Securing your WHMCS: the admin folder, two-step login, file permissions and updates

Choosing the Right Plan··· 178 views· 5 min read

This article is for resellers who run their own WHMCS. WHMCS is another company’s product: we neither sell nor resell licences, as explained in what WHMCS is. Menu names change from one WHMCS version to the next. The short answer: a WHMCS holds your customers’ details, your invoices and the key that creates and deletes accounts in WHM. You protect it on five fronts: an admin folder with a different name, two-factor login for every administrator, a read-only configuration file, the writable folders moved out of the public area, and updates kept current, always with a backup first.

What to protect, and why

Item The risk if left as shipped
The admin folder It is the first address bots try. With the default name, anyone knows where the door is.
Administrator accounts One stolen password opens everything: customers, invoices and the WHM key. Without a second factor there is no second barrier.
The configuration.php file It holds the database password and the key that encrypts stored data. If it can be changed, an attacker can settle in.
Folders WHMCS writes to (attachments, downloads, compiled templates) Inside the public area, a file someone uploads can be opened from a browser.
The install folder Left on the server, it lets the installer run again on top of your install.
An old version Flaws the maker fixed become public knowledge. Whoever does not update keeps them.

The steps, in this order

1 Take a backup first: files and database, kept outside the account. See making and keeping your own backup.
2 Delete the install folder if it is still there.
3 Rename the admin folder. Rename it in File Manager and tell WHMCS the new name with this line in configuration.php (use your own name): $customadminpath = 'a-name-only-you-know'; Bookmark the new address: the old one stops answering.
4 Switch on two-factor login: in Configuration > System Settings > Two-Factor Authentication, enable a method and make it compulsory for administrators. Each administrator finishes the setup in their own profile. Do the same on your account with us: enabling two-factor authentication.
5 Make configuration.php read-only (for example 400 or 444), as WHMCS’s own health screen recommends. See file permissions explained.
6 Move the writable folders out of the public area (attachments, downloads, compiled templates) and, if you like, the crons folder. The WHMCS documentation names the configuration line that points to each new place. If you move crons, fix the cron job path in cPanel in the same minute: cron jobs.
7 Open the System Health screen (in the utilities menu) and deal with whatever it flags as a warning.
8 Update when a new release comes out, after checking your licence covers it and the folder’s PHP version is supported. Always update the same way: the WHMCS updater or the cPanel application installer, not both in turn.
Do not lose the second factor without a plan B. Keep the backup codes somewhere other than your phone. And do not keep retrying the password when login fails: repeated attempts can block your IP, and that is no longer WHMCS: unblocking your IP.
One person, one administrator. Do not share a single admin account between colleagues. With separate accounts you give each person only the permissions they need, and the activity log tells you who did what.

Think someone got into your WHMCS? Tell us the address and the time, and we will check the server logs on our side.

Open a support ticket

Where to see it in your account

  • PHP version. In cPanel, Select PHP Version (or MultiPHP Manager) lists the versions your account offers. Compare with the version the WHMCS release you want asks for before you update.
  • The scheduled task. In cPanel open Cron Jobs and add the command line that WHMCS shows on its Automation Settings screen.
  • Permissions. In File Manager, select the file, choose Permissions and set it. configuration.php should be read-only once the install is finished.
  • Outside the public part. The folders you create in the account's home folder, next to public_html and not inside it, cannot be opened from a browser. Create the writable folders there and tell WHMCS the new path in its storage settings.
  • Your plan. Reseller I has 10 accounts and 50 GB, II 30 and 120 GB, III 60 and 250 GB: keep the WHMCS backups out of that space if they are large.

SEE ALSO

Installing WHMCS on your account

The most common WHMCS problems, and what causes them

File permissions explained: what 755, 644 and 777 mean

Files that must never be public: .git folders, .env, backups and database dumps

How to enable or disable two-factor authentication (2FA)

Making and keeping your own backup, and testing that it works

RECOMMENDED PRODUCT

Reseller hosting with WHM

Create, host and bill your own plans, under your own brand. from $35.57/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Choosing the Right Plan 2,099 Shared hosting vs VPS: which one does your project need? The difference is not "better" and "worse": it is who administers the machine. On shared hosting, we do. On a VPS, you d...
Choosing the Right Plan 2,026 Shared hosting vs dedicated server: when the jump is worth it These are the two extremes: on one side, everything handled by us on a shared machine; on the other, an entire physical...
Choosing the Right Plan 2,051 Shared hosting vs Cloud: what actually changes "Cloud" is so worn out in advertising that it has stopped meaning anything. In our catalogue it means something concrete...
Choosing the Right Plan 1,516 VPS vs Cloud: the difference is the network, not the marketing They are close relatives: in both cases you get a virtual machine of your own, with root access and administration on yo...
Choosing the Right Plan 1,565 VPS vs dedicated server: virtual resources or the whole machine On a VPS the resources are yours, but the physical machine is divided between several virtual machines. On a dedicated s...
Choosing the Right Plan 178 WHMCS e-mails landing in spam or not sent: SMTP settings, sender address and templates This article is for resellers who run their own WHMCS. WHMCS is another company’s product: we neither sell nor resell li...