Secure the Writeable Directories
We recommend moving all writeable directories to a non-public directory above your web root to prevent web based access. There are three writeable directories required for WHMCS to function, they are: "attachments", "downloads" and "templates_c"
We recommend moving all writeable directories to a non-public location above your web root to prevent web based access.
When you move the directories, you need to provide WHMCS with the new paths to use them. You do this by adding (or updating if they already exist) the following lines in the configuration.php file within the root WHMCS directory.
$attachments_dir = "/home/username/attachments/";
$downloads_dir = "/home/username/downloads/";
$templates_compiledir = "/home/username/templates_c/";
In the above example, "username" is the cPanel username and so the 3 folders are located in the home directory, above public_html.
Note that if you are running suPHP or phpSuExec chmod 755 should be sufficient permissions to make the directories writeable as this is the highest permission available for both folders and files when running in that condition.
Move the Crons Directory
The crons folder may be moved to any place above or below the docroot.
We recommend moving it to a non-public directory above your web root to prevent web based access.
The files within the crons directory need to know where to find your WHMCS installation, and your WHMCS installation needs to know where to find the crons directory, so the relocation process involves editing two files.
1. Begin by choosing a new location for your crons directory and move the entire /crons/ folder and contents to it.
2. Open the config.php file within the crons directory and follow the instructions within it to uncomment the WHMCS path line and provide the full path to your WHMCS installation. For example:
$whmcspath = '/home/username/public_html/whmcs/';
The above example assumes cPanel is being used, where "username" is the account username and "whmcs" is the directory containing the WHMCS installation.
REMEMBER: If you move the crons directory, when you upgrade WHMCS in future, you will need to update the cron files in your custom folder location and not upload the cron files to the default crons sub-directory or you will lose the benefits of moving them.
3. Open the configuration.php file within your WHMCS installation root directory and add the following line to the bottom of the file so that WHMCS is able to locate your custom crons directory location and show you the correct paths you need to use for cron and piping command configuration within the admin interface.
$crons_dir = '/home/username/whmcs_crons/';
The above example assumes cPanel is being used, where "username" is the account username and "whmcs_crons" is the custom crons directory.
If you have existing Cron Tasks configured before you make this change, you will need to update those to use the new directory path following making these changes.
Restrict Access by IP
For increased protection, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:
order deny,allow
allow from 12.34.5.67
allow from 98.76.54.32
deny from all
You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.". This is called Htaccess IP Restriction.
Change your WHMCS Admin Folder Name
Customising the url of your WHMCS admin area makes it harder for boths and malicious users to find it. It is not required, but if you wish to do so, find out how here: Customising the Admin Directory
Customising the name of your WHMCS admin directory makes it harder for bots and other malicious users to find your admin login url.
Renaming Your Admin Directory
The WHMCS software requires to know the name of the admin directory in order to function, so if you wish to change it, follow the steps below:
- Open the configuration.php file within your WHMCS installation's root directory
- At the bottom of the file (before the closing PHP tag ?> if one exists), add the following line:
$customadminpath = "mycustomfoldername"; - Replacing mycustomfoldername with the name you wish to use for your admin directory. This should just be the directory name, not a full path.
- If your configuration.php file already contains a custom admin path definition, you can simply update the existing line
- Rename the admin directory to the name you specified in step 2 above
- You cannot move the admin directory outside of the WHMCS folder tree - you can rename it, but not move it
- The admin directory name may only contain alphanumeric a-z 0-9 latin characters as well as dashes(-) and underscores(_)
Important Note for Upgrading
Remember! If you customise the name of your WHMCS admin directory, when it comes to applying updates or patches, it is important to remember to upload any files contained within the default "admin" directory in the distribution zip files to your custom admin directory folder. Failure to do this will result in unexpected behaviour.
Restrict Database Privileges
For day to day use, only the following database privileges are required. All others may be disabled.
- DELETE
- INSERT
- SELECT
- UPDATE
- LOCK TABLES
Please note that installation, upgrading, activating, and deactivating modules require the following additional privileges.
- ALTER
- CREATE
- DROP
- INDEX