Further Security Steps

From WHMCS Documentation

Revision as of 16:11, 20 February 2019 by John (talk | contribs)

WHMCS has many features built-in to help keep your data safe, but here are several simple extra steps you can take to secure your WHMCS installation even further.

Secure the Writeable Directories

We recommend moving all writeable directories to a non-public location to prevent web based access. There are three writeable directories required for WHMCS to function, they are: attachments, downloads and templates_c

WHMCS needs to be given the new location of the writeable directories. This is done in two places:

File Storage

The attachments and downloads storage directories can be moved to a local location or stored remotely on an AWS S3-compatible service. If you are unfamiliar with the AWS S3 service we recommend using the local storage option.

  1. Create the storage location. This could be either:
    • A writeable directory on your server above the web-root
    • A non-public AWS S3-compatible storage bucket.
  2. Navigate to Setup > Storage Settings
  3. Use the interface to add the secure storage locations and switch to them.

For step-by-step guidance using this interface please refer to Storage Settings.

Templates Cache

The templates cache (templates_c) is used to improve performance of templated pages and emails.

  1. Create a templates_c directory in the desired location (a non-public location above your web root)
  2. Edit the configuration.php file and specify the path to the new location by adding a new line:
$templates_compiledir = "/home/username/templates_c/";

In the above example, "username" is the cPanel username and so the folder is located in the home directory, above public_html.

Note that if you are running suPHP or phpSuExec chmod 755 should be sufficient permissions to make the directories writeable as this is the highest permission available for both folders and files when running in that condition.

Secure the `configuration.php` File

We recommend adjusting the permissions set for the "configuration.php" file located in your WHMCS root directory. This file contains sensitive data that cannot be recovered without a backup of the file. To avoid accidentally overwriting, editing or deleting the file, change the permission setting of this file to `400`. This provides read only access to the file by the system and prevents anyone else from reading, editing or executing the file.

To change the permissions on this file, you can run the following command from shell while in your WHMCS root directory:

chmod 400 configuration.php


Some systems may require you to set the permission to 440 or 444 depending on how the server is configured. For most, 400 should suffice, but if you encounter an error loading the application after setting the permission to 400, try 440 and then 444.

License Key Updates

Should you need to ever update your license key, you must set the permissions on this file to 755 to allow the system to edit the file. Once the key is updated, you can revert the permissions to 400.

Move the Crons Directory

The crons folder may be moved to any place above or below the docroot.

We recommend moving it to a non-public directory above your web root to prevent web based access.

The files within the crons directory need to know where to find your WHMCS installation, and your WHMCS installation needs to know where to find the crons directory, so the relocation process involves editing two files.

1. Begin by choosing a new location for your crons directory and move the entire /crons/ folder and contents to it.

2. Open the config.php file within the crons directory and follow the instructions within it to uncomment the WHMCS path line and provide the full path to your WHMCS installation. For example:

$whmcspath = '/home/username/public_html/whmcs/';

The above example assumes cPanel is being used, where "username" is the account username and "whmcs" is the directory containing the WHMCS installation.

REMEMBER: After moving the crons directory, if you manually upgrade WHMCS in future, you will need to update the cron files in your custom folder location and not upload the cron files to the default crons sub-directory or you will lose the benefits of moving them.

3. Open the configuration.php file within your WHMCS installation root directory and add the following line to the bottom of the file so that WHMCS is able to locate your custom crons directory location and show you the correct paths you need to use for cron and piping command configuration within the admin interface.

$crons_dir = '/home/username/whmcs_crons/';

The above example assumes cPanel is being used, where "username" is the account username and "whmcs_crons" is the custom crons directory.

If you have existing Cron Tasks or Email Forwarders configured before you make this change, you will need to update those to use the new directory path following making these changes.

Restrict Access by IP

For increased protection, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:

order deny,allow
allow from
allow from
deny from all

You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.". This is called Htaccess IP Restriction.

Change your WHMCS Admin Folder Name

Customising the url of your WHMCS admin area makes it harder for bots and malicious users to find it. It is not required, but if you wish to do so, find out how here: Customising the Admin Directory

Restrict Database Privileges

For day to day use, only the following database privileges are required. All others may be disabled.


Please note that installation, upgrading, activating, and deactivating modules require the following additional privileges.

  • DROP

Enable SSL

As a billing application that handles customer data, there is often private and sensitive data passing between it and end users browsers. Therefore having a valid SSL Certificate that enables the use of HTTPs and encrypted communication is essential.

Once you have an SSL Certificate configured, simply enter the https:// enabled URL in the WHMCS System URL field in Setup > General Settings to ensure it is used.

If you do not have an SSL Certificate, you may purchase one quickly and easily at: https://www.whmcs.com/ssl-certificates/

<< Back to Installation Overview