WHMCS provides a variety of security options that range from beginner to advanced. Here is an overview of the primary security features you can access through the general settings.
- Login to your WHMCS Admin
Hover over Setup and choose General Settings
Choose the Security tab
- Fill in the settings:
| Captcha Form Protection: |
Choose how captcha functions |
| Captcha Type: |
Select the type you wish to use |
| reCAPTCHA Public Key: |
You need to register for reCAPTCHA @ https://www.google.com/recaptcha/admin/create |
| reCAPTCHA Private Key: |
You need to register for reCAPTCHA @ https://www.google.com/recaptcha/admin/create |
| Required Password Strength: |
Enter the required password strength from 1 to 100 – Enter 0 to Disable |
| Failed Admin Login Ban Time: |
Enter the time to ban an IP in minutes after 3 failed login attempts – Enter 0 to Disable |
| Whitelisted IPs: |
IP Addresses exempt from being banned for invalid login attempts |
| Whitelisted IP Login Failure Notices: |
Tick to send login failure notices for Whitelisted IP addresses |
| Admin Force SSL Access: |
Tick this box to force SSL Access for all admin area requests |
| Disable Admin Password Reset: |
Tick this box to disable the forgotten password feature on the admin login page |
| Disable Credit Card Storage: |
Tick this box to not store customers credit cards in the database (Warning: This will delete any existing stored credit card data) |
| Allow Client CC Removal: |
Tick this box to allow customers to delete the credit card details stored on their account |
| Disable Session IP Check: |
This is used to protect against cookie/session hijacking but can cause problems for users with dynamic IPs |
| Allow Smarty PHP Tags: |
Tick to allow use of the Smarty {php} tag in templates. This is considered a security risk. |
| Proxy IP Header: |
Header used by your trusted proxies to relay IP information. Most proxies use “X_FORWARDED_FOR”; that is the default if no value is specified |
| Trusted Proxies: |
IP addresses of trusted proxies that forward traffic to WHMCS. Only add addresses that directly proxy requests! |
| API IP Access Restriction: |
– IP Addresses allowed to connect to the WHMCS API |
| Log API Authentication: |
Tick to record successful API authentications in Admin Log |
| CSRF Tokens: General: |
Tick to enable general use of CSRF tokens for all public and clientarea forms (Highly Recommended) |
| CSRF Tokens: Domain Checker: |
Tick to enable use of CSRF tokens for the Domain Checker form |
Click Save Changes
Now that you have gone through the Security options you are ready to proceed to the Social tab.
