InnoHosting
US: 1-888-522-INNO
UK: 0800-612-8075
Knowledgebase
Installing WHMCS
Posted by Chris W. on 06 July 2008 10:00 PM

Downloading WHMCS

Click here to navigate to our downloads page

Installing WHMCS

Installing WHMCS is very simple. The following steps will guide you through the process:

  1. Unzip the contents of the zip file to a folder on your computer
  2. Rename the file configuration.php.new to configuration.php
  3. Upload the entire whmcs folder to your website - if you experience problems, try uploading in binary mode
  4. Next you can rename the folder to whatever you like (billing, clients, etc...)
  5. Now visit the installation script at http://www.yourdomain.com/whmcs/install/install.php to run the installer process.
  6. Follow the instructions on screen to install which will involve setting file permissions as listed below, entering your license key and setting up your primary admin account
  7. When complete, delete the install folder from your web server.

 

Secure your WHMCS

Change your WHMCS Admin Folder Name

Malicious users who visit your site and recognise a WHMCS install will know that they can try logging into your admin area @ /admin/ To protect against this, you can rename the admin folder to something else. You then must tell WHMCS what the name of that folder is for things to work by adding the following line to the configuration.php file:

$customadminpath = "custom_admin_folder_name_goes_here";

 

NB. The Custom admin folder name can contain only alphanumeric characters (0-9, a-z).
The variable in the configuration.php file should not contain a leading slash (/)

Please note that if you have already created a cron job, or one has been created for you, you will need to update the path on the cron as well. eg. php -q /home/mylogin/public_html/secure/myfoldername/cron.php

Password Protect the Admin Directory

Add a second layer of protection to the admin directory by setting up .htaccess password protection. Most users can do this via the Password Protect Directories option in cPanel. Remember to keep your .htaccess username/password distinct and unique. You can use the Random Password Generation feature in cPanel to help.

Move the attachments, downloads & templates_c folders

The three folders "attachments", "downloads" and "templates_c" need to be writeable by WHMCS. When folders have this permission level it is safer to place the folders outside of the public accessible folder tree on your website. WHMCS allows you to do this. If you do move the folders, then you must tell WHMCS where they have been moved to by adding the following lines to the configuration.php file:

$templates_compiledir = "/home/username/templates_c/";
$attachments_dir = "/home/username/attachments/";
$downloads_dir = "/home/username/downloads/";

In the above example, "username" is the cpanel username and so the 3 folders are located in the home directory, above public_html.

Move the crons folder

The "crons" folder currently contains the domain synchronisation file so this should also be moved outside the public accessible folder tree to prevent outside users from triggering it. The entire "crons" directory should be moved, containing both the domainsync.php and config.php files.

WHMCS allows you to do this. If you do move the folders, then you must tell WHMCS where they have been moved to by editing the /crons/config.php file and specifying the path to the WHMCS root directory, for example:

 $whmcspath = '/home/username/public_html/whmcs/';

In the above example, "username" is the cpanel username and whmcs is located in the directory "whmcs".

Please note that if you have already created a cron job, or one has been created for you, you will need to update the path on the cron as well. eg. php -q /home/mylogin/crons/domainsync.php

Restrict Access by IP

For added security, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:

order deny,allow
allow from 12.34.5.67
allow from 98.76.54.32
deny from all

You can specify as many different allow from lines as you require. Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.". This is called Htaccess IP Restriction.

(708 vote(s))
Helpful
Not helpful

Comments (0)