https://docs.whmcs.com/9-1/tags/security/Recent content in security onHugo -- gohugo.iohttps://docs.whmcs.com/9-1/installation-guide/initial-configuration/enhancing-security/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/installation-guide/initial-configuration/enhancing-security/Enumerates ten security hardening steps for self-hosted installations: securing writeable directories, configuration.php, and crons, restricting Admin Area access by IP, renaming the admin directory, enabling SSL, and restricting database privileges.https://docs.whmcs.com/9-1/installation-guide/initial-configuration/secure-writeable-directories/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/installation-guide/initial-configuration/secure-writeable-directories/Walks through moving the attachments, downloads, and templates_c directories to a private location, updating the $templates_compiledir variable in configuration.php, and reconfiguring local storage paths in WHMCS’s Storage Settings interface using Switch or Migrate.https://docs.whmcs.com/9-1/clients/security-questions/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/clients/security-questions/Covers adding and disabling security questions at Configuration > System Settings > Security Questions, users setting up or updating their question and answer under Hello, Name! > Security Settings in the Client Area, and admins removing a user’s question via Manage User’s Disable Security Question setting.https://docs.whmcs.com/9-1/orders/spam-orders/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/orders/spam-orders/Lists methods to reduce spam orders: third-party firewalls, reCAPTCHA v3 or hCaptcha, banning email domains, disabling client registration and presales forms, a custom human-verification client field, MaxMind’s automatic fraud detection, and Only Auto Provision for Existing.https://docs.whmcs.com/9-1/system/authentication/api-credentials/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/api-credentials/Details the steps to create, edit, and delete API roles and API credential pairs at Configuration > System Settings > Manage API Credentials, including generating identifier/secret pairs and assigning permission roles to a credential.https://docs.whmcs.com/9-1/clients/client-email-verification/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/clients/client-email-verification/Explains how to enable email verification in the Security tab of General Settings, when verification emails trigger (new registration or email address change), the 60-minute validity of verification links, how users resend expired links, and where admins view verification status on the client Summary tab.https://docs.whmcs.com/9-1/installation-guide/initial-configuration/secure-the-configuration-file/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/installation-guide/initial-configuration/secure-the-configuration-file/Gives the chmod command to set configuration.php permissions to 400, lists fallback permissions (440, 444) for errors loading WHMCS, and notes the temporary 755 permission needed to update the license key.https://docs.whmcs.com/9-1/installation-guide/initial-configuration/move-the-cron-directory/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/installation-guide/initial-configuration/move-the-cron-directory/Walks through moving the crons directory above the web root, updating cron tasks and email forwarders, editing the crons config.php and configuration.php files with the new path, and updating the system cron command in cPanel.https://docs.whmcs.com/9-1/installation-guide/initial-configuration/rename-the-admin-directory/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/installation-guide/initial-configuration/rename-the-admin-directory/Walks through adding the $customadminpath variable to configuration.php, renaming the admin directory to match it, and re-uploading files to the custom directory name after applying WHMCS updates or patches.https://docs.whmcs.com/9-1/system/banned-ip-addresses/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/banned-ip-addresses/Covers manually adding, searching, filtering, and deleting entries on the Banned IPs list with wildcard IP ranges, the three-failed-login automatic ban trigger, removing an automatic ban via the tblbannedips database table, and restricting Admin Area access with an .htaccess allow-list.https://docs.whmcs.com/9-1/system/captcha-protection/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/captcha-protection/Compares the verification-code, checkbox (reCAPTCHA v2/hCaptcha), and invisible (reCAPTCHA v3/Invisible hCaptcha) captcha types, and gives the steps to select a Captcha Type, enter the Site Key and Secret Key, and set a score threshold under General Settings > Security.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-cron-issues/cron-http-access-denied-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-cron-issues/cron-http-access-denied-errors/Covers the 403 Access Denied error returned by crons/cron.php or the legacy admin/cron.php alias when a direct HTTP request’s IP address is not on the Cron HTTP Access Restriction allowlist, and gives the fix of invoking cron via CLI or adding the caller’s IP address or CIDR range to the allowlist in General Settings’ Security tab.https://docs.whmcs.com/9-1/system/system-tutorials/enable-default-captchas/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/system-tutorials/enable-default-captchas/Gives the steps to select Default (6 Character Verification Code) for Captcha Type and choose locations under Captcha for Select Forms on the Security tab of General Settings, noting the GD2 server requirement.https://docs.whmcs.com/9-1/system/system-tutorials/enable-hcaptcha/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/system-tutorials/enable-hcaptcha/Steps through selecting hCaptcha or Invisible hCaptcha for Captcha Type, authorizing the WHMCS domain in the hCaptcha account, entering the Site Key and Secret Key, setting the hCaptcha Score Threshold, and choosing Captcha for Select Forms locations on the Security tab of General Settings.https://docs.whmcs.com/9-1/system/system-tutorials/enable-recaptcha-v3/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/system-tutorials/enable-recaptcha-v3/Steps through selecting reCAPTCHA v3 for Captcha Type, registering a Score based (v3) site in the Google reCAPTCHA admin console, entering the Site Key and Secret Key, setting the reCAPTCHA Score Threshold, and choosing Captcha for Select Forms locations on the Security tab of General Settings.https://docs.whmcs.com/9-1/troubleshooting/grant-access-to-whmcs-support/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/grant-access-to-whmcs-support/Lists the WHMCS Support IP addresses and ranges to allowlist, the steps to create a temporary full-administrator user, cPanel and Plesk SSH key setup script commands, and the steps to remove temporary access and the admin user once support finishes.https://docs.whmcs.com/9-1/system/general-settings/general-settings-security/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/general-settings/general-settings-security/Documents Email Verification, Captcha Form Protection and Captcha Type options (Default, reCAPTCHA v2/v3, hCaptcha) with their Site/Secret Key and score threshold fields, Auto Generated Password Format, Minimum Password Length and Password Reuse Limit (with their PCI DSS-mandated lower limits of 12 and 4), Minimum User Password Strength, Failed Admin Login Ban Time, Whitelisted IPs, Trusted Proxies, Proxy IP Header, API IP Access Restriction, CSRF Token settings, and the Cron HTTP Access Restriction allowlist that gates direct HTTP requests to crons/cron.php.https://docs.whmcs.com/9-1/troubleshooting/general-troubleshooting/sensitive-directory-check-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/general-troubleshooting/sensitive-directory-check-errors/Resolves the System Health “Sensitive Directory Check” messages: a sensitive directory such as /vendor is web-accessible, a configured Storage Settings location (for example, Ticket Attachments, Client Files, or Downloads) is web-accessible, WHMCS could not determine whether a directory is web-accessible, or the System URL setting is not configured. Provides fixes per server type for exposed directories (verifying .htaccess exists and AllowOverride is not None on Apache, enabling .htaccess on OpenLiteSpeed, or manually restricting access on other servers like NGINX), moving or protecting an exposed Storage Settings location, configuring the System URL, and resolving directories that could not be evaluated.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-installation/administrator-password-refused-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-installation/administrator-password-refused-errors/Covers the web and CLI installer’s initial-admin password refusal: the 12-64 character, 72-byte, letter, number, and UTF-8 rules, the HTML-encoded-length edge case, and the CLI’s stdout-only, unlogged message with a non-zero exit status.https://docs.whmcs.com/9-1/system/database-and-storage/database-and-storage-tutorials/encrypt-your-mysql-connection/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/database-and-storage/database-and-storage-tutorials/encrypt-your-mysql-connection/Lists the db_tls_ca, db_tls_ca_path, db_tls_cert, db_tls_cipher, db_tls_key, and db_tls_verify_cert configuration.php settings needed to enable encrypted MySQL connections before, during (CLI -c/–config), or after installation.https://docs.whmcs.com/9-1/installation-guide/initial-configuration/restrict-nginx-directory-access/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/installation-guide/initial-configuration/restrict-nginx-directory-access/Details protecting the /vendor/ directory on NGINX servers that don’t read .htaccess, using cPanel & WHM’s Directory Privacy interface (v84+) or manual NGINX deny directives, plus locating the NGINX config file and restart commands by server type.