Securing your WHMCS installation is crucial for protecting sensitive customer and business information. While WHMCS has built-in security features, following additional steps can further safeguard your system against potential threats.
Pre-requisites
- Access to cPanel or a similar web hosting control panel.
- FTP/SFTP access to your server.
- Basic knowledge of Linux commands (if applicable).
- WHMCS installed and operational.
Step-by-Step Guide to Secure Your WHMCS Installation
1. Secure Writeable Directories
It's recommended to move all writeable directories to a private location to prevent unauthorized web access. The following directories need to be moved:
attachmentsdownloadstemplates_c
The attachments and downloads directories contain files attached to support tickets, while templates_c enhances the performance of templated pages and emails.
Moving Directories in cPanel
- Log in to your cPanel account and navigate to Files » File Manager.
- Locate your WHMCS installation directory.
- For each of the three directories mentioned:
- Right-click on the folder and select Move.
- Enter the new path (above the
public_htmldirectory). - Click Move File(s).
- Note the new directory paths for later steps.
- Return to the WHMCS installation path.
2. Update Configuration Files
- Right-click on
configuration.phpand select Edit. - Update the
$templates_compiledirsetting:$templates_compiledir = "/home/username/templates_c/"; - Save changes.
3. Update Storage Settings in WHMCS Admin Area
- In the WHMCS Admin Area, navigate to Configuration > System Settings > Storage Settings.
- In the Configurations tab, select Local Storage for Add New Configuration and click +.
- Enter the new path for the
attachmentsdirectory and click Save Changes. - Repeat the above step for the
downloadsdirectory. - In the Settings tab, select the new directory locations and click Switch.
- Only click Switch if you have successfully moved the directories. If you created new directories, use Migrate instead to copy the files.
Gotchas to Avoid
- Ensure that the new directories are above the
public_htmldirectory to prevent direct access. - Confirm that permissions are set correctly. Use the following command for Linux systems:
chmod 755 /path/to/directory - If using suPHP or PHP suEXEC, verify that permissions are compatible.
By following these steps, you can significantly enhance the security of your WHMCS installation. If you have any questions or need further assistance, consider reaching out to your hosting provider or system administrator.
