directory and follow the instructions within it to uncomment the WHMCS path line and provide the full path to your WHMCS installation. For example:
$whmcspath = '/home/username/public_html/whmcs/';
The above example assumes cPanel is being used, where "username" is the account username and "whmcs" is the directory containing the WHMCS installation.
3. Open the configuration.php file within your WHMCS installation root directory and add the following line to the bottom of the file so that WHMCS is able to locate your custom crons directory location and show you the correct paths you need to use for cron and piping command configuration within the admin interface.
$crons_dir = '/home/username/whmcs_crons/';
The above example assumes cPanel is being used, where "username" is the account username and "whmcs_crons" is the custom crons directory.
Restrict Access by IP
For added security, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:
order deny,allow allow from 184.108.40.206 allow from 220.127.116.11 deny from all
You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.". This is called Htaccess IP Restriction.
Restrict Database Privileges
For day to day use, only the following database privileges are required. All others may be disabled.
Please note that installation, upgrading, activating, and deactivating modules require the following additional privileges.