WHMCS Affiliate System: Setup, Commissions, Payouts and Fraud Limits

The WHMCS affiliate system is built in. You switch it on in the Affiliates tab at Configuration > System Settings > General Settings, activate each affiliate from their client profile, and pay percentage or fixed commissions once or on every renewal. Referrals are tracked by a cookie from the affiliate link, and payouts are recorded in WHMCS but sent by you.

How do you enable the WHMCS affiliate system?

Configure the Affiliates tab, then activate the clients who will refer customers. Both steps are required; with the system disabled, nothing appears in the Client Area. These are the settings on the Affiliates tab:

To make a client an affiliate, open their profile's Summary tab and click Activate as Affiliate under Other Actions. Once the system is enabled, clients can also activate themselves from the Client Area. You manage everyone at Clients > Manage Affiliates.

How are WHMCS affiliate commissions set?

At three levels, and the most specific wins. The General Settings percentage is the default. A product can override it in the Other tab at Configuration > System Settings > Products/Services, through Custom Affiliate Payout (Percentage, Fixed Amount or No Commission), Affiliate Pay Amount and One Time Payout. An individual affiliate's settings at Clients > Manage Affiliates override everything else.

Commissions recur on every renewal by default. Tick One Time Payout to pay only on the first sale. One quirk from the Affiliate System page: No Commission on a product beats the default rate, but a One Time Payout setting on the client or the product overrides No Commission. Test any product you meant to exclude.

The documented example is a 10% one-time commission with a 30-day hold: set the product's Custom Affiliate Payout to Percentage, Affiliate Pay Amount to 10, tick One Time Payout, then set Affiliate Commission Delay to 30. The calculation rules are the part most owners never read:

The currency row deserves a check if you sell in several currencies: a fixed commission of 20 is 20 dollars to one affiliate and 20 euros to another.

How does WHMCS track affiliate referrals?

With a link and a cookie. Each affiliate gets a link such as https://www.example.com/aff.php?aff=001, found under Affiliates in their Client Area. A visitor who follows it is sent to the Domain set in the General tab of General Settings and gets a cookie. If they order a product while the cookie is present, the affiliate earns the commission. The Affiliate Links page lists the useful parameters:

• &gid=2 opens the order form for product group 2.
• &pid=2 opens the order form for product 2.
• &gocart=true goes straight to the cart, and &register=true to the registration form.

For banners, put [AffiliateLinkCode] where the link belongs in the Affiliate Links setting, and WHMCS shows affiliates a preview with the code. Self-hosted installs can also place {$referrallink} in the active template's affiliates.tpl.

The cookie lasts three months. The documented way to change that, on a self-hosted install, is to edit the last argument of this line in aff.php:

Cookie::set('AffiliateID', $aff, '3m');

Change '3m' to '1m' for one month, or to a timestamp such as time() + (14*24*60*60) for 14 days. Because aff.php ships with WHMCS, check the line after every update. When a referral was missed, assign it at Orders > List All Orders: open the order and click Manual Assign in the Affiliate section. If the order is already paid, follow up with Manual Payout on that affiliate's Referrals tab.

How do WHMCS affiliate payouts work?

WHMCS tracks the balances and opens a ticket, and you send the money. A commission first lands in the Pending Commissions Balance. When the delay ends, and only if the service is still Active, it moves to Available to Withdraw. Once that balance reaches the Affiliate Payout Amount, the affiliate can click Request Withdrawal, which opens a ticket in the Payout Request Department.

You pay by whatever method you agreed, then record it on the affiliate's Withdrawals History tab, which offers three payout types:

• Create Transaction to Client records an expenditure against the client. You still make the payment yourself.
• Add Amount to Credit Balance turns the payout into credit for future invoices.
• Record in Withdrawals Only logs the withdrawal without any transaction or credit.

The Managing Affiliates page also covers manual commission entries, which go straight into Available to Withdraw, and pending commissions you can delete. Deleting an affiliate keeps the client account but erases their referrals and commissions for good.

How do you limit affiliate fraud in WHMCS?

Hold commissions long enough for chargebacks and cancellations to surface, and let the Active-status rule remove the bad ones. The usual abuse is an affiliate ordering through a second client account, or referring orders paid with stolen cards that are refunded or disputed later. The documentation describes one built-in block: a client earns nothing through their own link.

• Commission delay. Set 30 or 60 days. A service canceled, suspended or terminated before then loses its commission.
• Refund reversals. A full refund reverses the commission automatically. A partial refund asks, and reverses all of it or none.
• Order screening. Turn on FraudLabs Pro or MaxMind at Configuration > System Settings > Fraud Protection, and set high-risk products to set up only after you accept the order.
• Payout rules. A sensible minimum payout, and credit balance rather than cash for new affiliates, limit what a fake account can take.

For one more layer, the AffiliateCommission hook runs as a commission is applied and accepts skipCommission in its return. This file holds back large commissions for review:

<?php
// includes/hooks/affiliate_commission_review.php
if (!defined('WHMCS')) {
    die('This file cannot be accessed directly');
}

add_hook('AffiliateCommission', 1, function ($vars) {
    $reviewAbove = 100.00;
    if ($vars['commissionAmount'] > $reviewAbove) {
        logActivity(sprintf(
            'Affiliate commission held for review: affiliate %d, service %d, amount %.2f',
            $vars['affiliateId'],
            $vars['serviceId'],
            $vars['commissionAmount']
        ));
        return ['skipCommission' => true];
    }
    return [];
});

If the referral checks out, add the amount as a manual commission entry. Remember that manual entries skip the delay. My WHMCS hooks guide covers where hook files go and how to test them.

What can the built-in WHMCS affiliate system not do?

It pays one level of commission on new products and their renewals, and it leaves the money transfer to you. Anything beyond that needs code:

• Automatic payouts. WHMCS records withdrawals; it does not send money.
• Commission on domains, addons and upgrades. These are excluded by design.
• Tiers and multi-level schemes. The documentation describes one rate per affiliate and product, with no volume tiers or second-level referrers.
• Coupon attribution. The documentation describes tracking by cookie and manual assignment only, not crediting an affiliate because a client typed their promotion code.
• Reporting outside WHMCS. The API has two affiliate actions, AffiliateActivate and GetAffiliates, so feeding referral data to a CRM or partner platform is API integration work.

The AffiliateCommission and AffiliateWithdrawalRequest hooks, the second of which can skip the payout ticket, cover small changes. A payout integration or tiered scheme is an addon, which is the kind of thing I build under WHMCS custom module development.

Last reviewed 12 October 2026. Disclosure: I sell WHMCS and web development work, so I am not neutral. I am CTO at ElySpace, a freelance developer for Marmaids LLC, and founder of WHMCSPilot and MagizAI. Settings, rules and hook names come from the WHMCS 9.0 documentation as I read it on that date.