WHMCS uses a .htaccess file to protect the /vendor/ directory, but NGINX® does not read .htaccess files. Because of this, the directory loses its protection on servers that runs NGINX. If your server uses NGINX, you must take additional steps to protect sensitive directories.

Restricting Directory Access #

For cPanel & WHM version 84 and Later #

In cPanel & WHM version 84 and later, you can use cPanel’s Directory Privacy interface (Home » cPanel » Files » Directory Privacy) to add protection to this directory.

To protect the directory, perform the following steps:

1. Select the /whmcs/vendor directory in cPanel’s Directory Privacy interface (Home » cPanel » Files » Directory Privacy).
   
2. Select Password protect this directory.
   
3. Enter a display label for Enter a name for the protected directory.
   
   This name only functions as a label for the directory. Do not confuse it with the directory’s actual name.
4. Click Save. A confirmation message will appear. Click Go Back to return to the directory’s configuration.

For All Other Control Panels #

To restrict directory access on servers that run cPanel & WHM version 82 and earlier or on other hosting control panels:

1. Log in to the web server.
2. Locate the NGINX configuration template.
3. Add the deny directive to the top of the server block of your site’s configuration:

   server {
       location ^~ /vendor/ {
           deny all;
           return 403;
       }
       ...
   }
   

4. Save your changes and restart NGINX.

Locating the NGINX Configuration File #

NGINX has a very flexible configuration organization. Because of this, your configuration file may be in a number of different places:

Other Servers #

If you do not find the configuration file in any of the above locations:

1. Run the following command on your server:

   nginx -t
   

   The output will display the current directory path to your server’s NGINX configuration file. For example:

   nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
   nginx: configuration file /etc/nginx/nginx.conf test is successful
   

2. To check whether the NGINX configuration file contains any include directives, run the following command:

   grep include /etc/nginx/nginx.conf
   

   If the grep command does not return any output, you can proceed with your changes to the configuration. The server directive will exist in the file that you found in step 1.

3. If the grep command returns any results, you must check each include file for the server directive. For example, this output would require you to check all four include files for server directives:

   include /etc/nginx/modules-enabled/*.conf;
   include /etc/nginx/mime.types;
   include /etc/nginx/conf.d/*.conf;
   include /etc/nginx/sites-enabled/*;
   

Restarting NGINX #

After making any configuration changes to NGINX, you must reload the NGINX configuration by restarting NGINX.

Last modified: 2025 July 28