{"id":201540,"date":"2023-11-26T12:22:42","date_gmt":"2023-11-26T12:22:42","guid":{"rendered":"https:\/\/ded9.com\/?p=201540"},"modified":"2026-02-02T11:23:28","modified_gmt":"2026-02-02T11:23:28","slug":"10-ways-to-make-your-whmcs-installation-more-secure","status":"publish","type":"post","link":"https:\/\/ded9.com\/tr\/10-ways-to-make-your-whmcs-installation-more-secure\/","title":{"rendered":"10 Ways to Make Your WHMCS Installation More Secure: Essential Protection Steps"},"content":{"rendered":"<p><span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\">Activists in the field of providing hosting and virtual server services have always been and are the most frequent users of the WHMCS service. You may ask why. When launching your website, which is equipped with a management system for customer orders and invoices, WHMCS plays an important role. In order to have a secure WHMCS system, you need to purchase a\u00a0virtual server from a reliable and quality company as the first step.<\/span><\/p>\n<p>The WHMCS service contains the most important information about your business, the most personal information about your customers. Strangers&#8217; access to this information and disclosure will most likely destroy your business overnight. If you haven&#8217;t secured your WHMCS yet, keep in mind the valuable saying that &#8216;prevention is better than cure&#8217; and the sentence above: It is better to secure it immediately.<\/p>\n<p>If it is a program that can show all the information related to the services of all the customers in detail and provide the management of the services to the admin, it will probably be the first choice of many.<\/p>\n<p>WHMCS can be considered the beating heart of business customer transactions and order management. This system stores customer service and purchase information, and it allows you to extend and support services.<\/p>\n<p>Isn&#8217;t it better to protect the beating heart of our business with these explanations? Increasing the security of WHMCS should be done from the beginning of using this system because every second is important.<\/p>\n<p>Join us as we explore 10 ways to increase WHMCS security.<\/p>\n<h2>Ways to increase WHMCS security<\/h2>\n<p>Purchasing the original version of WHMCS is the first step in increasing its security. Be sure to use the paid, original version of this system. Cracked versions are completely penetrable.<\/p>\n<p>By applying the safety enhancement methods described below, you will actually prevent unauthorized access to the WHMCS system.<\/p>\n<p>The WHMCS system itself has features to protect your information, but in this section, we explain other ways to improve its security:<\/p>\n<h3>1. Moving Downloads, Attachments and Templates_C directories<\/h3>\n<p>It is better to move all writable folders and directories to a safe and personal place so that the possibility of accessing them on the web becomes zero.<\/p>\n<p><span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\">Note: If you are using suPHP or\u00a0PHP\u00a0<a href=\"https:\/\/en.wikipedia.org\/wiki\/SuEXEC\" target=\"_blank\" rel=\"noopener\">suEXEC<\/a>, directories are writeable at access level 755, which is the highest access level for files and folders.<\/span><\/p>\n<p>If you are unable to transfer all the folders or do not intend to transfer all the directories at the moment, you can start with the three folders Downloads, Attachments, and Templates_C.<\/p>\n<p>After migration, you need to update their location in the shell cache and installation file repository. How to move directories depends on the control panel you are using. Proceed as follows in cPanel:<\/p>\n<ul>\n<li>Go to Files &gt;&gt; File Manager in cPanel.<\/li>\n<li>Go to the installation directory of your WHMCS system.<\/li>\n<li>For each of the three folders:<\/li>\n<\/ul>\n<p>a) Right click on the folder and select Move.<\/p>\n<p data-wp-editing=\"1\"><img fetchpriority=\"high\" decoding=\"async\" class=\"aligncenter wp-image-201544 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.1.png\" alt=\"Right click on the folder and select Move.\" width=\"336\" height=\"245\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.1.png 336w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.1-300x219.png 300w\" sizes=\"(max-width: 336px) 100vw, 336px\" \/><\/p>\n<p>b) Enter the new location of the folders. The selected location must be in the public_html section. Then click Move File(s) to move the folders.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-201556 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.2-1.png\" alt=\"Enter the new location of the folders. The selected location must be in the public_html section. Then click Move File(s) to move the folders.\" width=\"438\" height=\"220\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.2-1.png 438w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.2-1-300x151.png 300w\" sizes=\"(max-width: 438px) 100vw, 438px\" \/><\/p>\n<p>Note: Be sure to write down the new path of the folders because we will need them later.<\/p>\n<p>c) Navigate to the WHMCS installation path.<\/p>\n<p>Right-click on the configuration.php file and select Edit.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-201559 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.3.png\" alt=\"Navigate to the WHMCS installation path.\" width=\"365\" height=\"209\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.3.png 365w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.3-300x172.png 300w\" sizes=\"(max-width: 365px) 100vw, 365px\" \/><\/p>\n<p>Update templates_compiledir$ settings to use the new templates_c location. for example:<\/p>\n<div class=\"wp-block-codemirror-blocks code-block \">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;php&quot;,&quot;mime&quot;:&quot;text\/x-php&quot;,&quot;theme&quot;:&quot;material&quot;,&quot;lineNumbers&quot;:false,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:false,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">$templates_compiledir = \"\/home\/username\/templates_c\/\";<\/pre>\n<\/div>\n<p>username is the username of your host.<\/p>\n<ul>\n<li>Save the changes by clicking Save Changes.<\/li>\n<li>Go to the opposite address in the WHMCS admin area: Configuration &gt; System Settings &gt; Storage Settings<\/li>\n<li>In the Configurations tab, select Local Storage and then Add New Configuration and click +.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201562 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.4.png\" alt=\"username is the username of your host.\" width=\"309\" height=\"140\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.4.png 309w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.4-300x136.png 300w\" sizes=\"(max-width: 309px) 100vw, 309px\" \/><\/p>\n<ul>\n<li>Enter the new path of the attachments directory and save the changes.<\/li>\n<li>Repeat the previous two steps for the downloads folder.<\/li>\n<li>In the Settings tab, select the new path of each directory in each menu.<\/li>\n<\/ul>\n<p>Click on Switch to complete the process.<\/p>\n<p>Note: Select Switch only when you have moved folders. If you have created new directories, use Migrate to copy the files from the old directory to the new directory.<\/p>\n<h3>2. Setting the configuration.php file permissions<\/h3>\n<p>The second recommended method is to set the permissions of the configuration.php file in the root directory of your site&#8217;s WHMCS. This file contains sensitive information that cannot be recovered without a backup.<\/p>\n<p>Changing the permissions of this file prevents its accidental editing, overwriting, and deletion.<\/p>\n<p>Permission 400 restricts file access to read-only mode and prevents other people from viewing, editing, and executing the file. To grant 400 permission to the configuration.php file, run the following command in the root of the WHMCS directory:<\/p>\n<div class=\"wp-block-codemirror-blocks code-block \">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;php&quot;,&quot;mime&quot;:&quot;text\/x-php&quot;,&quot;theme&quot;:&quot;material&quot;,&quot;lineNumbers&quot;:false,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:false,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">chmod 400 configuration.php<\/pre>\n<\/div>\n<p>Hints :<\/p>\n<p>While 400 permissions are usually enough for most systems, some system settings may require 440 or 444 permissions. If you have problems reloading the app, try these permissions.<br \/>\nAlso, if you need to update the license key, you must apply for license 755. After the update, you can change it to 400.<\/p>\n<h3>3. Change the name of the WHMCS system admin folder<\/h3>\n<p>By renaming the WHMCS admin folder, you make it harder for bots and hackers to find the WHMCS admin area URL. To do this, we need to create a custom directory and update the WHMCS settings.<\/p>\n<ul style=\"list-style-type: square;\">\n<li><a href=\"https:\/\/ded9.com\/best-url-shortener-for-wordpress-in-2023\/\">Best URL Shortener for WordPress in 2023<\/a><\/li>\n<\/ul>\n<p>Open the configuration.php file in the root directory of the WHMCS installation.<\/p>\n<p>Edit the following line where the word example is the name of your choice:<\/p>\n<div class=\"wp-block-codemirror-blocks code-block \">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;php&quot;,&quot;mime&quot;:&quot;text\/x-php&quot;,&quot;theme&quot;:&quot;material&quot;,&quot;lineNumbers&quot;:false,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:false,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">$customadminpath = \"example\";<\/pre>\n<\/div>\n<p>Hints:<\/p>\n<p>a) The name of the admin folder must consist of standard characters, i.e. English alphabets, numbers 0 to 9, hyphen (-) and dash (-) and be available in the root directory.<\/p>\n<p>b) Enter the folder name only. No need to enter its address.<\/p>\n<p>c) If you don&#8217;t see this code, add it to the end of the code lines or before the final ?&gt; (if any).<\/p>\n<p>Replace the admin directory with the name you chose for customadminpath and save the changes.<\/p>\n<h3>4. Activation of the SSL certificate on the domain<\/h3>\n<p>The WHMCS system generally contains important information that is being transferred between the system and the target user&#8217;s browser. Having a valid SSL certificate that enables the exchange of encrypted information and the use of HTTPS is essential for any site.<\/p>\n<p>If your site does not have an SSL certificate, obtain an SSL license.<\/p>\n<p>After activating the ssl security certificate in cPanel on the site domain, set the WHMCS System URL settings in the General tab and the Configuration &gt; System Settings &gt; General Settings section by entering \/\/:https before the domain address.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201565 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.6-1024x620-1.jpg\" alt=\"After activating the ssl security certificate in cPanel on the site domain, set the WHMCS System URL settings in the General tab and the Configuration &gt; System Settings &gt; General Settings section by entering \/\/:https before the domain address.\" width=\"1024\" height=\"620\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.6-1024x620-1.jpg 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.6-1024x620-1-300x182.jpg 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.6-1024x620-1-768x465.jpg 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>Finally, save the applied changes.<\/p>\n<h3>5. Limitation of database privileges<\/h3>\n<p>The WHMCS system requires the following privileges to perform daily tasks:<\/p>\n<ul>\n<li dir=\"ltr\">DELETE<\/li>\n<li dir=\"ltr\">INSERT<\/li>\n<li dir=\"ltr\">SELECT<\/li>\n<li dir=\"ltr\">UPDATE<\/li>\n<li dir=\"ltr\">LOCK TABLES<\/li>\n<\/ul>\n<p>For more security, it is better to limit access to other privileges such as ALTER, CREATE, DROP and INDEX. For this, perform the following steps:<\/p>\n<p>Step 1: Enter cPanel through the user area.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201568 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.7-1024x259-1.jpg\" alt=\"Step 1: Enter cPanel through the user area.\" width=\"1024\" height=\"259\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.7-1024x259-1.jpg 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.7-1024x259-1-300x76.jpg 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.7-1024x259-1-768x194.jpg 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>Step 2: Go to the Databases section and open MySQL Databases.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201571 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.8-1024x272-1.png\" alt=\"Step 2: Go to the Databases section and open MySQL Databases.\" width=\"1024\" height=\"272\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.8-1024x272-1.png 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.8-1024x272-1-300x80.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.8-1024x272-1-768x204.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>Step 3: Go to Current Databases and select the database you want.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201574 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.9-1024x314-1.png\" alt=\"Step 3: Go to Current Databases and select the database you want.\" width=\"1024\" height=\"314\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.9-1024x314-1.png 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.9-1024x314-1-300x92.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.9-1024x314-1-768x236.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>Step 4: Next to the database used for WHMCS, click on the user in the Privileged Users row<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201580 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.10-1024x306-2.png\" alt=\"Step 4: Next to the database used for WHMCS, click on the user in the Privileged Users row\" width=\"1024\" height=\"306\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.10-1024x306-2.png 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.10-1024x306-2-300x90.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.10-1024x306-2-768x230.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>User selection from the used database<\/p>\n<p>Fifth step: Remove ALTER, CREATE, DROP and INDEX privileges from this user&#8217;s privileges. Finally, click the Make Changes button at the bottom of the page.<\/p>\n<h3>6. Move the Crons directory<\/h3>\n<p>Moving the Crons directory can also restrict web access to this directory. After the transfer, we must also update the WHMCS settings.<\/p>\n<p>Step 1: Move the entire \/crons\/ directory to the new location.<\/p>\n<p>Step 2: If you used Cron Job, update their defined location to the new location of the cron.<\/p>\n<p>Step 3: Rename the config.php.new file to config.php.<\/p>\n<p>Step 4: Open the config.php file and find the whmcspath$ line.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201583 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.11.png\" alt=\"Step 4: Open the config.php file and find the whmcspath$ line.\" width=\"627\" height=\"296\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.11.png 627w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.11-300x142.png 300w\" sizes=\"(max-width: 627px) 100vw, 627px\" \/><\/p>\n<p>Fifth step: Remove the two characters \/ from the beginning of the line and replace the phrase \/path\/to\/whmcs\/ with the full address of the new folder. for example:<\/p>\n<div class=\"wp-block-codemirror-blocks code-block \">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;php&quot;,&quot;mime&quot;:&quot;text\/x-php&quot;,&quot;theme&quot;:&quot;material&quot;,&quot;lineNumbers&quot;:false,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:false,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">$whmcspath = '\/home\/username\/public_html\/whmcs\/';<\/pre>\n<\/div>\n<p>Step 6: Save the file and exit.<\/p>\n<p>Step Seven: Open the configuration.php file in the root directory of the WHMCS installation.<\/p>\n<p>Step 8: Replace \/home\/username\/whmcs_crons\/ in the code below with the address of the new directory, then add the resulting code to the end of the code.<\/p>\n<div class=\"wp-block-codemirror-blocks code-block \">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;php&quot;,&quot;mime&quot;:&quot;text\/x-php&quot;,&quot;theme&quot;:&quot;material&quot;,&quot;lineNumbers&quot;:false,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:false,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">$crons_dir = '\/home\/username\/whmcs_crons\/';<\/pre>\n<\/div>\n<p>Step 9: Update the new directory location in the cron job.<\/p>\n<p>Step 10: To complete the update process, transfer all the updated cronjob files from the default location to the new location.<\/p>\n<h3>7. Restrict access to IPs<\/h3>\n<p>If you and your employees work with fixed IPs, you can restrict access to WHMCS to a specific set of IPs by following the steps below.<\/p>\n<ul>\n<li>Log in to cPanel.<\/li>\n<li>Go to the File Manager section.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201586 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.12-1024x350-1.png\" alt=\"If you and your employees work with fixed IPs, you can restrict access to WHMCS to a specific set of IPs by following the steps below.\" width=\"1024\" height=\"350\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.12-1024x350-1.png 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.12-1024x350-1-300x103.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.12-1024x350-1-768x263.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>In this section, go to the location where the WHMCS installation files are, and open the admin folder.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201589 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.13-1024x289-1.png\" alt=\"In this section, go to the location where the WHMCS installation files are, and open the admin folder.\" width=\"1024\" height=\"289\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.13-1024x289-1.png 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.13-1024x289-1-300x85.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.13-1024x289-1-768x217.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>To limit IPs, we need to create a new file inside this directory. To do this, click the File+ button in the upper left corner.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201592 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.14.png\" alt=\"To limit IPs, we need to create a new file inside this directory. To do this, click the File+ button in the upper left corner.\" width=\"754\" height=\"783\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.14.png 754w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.14-289x300.png 289w\" sizes=\"(max-width: 754px) 100vw, 754px\" \/><\/p>\n<p>htaccess statement. put as the file name. Now click on Create New File.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201595 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.15.png\" alt=\"htaccess statement. put as the file name. Now click on Create New File.\" width=\"770\" height=\"391\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.15.png 770w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.15-300x152.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.15-768x390.png 768w\" sizes=\"(max-width: 770px) 100vw, 770px\" \/><\/p>\n<p>After the htaccess file. created, it will be placed in the admin\/ folder.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201598 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.16-1024x457-1.png\" alt=\"After the htaccess file. created, it will be placed in the admin\/ folder.\" width=\"1024\" height=\"457\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.16-1024x457-1.png 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.16-1024x457-1-300x134.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.16-1024x457-1-768x343.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>Once on the htaccess file, left-click to activate the Edit option in the tools row at the top of the File Manager. Click on it.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201602 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.17-1024x459-1.png\" alt=\"Once on the htaccess file, left-click to activate the Edit option in the tools row at the top of the File Manager. Click on it.\" width=\"1024\" height=\"459\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.17-1024x459-1.png 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.17-1024x459-1-300x134.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.17-1024x459-1-768x344.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>The Edit page will appear, click Edit at the bottom right of the page.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201605 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.18.png\" alt=\"The Edit page will appear, click Edit at the bottom right of the page.\" width=\"760\" height=\"541\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.18.png 760w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.18-300x214.png 300w\" sizes=\"(max-width: 760px) 100vw, 760px\" \/><\/p>\n<p>An HTML editor will open in a new tab in your browser. Enter the following text in it:<\/p>\n<div class=\"wp-block-codemirror-blocks code-block \">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;htmlmixed&quot;,&quot;mime&quot;:&quot;text\/html&quot;,&quot;theme&quot;:&quot;material&quot;,&quot;lineNumbers&quot;:false,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:false,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">order deny,allow\r\nallow from x.x.x.x\r\nallow from x.x.x.x\r\ndeny from all<\/pre>\n<\/div>\n<p>For each IP you want to provide access to, start the line with allow from and complete with the IP address. You can define an unlimited number of IPs. With the above code, the access request of all IPs except the defined IPs is rejected.<\/p>\n<p>At the end of your file, there will be a file like the image below:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201609 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.19.png\" alt=\"At the end of your file, there will be a file like the image below:\" width=\"648\" height=\"247\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.19.png 648w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.19-300x114.png 300w\" sizes=\"(max-width: 648px) 100vw, 648px\" \/><\/p>\n<p>Click the Save Changes button in the upper right corner of the screen. Now, only the IPs that are allowed to access the admin directory can load the login page.<\/p>\n<h3>8. Prevent Clickjacking<\/h3>\n<p>Clickjacking is a form of online fraud. This attack involves covering a dangerous page with another simple page to force the user to click.<\/p>\n<p>By limiting the elements of a page to a button so that clicking anywhere on the page and on any element will do only one thing, hackers will seek to steal information, delete user accounts, etc.<\/p>\n<p>To secure the site against Clickjacking, do the following:<\/p>\n<p>Enter CPanel and go to File Manager.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201612 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.12-1-1024x350-1.png\" alt=\"Enter CPanel and go to File Manager.\" width=\"1024\" height=\"350\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.12-1-1024x350-1.png 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.12-1-1024x350-1-300x103.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.12-1-1024x350-1-768x263.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>htaccess file. Find and left-click on it once. Then click on the Edit button at the top of the page to open the editing page:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201615 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.20-1024x438-1.png\" alt=\"htaccess file. Find and left-click on it once. Then click on the Edit button at the top of the page to open the editing page:\" width=\"1024\" height=\"438\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.20-1024x438-1.png 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.20-1024x438-1-300x128.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.20-1024x438-1-768x329.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>Click Edit on the page that opens.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201618 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.18-1.png\" alt=\"Click Edit on the page that opens.\" width=\"760\" height=\"541\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.18-1.png 760w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.18-1-300x214.png 300w\" sizes=\"(max-width: 760px) 100vw, 760px\" \/><\/p>\n<p>In the editor that is opened in a new tab, put the following codes at the end of the codes and save the changes:<\/p>\n<div class=\"wp-block-codemirror-blocks code-block \">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;php&quot;,&quot;mime&quot;:&quot;text\/x-php&quot;,&quot;theme&quot;:&quot;material&quot;,&quot;lineNumbers&quot;:false,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:false,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">&lt;IfModule mod_headers.c&gt; Header always append X-Frame-Options SAMEORIGIN &lt;IfModule\/&gt;<\/pre>\n<\/div>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-201621 size-full\" src=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.21-1024x387-1.png\" alt=\"In the editor that is opened in a new tab, put the following codes at the end of the codes and save the changes:\" width=\"1024\" height=\"387\" srcset=\"https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.21-1024x387-1.png 1024w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.21-1024x387-1-300x113.png 300w, https:\/\/ded9.com\/wp-content\/uploads\/2023\/11\/10-ways-to-secure-whmcs.21-1024x387-1-768x290.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>Now your site is protected from Clickjacking.<\/p>\n<h3>9. Close unused ports<\/h3>\n<p>One of the best ways to prevent unauthorized access is to close unused ports. This will reduce the possibility of unauthorized access to the WHMCS server and system.<\/p>\n<p>In addition to closing ports, there are various ways to protect them, such as Port Knocking, which you can also use.<\/p>\n<h3>10. Physical protection of the server<\/h3>\n<p>The last way on our list is to physically protect the server. This is the only way to access WHMCS information other than the Internet after all web access is closed.<\/p>\n<p>For this reason, make sure that the server is located in a safe place and that you also physically protect the server.<\/p>\n<h2>Conclusion<\/h2>\n<p>The WHMCS system is the management center for all customer orders, invoices, and tickets. Because important information is exchanged every moment in this system, its security must be increased to the highest possible level.<\/p>\n<p>We mentioned 10 methods of increasing security, which we suggest you do all 10 methods to achieve the maximum level of security. In case of any problem or question, share it with our experts in the comments section.<\/p>\n<p>Also, if you know another way that is not mentioned in this article, we will be happy if you share it with others in the comments section.<\/p>\n<h2>FAQ<\/h2>\n<div id=\"rank-math-rich-snippet-wrapper\"><div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Why secure writable directories in WHMCS?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Moving writable folders like attachments, downloads, and templates_c out of public web access prevents unauthorized file access and enhances security.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How does enabling SSL help WHMCS security?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>SSL encryption protects sensitive information exchanged between users and your WHMCS site by using HTTPS instead of plain HTTP.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What\u2019s a good way to protect the WHMCS admin area?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Rename the admin directory and restrict access by IP addresses so that only authorized users can reach the login page.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Activists in the field of providing hosting and virtual server services have always been and are the most frequent users of the WHMCS service. You may ask why. When launching your website, which is equipped with a management system for customer orders and invoices, WHMCS plays an important role. In order to have a secure [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":201541,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1043],"tags":[4690],"class_list":["post-201540","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-web","tag-whmcs"],"acf":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/posts\/201540","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/comments?post=201540"}],"version-history":[{"count":4,"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/posts\/201540\/revisions"}],"predecessor-version":[{"id":266910,"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/posts\/201540\/revisions\/266910"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/media\/201541"}],"wp:attachment":[{"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/media?parent=201540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/categories?post=201540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ded9.com\/tr\/wp-json\/wp\/v2\/tags?post=201540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}