\r\n \t\t\t\t\tDid you know that you can get a free<\/strong><\/span> WHMCS license<\/strong> with our reseller hosting<\/a> plans? Give us a try! \ud83e\udd1d \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n WHMCS recommends moving all writeable directories to a non-public location to prevent web-based access. There are three required writeable directories in WHMCS:<\/p>\n If you change the location of these writable directories, you must specify their new location in WHMCS. This is done in 2 places:<\/p>\n You have the option to move the attachments and downloads storage directories to a local location, or you can store them remotely on an AWS S3-compatible service. (If you aren’t familiar with S3-type services, we recommend using the Local Storage option.)<\/p>\n To change your storage locations, use the steps below.<\/p>\n Step 1:<\/strong> Create your tertiary storage location in the new service. This could either be one of the following:<\/p>\n Step 2:<\/strong> Login to your WHMCS installation and once logged in, click the wrench in the top right corner, then click System Settings.<\/p>\n Visit Site<\/a> Step 3:<\/strong> Using the search function at the top, search for storage. Once the Storage Settings option loads, click it to open the Storage Settings.<\/p>\n Step 4:<\/strong> Once the Storage Settings load, you’ll be presented with a list of all storage types and their locations:<\/p>\n In order to set a offsite or S3-type storage, you’ll need to click the Configurations option at the top:<\/p>\n Once the configurations load, you’ll be presented with a list of the three local configurations plus the option to Add New Configuration.<\/p>\n Click the drop-down next to Local Storage and choose S3, then click the + to add the configuration.<\/p>\n Once you’ve entered that information, click Save Changes.<\/p>\n <\/p>\n Next, return to the Settings by clicking Settings.<\/p>\n Once the list of locations loads, click the drop-down menu next to the location you want to set to remote, then choose the newly created remote destination from the drop-down menu.<\/p>\n You can use the templates cache (templates_c) to improve the performance of templated pages and emails. To do this, follow the steps below:<\/p>\n Step 1:<\/strong> Create a templates_c directory in the desired location…. i.e. above your public_html folder.<\/p>\n Step 2:<\/strong> This will involve editing the configuration.php file of your WHMCS installation. To do this, log in to your ChemiCloud account by clicking here<\/a>, then open your cPanel > File Manager.<\/p>\n Click on the file, then at the top click Edit in the row of tools. In the modal that appears, click Edit.<\/p>\n A new tab will open with your WHMCS configuration listed:<\/p>\n If you are changing the location of the templates_c, specify the new path to the templates_c directory you created on Line 10.<\/p>\n \t\t \r\n \t\t\t\t\tIf you are running suPHP or PHP suEXEC, chmod 755 should be sufficient permissions to make the directories writeable. This is the highest permission available for both folders and files when running in that condition. \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n Step 4:<\/strong> When you’ve finished editing, click Save Changes in the top right corner.<\/p>\n WHMCS recommends adjusting the permissions for the “configuration.php” file in your WHMCS root directory. This file contains sensitive data that you can’t recover without a backup of the file. To avoid accidentally overwriting, editing, or deleting the file, change the permission setting of this file to 400.<\/p>\n This provides the system with read-only access and prevents anyone else from reading, editing, or executing the file.<\/p>\n To change the permissions on this file, you can use the Terminal app to do. Just follow the steps below:<\/p>\n Step 1:<\/strong> Login to your ChemiCloud account by clicking here<\/a>, then open your cPanel and look for Terminal, which is located in the Advanced Section.<\/p>\n Step 2:<\/strong> Once the Terminal Page opens, you’ll need to click the blue button which says “I understand and want to proceed.”. The Terminal is an advanced feature and you’ll need to follow the directions below precisely.<\/p>\n Step 3:<\/strong> After clicking the blue button, the terminal will load.<\/p>\n Step 4:<\/strong> Using the cd command, which stands for change directory, change directory into the directory where your WHMCS location is installed. In my case, WHMCS is installed in a folder called billing which is located in the public_html folder, so I will use this command:<\/p>\n to change directories into the WHMCS installation directory.<\/p>\n \t\t \r\n \t\t\t\t\tIf you aren’t sure where that is, or need a visual reminder, you can use the LIST command, which is ls, to list the directories in the folder in which you are currently located.<\/p>\n In case it’s difficult to see, in the above image, I used the following commands:<\/p>\n This allowed me to show, or “list” the directories in each folder as I moved through them one at a time, to be sure I was able to navigate into the right directory.<\/p>\n \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n Step 5: Next you need to run the following command in your Terminal:<\/p>\n \r\n \t\t\t\t\tSome systems may require you to set the permission to 440 or 444, depending on the server’s configuration. Usually, 400 should suffice, but if you encounter an error loading the application after setting the permission to 400, try 440 and then 444. \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n \r\n \t\t\t\t\tThe CHMOD command doesn’t have any output on successful run, which means it will only give you output if there’s something wrong. I.e. you don’t have permission to change the file permissions, etc.\u00a0 \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n After running the command, your Terminal should look like this:<\/p>\n \r\n \t\t\t\t\tFor commands like CHMOD which don’t have output on successful run, being sent back to a blank command line is called being sent back to prompt.\u00a0 \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n Congrats, you’ve successfully changed the permissions on the WHMCS configuration.php file. Keep in mind, if you need to update your WHMCS License Key, you must set the permissions on this file to 755 to allow the system to edit the file. After updating your license key, you can revert the permissions to 400.<\/p>\n For increased protection, if you and all of your staff use fixed (static) IP addresses, you can restrict access to WHMCS to a specific set of IP addresses. To do this, use the steps below:<\/p>\n Step 1:<\/strong> Log in to your cPanel. There’s a lot of ways to do this, but the sure-fire easiest way is to login to your Client Area<\/a>, then open your cPanel.<\/p>\n Step 2:<\/strong> Once your cPanel is open, open your File Manager.<\/p>\n Step 3:<\/strong> In your File Manager, navigate to the directory where your WHMCS installation is located, and open the admin directory.<\/p>\n Step 4:<\/strong> You’ll need to create a new file in the admin directory in order to restrict access to WHMCS by IP address. To do this, click + File in the top left corner of File Manager.<\/p>\n Click Create New File after entering the filename.<\/p>\n Single-click on the .htaccess file to select it, then click Edit in the top right corner of the row of tools at the top of File Manager.<\/p>\n The Edit modal will appear, just click Edit in the bottom right corner to proceed.<\/p>\n Enter the following text:<\/p>\n For each IP address, you wish to allow, enter a new line beginning with allow from, following by the IP address.<\/p>\n When you’ve finished, your file could look like this one below (depending on how many IPs you’ve allowed):<\/p>\n When you’ve finished, click the Save Changes button in the top right corner.<\/p>\n Now, when others try to access your WHMCS Admin area, unless their IP address is on the list, they won’t be able to load the login page or any other elements in the Admin directory.<\/p>\n \t\t \r\n \t\t\t\t\tYou can specify as many different allow from IP address entries as you need. You can allow entire IP subnets by specifying just the first part of an IP address (for example, 12.34.). \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n You can rename the Admin directory into something else to make it even harder for people to access your Admin area or break into your WHMCS installation.<\/p>\n Follow the steps below to rename your WHMCS admin directory.<\/p>\n Step 1:<\/strong> Login to your cPanel. There’s a lot of ways to do this, but the sure fire easiest way is to login to your Client Area<\/a>, then open your cPanel.<\/p>\n Step 2:<\/strong> Once your cPanel is open, open your File Manager.<\/p>\n Step 3:<\/strong> In your File Manager, navigate to the Directory where your WHMCS installation is located and locate a file called configuration.php.<\/p>\n Click on the file, then at the top click Edit in the row of tools. In the modal that appears, click Edit.<\/p>\n A new tab will open with your WHMCS configuration listed:<\/p>\n At the bottom of the configuration, add a new line with the following text:<\/p>\n Replace “mycustomfoldername” with the name you wish to use for your Admin directory. This should just be the directory name, not the full path to the directory.<\/p>\n Click Save Changes in the top right corner to save these new changes.<\/p>\n Step 4:<\/strong> Next, return to your File Manager and locate the Admin directory in the directory where WHMCS is installed.<\/p>\n Single-click the folder, then click Rename from the row of tools at the top of the File Manager.<\/p>\n In the rename modal, give the folder the same name you entered in the WHMCS configuration.php file in the earlier step, then click the rename file button to save the file rename.<\/p>\n Now, the folder will be renamed and your WHMCS installation is even more secure!<\/p>\n WHMCS only requires a few database permissions to operate day-to-day, including these permissions:<\/p>\n However, if you are doing a new installation, upgrade, or activating and deactivating modules, you’ll need these privileges:<\/p>\n For enhanced security, you can disable access to ALTER, CREATE, DROP, and INDEX. To do this, use the steps below:<\/p>\n Step 1:<\/strong> Login to your cPanel. There’s a lot of ways to do this, but the sure fire easiest way is to login to your Client Area<\/a>, then open your cPanel.<\/p>\n Step 2:<\/strong> Once your cPanel is open, scroll down to the Databases section and open MySQL Databases.<\/p>\n Step 3:<\/strong> Scroll to the Current Databases section and locate the database that’s used for your WHMCS installation.<\/p>\n \t\t \r\n \t\t\t\t\tIf you don’t remember which database you used for your WHMCS installation, not to worry, just open your cPanel, then navigate to File Manager, and using the File Manager, open the configuration.php file located in the directory where your WHMCS installation is located.<\/p>\n The database used will be listed in the configuration.php file. \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\nWHMCS Security Checklist: 5 Ways to Secure Your Installation<\/h2>\n
Secure Your Writable Directories<\/h3>\n
\n
\n
File Storage:<\/h4>\n
\n
![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/3-19.png\")
<\/a>![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/1-10.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/1-18.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/2-20.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/3-20.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/4-18.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/5-19.png\")
<\/a>In the modal that appears, you’ll need to enter the Access Key & Secret, plus the Bucket name and region, and an optional endpoint URL in order to successfully set this up.<\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/6-17.png\")
<\/a><\/p>\nTemplates Cache:<\/h4>\n
![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/7-17.png\")
<\/a>Step 3: In your File Manager, navigate to the Directory where your WHMCS installation is located and locate a file called configuration.php.<\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/8-15.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/9-14.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/11-8.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/12-9.png\")
<\/a><\/p>\nSecure the configuration.php File<\/h3>\n
![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/2-21.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/3-21.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/4-20.png\")
<\/a><\/p>\ncd public_html\/billing<\/pre>\n
![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/6-19.png\")
<\/a><\/p>\nls\r\n\r\ncd public_html\r\n\r\nls\r\n\r\ncd billing<\/pre>\n
chmod 400 configuration.php<\/pre>\n \t\t
![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/7-18.png\")
<\/a><\/p>\n \t\t![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/8-16.png\")
<\/a><\/p>\n \t\tRestrict Access By IP Address<\/h3>\n
![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2020\/12\/lab.jpg\")
<\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/11-9.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/12-10.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/13-8.png\")
<\/a>In the new file modal, the file name will be .htaccess<\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/14-8.png\")
<\/a>Once the .htaccess file is created, it will be listed amongst the other files in the \/admin directory:<\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/15-5.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/16-4.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/17-2.png\")
<\/a>Step 5:<\/strong> A new tab in your browser will open with the HTML editor.<\/p>\norder deny,allow\r\nallow from x.x.x.x\r\nallow from x.x.x.x\r\ndeny from all<\/pre>\n
![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/19-2.png\")
<\/a><\/p>\nRenaming Your Admin Directory<\/h3>\n
<\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n$customadminpath = \"mycustomfoldername\";<\/pre>\n<\/div>\n
![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/20-2.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/21-1.png\")
<\/a><\/p>\nRestrict Database Privileges<\/h3>\n
\n
\n
<\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/22-1.png\")
<\/a><\/p>\n
![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/24-1.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/07\/23-1.png\")
<\/a>Step 5: Uncheck the permissions that are not needed for day-to-day functioning of WHMCS. This includes these:<\/p>\n