Português
English
This article is for resellers who run their own WHMCS. WHMCS is another company’s product: we neither sell nor resell licences, as explained in what WHMCS is. Menu names change from one WHMCS version to the next. The short answer: a WHMCS holds your customers’ details, your invoices and the key that creates and deletes accounts in WHM. You protect it on five fronts: an admin folder with a different name, two-factor login for every administrator, a read-only configuration file, the writable folders moved out of the public area, and updates kept current, always with a backup first.
What to protect, and why
| Item | The risk if left as shipped |
| The admin folder | It is the first address bots try. With the default name, anyone knows where the door is. |
| Administrator accounts | One stolen password opens everything: customers, invoices and the WHM key. Without a second factor there is no second barrier. |
| The configuration.php file | It holds the database password and the key that encrypts stored data. If it can be changed, an attacker can settle in. |
| Folders WHMCS writes to (attachments, downloads, compiled templates) | Inside the public area, a file someone uploads can be opened from a browser. |
| The install folder | Left on the server, it lets the installer run again on top of your install. |
| An old version | Flaws the maker fixed become public knowledge. Whoever does not update keeps them. |
The steps, in this order
|
|
|
|
|
|
|
|
| Do not lose the second factor without a plan B. Keep the backup codes somewhere other than your phone. And do not keep retrying the password when login fails: repeated attempts can block your IP, and that is no longer WHMCS: unblocking your IP. |
| One person, one administrator. Do not share a single admin account between colleagues. With separate accounts you give each person only the permissions they need, and the activity log tells you who did what. |
|
Think someone got into your WHMCS? Tell us the address and the time, and we will check the server logs on our side. Open a support ticket |
Where to see it in your account
- PHP version. In cPanel, Select PHP Version (or MultiPHP Manager) lists the versions your account offers. Compare with the version the WHMCS release you want asks for before you update.
- The scheduled task. In cPanel open Cron Jobs and add the command line that WHMCS shows on its Automation Settings screen.
- Permissions. In File Manager, select the file, choose Permissions and set it. configuration.php should be read-only once the install is finished.
- Outside the public part. The folders you create in the account's home folder, next to public_html and not inside it, cannot be opened from a browser. Create the writable folders there and tell WHMCS the new path in its storage settings.
- Your plan. Reseller I has 10 accounts and 50 GB, II 30 and 120 GB, III 60 and 250 GB: keep the WHMCS backups out of that space if they are large.
RECOMMENDED PRODUCT Web hosting with cPanel Domain and SSL included, daily backups and the panel you already know. from $6.59/mo (3-year plan, with coupon) See plans |
