Further Security Steps - Revision history

SarahK at 20:04, 14 February 2023

2023-02-14T20:04:27Z

2023-02-10T20:21:33Z

‎Recommended Steps

2023-02-10T20:21:10Z

‎Recommended Steps

2023-02-10T20:20:52Z

2023-02-08T22:02:13Z

‎Enable SSL

2023-02-08T21:52:14Z

‎Restrict Database Privileges

2023-02-08T21:32:58Z

‎Change your WHMCS Admin Folder Name

2023-02-08T21:32:11Z

‎Restrict Access by IP

2023-02-08T21:12:50Z

‎Move the Crons Directory

2023-02-08T20:46:24Z

‎Secure the configuration.php File

← Older revision		Revision as of 20:04, 14 February 2023
Line 1:		Line 1:
−	WHMCS includes many features to help keep your data safe, but you can ~~simple~~ additional steps to secure your WHMCS installation further.	+	WHMCS includes many features to help keep your data safe, but you can take recommended additional steps to secure your WHMCS installation further.

	== Recommended Steps ==		== Recommended Steps ==

@@ Line 3: / Line 3: @@
 == Recommended Steps ==
-This includes:
+We recommend:
 # Securing the writeable directories by [https://help.whmcs.com/m/installation/l/1650299-securing-writeable-directories moving them to a non-public location].

@@ Line 14: / Line 14: @@
 # Defending against clickjacking by [https://owasp.org/www-community/attacks/Clickjacking always sending the proper Content Security Policy (CSP) frame-ancestors directive response headers].
 # Performing general server hardening measures (for example, [https://docs.cpanel.net/knowledge-base/security/security-best-practices/ cPanel's] or [https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration OWASP's] best practices).
 If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance.

@@ Line 1: / Line 1: @@
 WHMCS includes many features to help keep your data safe, but you can simple additional steps to secure your WHMCS installation further.
-==Secure the Writeable Directories==
+== Recommended Steps ==
-We recommend moving all writeable directories to a non-public location to prevent web based access.
+This includes:
-For more information and steps to do this, see [https://help.whmcs.com/m/installation/l/1650299-securing-writeable-directories Securing Writeable Directories].
+# Securing the writeable directories by [https://help.whmcs.com/m/installation/l/1650299-securing-writeable-directories moving them to a non-public location].
-==Secure the configuration.php File==
+If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance.

@@ Line 41: / Line 41: @@
 As a billing application that handles customer data, there is often private and sensitive data passing between WHMCS and end users' browsers. Having a valid SSL certificate that enables the use of HTTPS and encrypted communication is essential.
-After you configure an SSL certificate, enter the <tt>https://</tt>-enabled URL in the '''WHMCS System URL''' text box in the '''[[General Tab|General]]''' tab at '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > General Settings''' or, prior to WHMCS 8.0, '''Setup > General Settings''' to ensure that the system uses it.
+For steps to configure this, see [https://help.whmcs.com/m/installation/l/1650306-enabling-ssl Enabling SSL].
 ==Vendor Directory==

@@ Line 33: / Line 33: @@
 ==Restrict Database Privileges==
-Disable any unneeded database privileges.
+We recommend disabling any unneeded database privileges. WHMCS requires a specific set of permissions for day-to-day use and additional privileges during installation, upgrades, and module activations.
-Most tasks only require the following database privileges:
+For more information and lists of the required permissions, see [[System_Environment_Guide#Database_Privileges|System Environment Guide]].
 ==Enable SSL==

@@ Line 27: / Line 27: @@
 ==Change your WHMCS Admin Folder Name==
-Optionally, customising the URL of your WHMCS [[Admin Area]] can make it harder for bots and malicious users to find it. For steps, see [[Customising the Admin Directory]].
+Optionally, customising the URL of your WHMCS [[Admin Area]] can make it harder for bots and malicious users to find it.
 ==Restrict Database Privileges==

@@ Line 21: / Line 21: @@
 ==Restrict Access by IP==
-For increased protection, if your staff uses fixed IP addresses, you can restrict access to a specific set of IPs. To do this, create a file with the name <tt>.htaccess</tt> in your WHMCS admin directory with the following content:
+For increased protection, if your staff uses fixed IP addresses, you can restrict access to a specific set of IP addresses.
-===Apache 2.2===
+For steps to do this, see [https://help.whmcs.com/m/installation/l/1650303-restricting-access-by-ip-address Restricting Access by IP Address].
 ==Change your WHMCS Admin Folder Name==

@@ Line 15: / Line 15: @@
 ==Move the Crons Directory==
-{{:Custom Crons Directory}}
+We recommend moving the <tt>crons</tt> directory to a private directory above your web root in order to prevent web-based access.
 ==Restrict Access by IP==

@@ Line 9: / Line 9: @@
 ==Secure the configuration.php File==
-We recommend adjusting the permissions for the "configuration.php" file in your WHMCS root directory. This file contains sensitive data that you can't recover without a backup of the file. To avoid accidentally overwriting, editing or deleting the file, change the permission setting of this file to <tt>400</tt>.  This provides the system with read-only access and prevents anyone else from reading, editing or executing the file.
+We recommend adjusting the permissions for the <tt>configuration.php</tt> file in your WHMCS root directory. This file contains sensitive data that you can't recover without a backup of the file.
-To change the permissions on this file, you can run the following command while in your WHMCS root directory:
+For steps to do this, see [https://help.whmcs.com/m/installation/l/1650301-securing-the-configuration-file Securing the Configuration File].
 ==Move the Crons Directory==