How to Set Up WHMCS Yourself: Install, Secure, Configure, Test

To set up WHMCS yourself, follow the order in the official installation guide: check the server against the system requirements, upload the files, create the database, run install/install.php, delete the install folder and fix permissions. Then harden the install, add the cron job, finish the Getting Started Wizard, configure settings, gateways, products and support, set up backups and place test orders.

In what order should you set up WHMCS?

Install first, secure second, configure third, test last. The Install WHMCS page ends with this order; the menu paths are from the WHMCS 9.0 documentation. WHMCS Cloud does the install, security and cron for you, so this guide is for self-hosted installs. If you are still deciding whether WHMCS fits, start with what WHMCS is and what it does.

What do you need before installing WHMCS?

You need a license, a server that meets the requirements and an empty MySQL database. With a license bought from WHMCS you download the Full Release from the Members Area; a reseller supplies the files otherwise. The PHP, ionCube Loader and MySQL versions change with each release, so I keep them in a separate WHMCS system requirements guide. Installing ionCube Loader and turning off MySQL strict mode both need root, so without it, ask your host first.

How do you install WHMCS?

Upload the files, create the database and run the browser installer. These are the documented steps:

1. Unzip the release and upload the whmcs folder, or upload the ZIP and extract it in cPanel's File Manager. You may rename the folder, for example to billing, but not to admin.
2. Create the database and a user with ALTER, CREATE, DROP, INDEX, LOCK TABLES, SELECT, INSERT, UPDATE and DELETE.
3. Open https://example.com/whmcs/install/install.php. Accept the license agreement, set the file permissions it asks for, enter the license key and create the primary admin account.
4. Delete the install folder when the Installation Completion page appears.
5. Check permissions: configuration.php at 400, and attachments, downloads and templates_c writable. Under suPHP or suEXEC you can restrict them further, and DSO needs 644.

If the database requires encrypted connections, use the command-line installer instead. On Plesk there is also a WHMCS Installer extension. In the 9.1 beta, the first admin password must be 12 to 64 characters, and a new install has to connect a WHMCS Marketplace account before the Admin Area opens.

Which security steps come right after the install?

Do the ten steps on the Enhancing Security page before you add gateways or customer data. The ones that need file changes:

• Writable directories. Move attachments, downloads and templates_c above the web root. Set $templates_compiledir in configuration.php, then add the two storage paths as Local Storage at Configuration > System Settings > Storage Settings and click Switch.
• The configuration file. Keep configuration.php read-only and keep a copy somewhere safe. It holds the encryption hash, and the data cannot be recovered without it.
• The crons folder. Move it above the web root and point $crons_dir at it.
• The admin folder. Add $customadminpath = "yourname"; at the bottom of configuration.php and rename the folder to match. Letters, numbers, hyphens and underscores only. After every update, copy the new admin files into it.

The rest are settings: HTTPS on the domain, a database user without ALTER, CREATE, DROP and INDEX for daily running, admin access limited to fixed staff IP addresses, a block on direct requests to vendor if you run Nginx, and a frame-ancestors Content Security Policy header against clickjacking. WHMCS also suggests banning sign-ups with email addresses on your own company domain.

How do you set up the WHMCS cron job?

Add crons/cron.php to the server's cron to run every five minutes, and do it before the first admin login. Copy the exact command from Configuration > System Settings > Automation Settings rather than typing the path:

*/5 * * * * php -q /home/username/whmcs_crons/cron.php

Daily tasks run in the Time of Day hour, 9:00am server time by default. My WHMCS cron guide covers the status page, the PHP version mismatch warning and debugging.

What does the Getting Started Wizard set up?

It covers the basics in one pass on your first admin login. You can skip any step and reopen it at Configuration > Getting Started Wizard. The Getting Started Wizard page lists its steps:

• Admin and client area languages, and consent to analytics tracking.
• Company name, email, address and a PNG or JPG logo.
• Payments with PayPal Payments, Stripe, Bank Transfer or Mail In Payment.
• Domain sales with Enom and prices for the TLDs you pick.
• Your first cPanel, Plesk or DirectAdmin server.
• MarketConnect products.

After the wizard, the Setup Tasks list at Configuration > System Settings shows what is still missing, such as a product or a support department.

Which General Settings should you change first?

Go through the tabs at Configuration > System Settings > General Settings in this order:

Publish the SPF and DKIM records your mail provider gives you, or invoices land in spam.

How do you add gateways, servers, products and support?

Add them in this order, because a product needs a server and an invoice needs a gateway:

1. Gateway: Configuration > Apps & Integrations. If you take no online payments yet, activate Mail In Payment or Bank Transfer. My Stripe guide covers card payments.
2. Server: Configuration > System Settings > Servers, then test the connection. See the cPanel integration guide.
3. Products: Configuration > System Settings > Products/Services. Create a product group, then each product with its pricing and module settings.
4. Support: Configuration > System Settings > Support Departments, then Add New Department. Then set up email piping or email importing so replies become ticket updates.

If you sell domains or bill in more than one currency, my guides on domain registrar setup and multi-currency setup go further.

How should you set the WHMCS automation rules?

Set them at Configuration > System Settings > Automation Settings to match your terms of service. The defaults and options below come from the Automation Settings page:

• Invoice Generation: 14 days before the due date by default, with per billing cycle and domain overrides under Advanced Settings.
• Reminders: one unpaid reminder before the due date and up to three overdue reminders. A value of 0 turns one off.
• Suspension: Enable Suspension with Suspend Days, and Enable Unsuspension so payment reactivates the service. A manual suspension with a custom reason is not reversed.
• Termination: Termination Days. This removes the account from the server, so give it enough days and say so in your terms.
• Auto Cancellation: cancels old unpaid invoices, but never ones with a partial payment or applied credit.

How do you set up WHMCS backups?

Turn on an automated database backup at Configuration > System Settings > Database Backups and keep configuration.php safe separately. The Database Backups page gives three options. SFTP/FTP stores the zipped SQL file remotely, without FTPS support. cPanel Backups only asks cPanel to start a full backup and needs a WHM API token with the basic-system-info and cpanel-api permissions. Daily Email Backups may fail on large databases. Both remote options need a passing Test Connection before Save & Activate.

For a manual copy, use Utilities > System > Database Status or run php -q cron.php do --DatabaseBackup. The database backup leaves out your custom templates, hooks and modules, so back up the files too, and restore a copy once to prove it works.

How do you test WHMCS before taking real orders?

Put gateways and registrars in test mode and push test orders through every stage. For later changes, use a separate test install as described in Set Up a Test Environment: WHMCS gives one free development license per directly bought license, it must be password protected, and Disable Email Sending in the Mail tab stops test mail reaching customers.

1. Order a product from the public order form as a new client and pay with the gateway in test mode.
2. Confirm the service is Active, the account exists on the server and the welcome email arrives.
3. Open a ticket, reply from the admin side and close it.
4. Move the next due date back, let the cron run and check the renewal invoice.
5. Suspend, unsuspend and terminate the test service.
6. Clear every warning at Configuration > System Health that applies to you.

When is a do-it-yourself WHMCS setup the wrong choice?

When nobody will maintain it afterwards. A self-hosted install needs updates, PHP upgrades in the right order and someone who reads System Health. Shared hosting without root can block ionCube Loader and strict mode changes; WHMCS Cloud avoids both. The documentation also leaves business decisions to you, such as termination days and tax rules.

The setup itself is well documented. Where I come in is the work around it, such as a WHMCS security audit of what you built or custom module development for what WHMCS does not ship.

Last reviewed 12 October 2026. Disclosure: I sell WHMCS and web development work, so I am not neutral. I am CTO at ElySpace, a freelance developer for Marmaids LLC, and founder of WHMCSPilot and MagizAI.