Security Tab - Revision history

SarahK: /* Allow Smarty PHP Tags */

2023-01-26T21:49:52Z

‎Allow Smarty PHP Tags

SarahK: /* Allow Smarty PHP Tags */

2023-01-03T19:32:38Z

‎Allow Smarty PHP Tags

SarahK: /* Log API Authentication */

2022-05-03T20:17:10Z

‎Log API Authentication

SarahK at 13:48, 15 April 2022

2022-04-15T13:48:33Z

SarahK at 13:34, 15 April 2022

2022-04-15T13:34:29Z

SarahK at 18:33, 7 February 2022

2022-02-07T18:33:02Z

SarahK: /* Allow Client Pay Method Removal */

2022-02-01T19:13:05Z

‎Allow Client Pay Method Removal

SarahK: /* Failed Admin Login Ban Time */

2022-01-26T19:36:19Z

‎Failed Admin Login Ban Time

SarahK at 21:48, 20 January 2022

2022-01-20T21:48:00Z

SarahK: /* Email Verification */

2022-01-17T18:51:32Z

‎Email Verification

@@ Line 93: / Line 93: @@
 ===Allow Smarty PHP Tags===
-−
-The use of {php} tags is deprecated in WHMCS 6 and above, but you can enable legacy support during the transition period. We recommend disabling this option unless you specifically require it. For more information, see [[Templates and Custom PHP Logic]].
+<div class="docs-alert-warning">
 ===Trusted Proxy Settings===

@@ Line 94: / Line 94: @@
 ===Allow Smarty PHP Tags===
-The use of {php} tags is depreciated in WHMCS v6 and above, but legacy support can be enabled here during a transition period. We recommend keeping this option disabled unless you specifically require it. For more information, see [[Templates and Custom PHP Logic]].
+The use of {php} tags is deprecated in WHMCS 6 and above, but you can enable legacy support during the transition period. We recommend disabling this option unless you specifically require it. For more information, see [[Templates and Custom PHP Logic]].
 ===Trusted Proxy Settings===

@@ Line 141: / Line 141: @@
 ===Log API Authentication===
-By default, successful authentications made via the API are not recorded. Checking this option will record them with Admin Area authentications under '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Logs > Admin Log''' or, prior to WHMCS 8.0, '''Utilities > Logs > Admin Log'''. This might be useful for recording logins from your staff using our mobile apps.
+By default, successful authentications made via the API are not recorded. Checking this option will record them with Admin Area authentications in the '''Admin Log''' at '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > [[System Logs]]''' or, prior to WHMCS 8.0, '''Utilities > Logs'''. This might be useful for recording logins from your staff using our mobile apps.
 ===CSRF Tokens===

@@ Line 3: / Line 3: @@
 The '''Security''' tab allows you to configure security-related features in WHMCS.
-You can access this tab at at '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > [[General Settings]]''' or, prior to WHMCS 8.0, '''Setup > General Settings'''.
+You can access this tab at '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > [[General Settings]]''' or, prior to WHMCS 8.0, '''Setup > General Settings'''.
 ===Email Verification===

← Older revision		Revision as of 13:34, 15 April 2022
Line 1:		Line 1:
−	<br/><br/>{{General Settings}}	+	{{General Settings}}<br/>
		+
		+	The '''Security''' tab allows you to configure security-related features in WHMCS.
		+
		+	You can access this tab at at '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > [[General Settings]]''' or, prior to WHMCS 8.0, '''Setup > General Settings'''.

	===Email Verification===		===Email Verification===

@@ Line 96: / Line 96: @@
 The '''Trusted Proxies''' setting allows you to itemize IP addresses or IP ranges for proxies or other forwarding services so that WHMCS can accurately determine the IP address of inbound traffic.
-You may find it necessary to utilize the trusted proxy settings if your WHMCS installation:
+You may find it necessary to configure these if your WHMCS installation:
 * is behind a proxy you control.
@@ Line 107: / Line 107: @@
 Unfortunately, this also makes it look as if your client logins, admin logins, and orders are all coming from the proxy instead of the real location. When this happens, the location is masked for logging, access authorization, fraud detection, or other IP address-related purposes.
-To counteract this, the details of your proxy service [[Trusted_Proxy_Settings|can be entered into these fields]].
+Using these settings can help to mitigate these issues. For more information, see [[Trusted Proxy Settings]].
 <div class="docs-alert-warning">
@@ Line 122: / Line 122: @@
 ====Trusted Proxies====
-[[File:TrustedProxiesWithData.png|thumb|Sample Trusted Proxies]]
+[[File:TrustedProxiesWithData.png|thumb]]
-Use this field to add and remove IP addresses and IP address CIDR ranges of trusted proxies. WHMCS will check the header to discover the actual canonical request IP address.
+This list contains the IP addresses and IP address CIDR ranges of trusted proxies. WHMCS will check the header to discover the actual canonical request IP address.
 ===API IP Access Restriction===

@@ Line 80: / Line 80: @@
 When this is unchecked, only admins can remove credit card details from a client's account.
-When this is checked, an option will appear in the Shopping Cart and Client Area for the same.
+When this is checked, an option will appear in the Shopping Cart and Client Area to allow them to choose to store the payment details they are entering as a saved Pay Method for faster checkouts in future.
 ===Disable Session IP Check===

@@ Line 43: / Line 43: @@
 ===Failed Admin Login Ban Time===
-If someone makes three incorrect attempts to log in to the WHMCS Admin Area, this is the time in minutes before they can try to log in again (dictionary attack protection). To remove the ban on an IP address, see [[FAQs|How to Unban Your IP]].
+By default, WHMCS blocks any user IP addresses that attempt to log in to the admin area with a valid username and incorrect password three or more times. The length of this ban, by default, is 15 minutes. This helps to prevent hackers from endlessly trying different password combinations in order to gain access to your admin area.
-Set this to <tt>0</tt> to disable the login ban feature.
+Use this setting to specify this number of minutes before the user can try again. This provides dictionary attack protection.
 ===Whitelisted IPs===

@@ Line 17: / Line 17: @@
 This requires GD2 on your server and displays an image with five characters on a blue striped background. No additional configuration is required.
-=====reCAPTCHA=====
+=====reCAPTCHA and Invisible reCAPTCHA=====
-This uses [http://www.google.com/recaptcha Google's reCAPTCHA] service. You must register [https://www.google.com/recaptcha/admin/create here] for a set of keys to use this service. Then, you can enter the keys in the appropriate boxes on this tab.
+These options use [http://www.google.com/recaptcha Google's reCAPTCHA] service. You must register [https://www.google.com/recaptcha/admin/create here] for a set of keys to use this service. Then, you can enter the keys in the appropriate boxes on this tab.
+* When you select one of these options, the '''Captcha for Select Forms''' checkboxes and '''reCAPTCHA Site Key''' and '''reCAPTCHA Secret Key''' text boxes will appear.
-For configuration instructions, see [[Google_No_CAPTCHA_reCAPTCHA|No CAPTCHA reCAPTCHA]] for more details.
+* For full configuration instructions, see [[Google reCAPTCHA]].
 ===Required Password Strength===

@@ Line 3: / Line 3: @@
 ===Email Verification===
-When you enable this, WHMCS will send an email to new clients on account creation or update. This email requests that the user confirms their intent to register or change of email address. For more information, see [[Client Email Verification]].
+When you enable this, WHMCS will send an email verification notice each time a user or admin creates a new client and each time an existing client email address changes. The client must use the verification link in the email to confirm the new email address.
 ===Captcha Form Protection===