WHMCS security hardening checklist

WHMCS holds customer data, payment tokens and the keys to your servers, which makes it a target. Most compromises exploit simple things: a default admin path, writable configuration, outdated versions or weak staff passwords. Work through this checklist after installation and review it every few months.

Before you start

• Administrator access to WHMCS and File Manager or SSH access to its files.
• A full backup of the WHMCS files and database.

Protect files and folders

1. Lock configuration.php: set permissions to 400 (or 440) so it cannot be modified by PHP.
2. Move writable folders out of the web root: create /home/user/whmcs_data/ and move attachments, downloads and templates_c there. Update paths under Configuration → System Settings → Storage Settings and set $templates_compiledir in configuration.php.
3. Move the crons folder: move crons outside the web root, edit crons/config.php to point to the WHMCS path, and update the cron job command.
4. Delete the install folder right after installation.
5. Rename the admin folder: rename admin to something unique and set $customadminpath = 'yourname'; in configuration.php.

Secure staff logins

• Enable two-factor authentication under Configuration → System Settings → Two-Factor Authentication and force it for all administrators. See admin roles and 2FA.
• Give every staff member their own account with the least-privileged Administrator Role.
• Remove accounts of former staff immediately.
• Restrict admin area access by IP: add an .htaccess rule in the admin folder allowing only your office or VPN IPs, or use General Settings → Security → Admin IP Whitelist where available.

Protect clients and forms

• Enable CAPTCHA (reCAPTCHA v3 or hCaptcha) on login, registration, checkout, contact and domain checker forms under General Settings → Security.
• Set Required Password Strength to at least 50.
• Offer two-factor authentication for clients too.
• Enable Fraud Protection (MaxMind or FraudLabs Pro) under Configuration → System Settings → Fraud Protection to review risky orders.

Secure the API

• Under General Settings → Security → API IP Access Restriction, allow only the IPs of systems that use the API.
• Create API credentials per integration under Configuration → System Settings → Manage API Credentials with a limited API role.

Server and transport

• Serve WHMCS only over HTTPS and enable HSTS.
• Use a supported PHP version with security updates.
• Put WHMCS on its own subdomain and, ideally, its own hosting account, separate from your WordPress site.
• Enable server-side malware scanning and a WAF (Imunify360 or ModSecurity).

Keep WHMCS updated

Apply security releases as soon as they are published. WHMCS announces them in the admin area and by email. See update WHMCS safely. Also update third-party modules and themes – outdated addons are a frequent entry point.

Monitor

• Review Utilities → Logs → Admin Log for logins from unknown IPs.
• Check Utilities → System → System Health regularly; it flags insecure settings.
• Keep daily off-site database backups.

Next steps

• Set up admin roles and 2FA.
• Configure WHMCS database backups.
• Update WHMCS.