Create WHMCS staff accounts, admin roles and two-factor authentication

As your hosting business grows, more people need access to WHMCS: support agents, billing staff, a developer. Giving everyone full admin rights is risky. WHMCS's administrator roles let you grant only what each person needs, and two-factor authentication protects every account against stolen passwords.

Before you start

• A full administrator account in WHMCS.
• A list of staff and what each needs to do.

Review the built-in roles

Go to Configuration → System Settings → Administrator Roles. WHMCS ships with Full Administrator, Sales Operator and Support Operator. You can edit them or create your own.

Create a custom role

1. Click Add New Role Group and name it, for example Billing Staff.
2. Tick the permissions the role needs, for example View Invoices, Manage Invoice, Add Transaction, View Clients Summary. Leave out Configure General Settings, Manage Servers and Configure Payment Gateways.
3. Choose which widgets appear on their dashboard.
4. Choose which email notifications the role can receive.
5. Click Save Changes.

Add a staff member

1. Go to Configuration → System Settings → Manage Admin Users (or Administrator Users).
2. Click Add New Administrator.
3. Choose the Administrator Role.
4. Enter first name, last name, email and a unique user name.
5. Set a strong temporary password and ask them to change it.
6. Under Assigned Departments, tick the support departments they handle.
7. Set Ticket Notifications as needed and click Save Changes.

Enable two-factor authentication

1. Go to Configuration → System Settings → Two-Factor Authentication.
2. Activate Time Based Tokens (works with Google Authenticator, Authy, Microsoft Authenticator) and optionally Duo Security or Yubico.
3. Tick Enable for Admin Users and Force Admin Users to Enable.
4. Optionally Enable for Clients so customers can protect their accounts.
5. Save. Each admin is asked to scan a QR code at next login and receives backup codes.

Review activity

• Utilities → Logs → Admin Log shows each staff login with IP address and time.
• Utilities → Logs → Activity Log records actions such as invoice changes, with the admin's name.
• Disable accounts of former staff immediately with Disable in Manage Admin Users rather than deleting them, to keep the audit trail.

Troubleshooting

• Staff cannot see a menu: the role lacks the matching permission.
• Staff cannot see tickets: they are not assigned to that department.
• Lost 2FA device: another full administrator can disable 2FA on the user's profile; otherwise use a backup code.
• 2FA codes rejected: the phone's time is off; enable automatic time.

Next steps

• Complete the WHMCS security checklist.
• Set up support departments.
• Back up the WHMCS database.