WHMCS recommends that you take a few security steps after you complete an install.
The WHMCS Firewall module helps to remind you when you have not completed those best practices by sending you alerts until you do.
You should complete All the recommended “Further Security Steps” below but at the very least you “MUST” change your admin path from the default “admin”.
Change your WHMCS Admin Folder Name
With many web based softwares, users know they can try visiting various common directory names to find admin control panels. So customizing the location of your WHMCS admin area is one of many steps you can take in order to make the lives of malicious users looking for login forms a little bit more difficult. WHMCS needs to know what you call your admin directory, however if you choose to rename it, so if you would like to do this, please refer to Customizing the Admin Directory
Password Protect the Admin Directory
Add a second layer of protection to the admin directory by setting up .htaccess password protection. Most users can do this via the Password Protect Directories option in cPanel. Remember to keep your .htaccess username/password distinct and unique. You can use the Random Password Generation feature in cPanel to help.
Move the attachments, downloads & templates_c folders
The three folders “attachments”, “downloads” and “templates_c” need to be writeable by WHMCS and therefore require the permissions 777 (writeable by all). When folders have this permission level it is safer to place the folders outside of the public accessible folder tree on your website. WHMCS allows you to do this. If you do move the folders, then you must tell WHMCS where they have been moved to by adding the following lines to the configuration.php file:
$templates_compiledir = “/home/username/templates_c/”;
$attachments_dir = “/home/username/attachments/”;
$downloads_dir = “/home/username/downloads/”;
In the above example, “username” is the cpanel username and so the 3 folders are located in the home directory, above public_html.
Note that if you are running suphp or phpsuexec you should not make the mode changes as the folders will already be writeable. In fact, you cannot set folder or file permissions to be 777 when running suphp or phpsuexec – the highest permissions are 755 for both folders and files.
Move the crons folder
The “crons” folder currently contains the domain synchronisation file so this should also be moved outside the public accessible folder tree to prevent outside users from triggering it. The entire “crons” directory should be moved, containing both the domainsync.php and config.php files.
WHMCS allows you to do this. If you do move the folders, then you must tell WHMCS where they have been moved to by editing the /crons/config.php file and specifying the path to the WHMCS root directory, for example:
$whmcspath = ‘/home/username/public_html/whmcs/’;
In the above example, “username” is the cpanel username and whmcs is located in the directory “whmcs”.
Please note that if you have already created a cron job, or one has been created for you, you will need to update the path on the cron as well. eg. php -q /home/mylogin/crons/domainsync.php
Restrict Access by IP
For added security, if your staff uses fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:
allow from 220.127.116.11
allow from 18.104.22.168
deny from all
You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet’s by specifying just the first part of an IP, for example: “12.34.”. This is called Htaccess IP Restriction.
Restrict Database Privileges
For day to day use, only the following database privileges are required. All others may be disabled.
Please note that installation, upgrading, activating, and deactivating modules require the following additional privileges.