11 Common WHMCS Security Mistakes That Lead to Devastating Hacks

# 1. Create secure database with random name
mysql -u root -p
CREATE DATABASE wh_4k9j2m8x CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

# 2. Create dedicated user with limited privileges
CREATE USER 'wh_usr_9k2j4m'@'localhost' IDENTIFIED BY 'UltraSecure#Pass2024!@#';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX ON wh_4k9j2m8x.* TO 'wh_usr_9k2j4m'@'localhost';
FLUSH PRIVILEGES;

# 3. Update WHMCS configuration.php
$db_host = "127.0.0.1:3306";
$db_username = "wh_usr_9k2j4m";
$db_password = "UltraSecure#Pass2024!@#";
$db_name = "wh_4k9j2m8x";

# 4. Change table prefix (during installation)
$whmcs_db_prefix = "sys_";

# 5. Enable SSL connection
$whmcs_db_ssl = true;

#!/bin/bash
# Secure WHMCS File Permissions Script
# Save as: secure_whmcs_permissions.sh

WHMCS_DIR="/path/to/your/whmcs"
WEB_USER="www-data"  # Change to your web server user

echo "Securing WHMCS file permissions..."

# Set ownership
chown -R $WEB_USER:$WEB_USER $WHMCS_DIR

# Secure directory permissions
find $WHMCS_DIR -type d -exec chmod 755 {} \;

# Secure file permissions
find $WHMCS_DIR -type f -exec chmod 644 {} \;

# Extra secure configuration files
chmod 600 $WHMCS_DIR/configuration.php
chmod 600 $WHMCS_DIR/includes/dbconnect.php

# Secure templates_c (needs write access)
chmod 755 $WHMCS_DIR/templates_c
find $WHMCS_DIR/templates_c -type f -exec chmod 644 {} \;

# Secure downloads directory
chmod 755 $WHMCS_DIR/downloads
find $WHMCS_DIR/downloads -type f -exec chmod 644 {} \;

# Secure uploads directory (if exists)
if [ -d "$WHMCS_DIR/uploads" ]; then
    chmod 755 $WHMCS_DIR/uploads
    find $WHMCS_DIR/uploads -type f -exec chmod 644 {} \;
fi

# Secure attachments
if [ -d "$WHMCS_DIR/attachments" ]; then
    chmod 755 $WHMCS_DIR/attachments
    find $WHMCS_DIR/attachments -type f -exec chmod 644 {} \;
fi

# Remove execute permissions from specific files
find $WHMCS_DIR -name "*.txt" -exec chmod 644 {} \;
find $WHMCS_DIR -name "*.sql" -exec chmod 644 {} \;
find $WHMCS_DIR -name "*.log" -exec chmod 644 {} \;

# Protect sensitive directories
echo "Deny from all" > $WHMCS_DIR/includes/.htaccess
echo "Deny from all" > $WHMCS_DIR/templates_c/.htaccess

# Set immutable flag on critical files (optional)
chattr +i $WHMCS_DIR/configuration.php

echo "WHMCS permissions secured successfully!"
echo "Remember to test functionality after applying!"

# Verification commands
echo "Verification:"
ls -la $WHMCS_DIR/configuration.php
ls -la $WHMCS_DIR/includes/
find $WHMCS_DIR -perm 777 -ls

# Strong Password Generation Script
#!/bin/bash

generate_strong_password() {
    local length=${1:-32}
    openssl rand -base64 $length | tr -d "=+/" | cut -c1-$length
}

# Generate different passwords for each service
echo "=== WHMCS Security Password Set ==="
echo "Admin Password: $(generate_strong_password 24)"
echo "Database Password: $(generate_strong_password 32)"
echo "Encryption Key: $(generate_strong_password 64)"
echo "API Password: $(generate_strong_password 24)"
echo "License Key: $(generate_strong_password 16)"

# Create .my.cnf for secure MySQL access
cat > ~/.my.cnf << 'EOF'
[mysql]
user=wh_usr_9k2j4m
password=YOUR_GENERATED_DB_PASSWORD

[mysqldump]
user=wh_usr_9k2j4m
password=YOUR_GENERATED_DB_PASSWORD
EOF

chmod 600 ~/.my.cnf

# Password complexity checker for WHMCS
password_check() {
    local pass="$1"
    local score=0
    
    # Length check
    if [ ${#pass} -ge 16 ]; then score=$((score + 1)); fi
    
    # Character variety checks
    if [[ $pass =~ [a-z] ]]; then score=$((score + 1)); fi
    if [[ $pass =~ [A-Z] ]]; then score=$((score + 1)); fi
    if [[ $pass =~ [0-9] ]]; then score=$((score + 1)); fi
    if [[ $pass =~ [^a-zA-Z0-9] ]]; then score=$((score + 1)); fi
    
    if [ $score -ge 4 ]; then
        echo "Password strength: STRONG"
        return 0
    else
        echo "Password strength: WEAK (Score: $score/5)"
        return 1
    fi
}

# Example usage
# password_check "YourPasswordHere"

#!/bin/bash
# Secure WHMCS Backup Script with Encryption
# File: whmcs_secure_backup.sh

# Configuration
BACKUP_DIR="/secure/backups/whmcs"
WHMCS_DIR="/var/www/html/whmcs"
DB_NAME="wh_4k9j2m8x"
DB_USER="wh_usr_9k2j4m"
ENCRYPT_KEY="$(cat /root/.whmcs_backup_key)"  # Store key separately
RETENTION_DAYS=30

# Create secure backup directory
mkdir -p $BACKUP_DIR
chmod 700 $BACKUP_DIR

# Generate secure timestamp
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
RANDOM_ID=$(openssl rand -hex 8)
BACKUP_NAME="whmcs_backup_${TIMESTAMP}_${RANDOM_ID}"

echo "Starting secure WHMCS backup: $BACKUP_NAME"

# 1. Create encrypted database backup
mysqldump --single-transaction --routines --triggers \
          --databases $DB_NAME > "/tmp/${BACKUP_NAME}_db.sql"

# Encrypt database dump
gpg --cipher-algo AES256 --compress-algo 1 --s2k-mode 3 \
    --s2k-digest-algo SHA512 --s2k-count 65536 \
    --symmetric --output "$BACKUP_DIR/${BACKUP_NAME}_db.sql.gpg" \
    --batch --yes --quiet --passphrase "$ENCRYPT_KEY" \
    "/tmp/${BACKUP_NAME}_db.sql"

# Remove temporary file
rm "/tmp/${BACKUP_NAME}_db.sql"

# 2. Create encrypted file backup
tar -czf - -C "$WHMCS_DIR" . | \
gpg --cipher-algo AES256 --compress-algo 1 --s2k-mode 3 \
    --s2k-digest-algo SHA512 --s2k-count 65536 \
    --symmetric --output "$BACKUP_DIR/${BACKUP_NAME}_files.tar.gz.gpg" \
    --batch --yes --quiet --passphrase "$ENCRYPT_KEY"

# 3. Create backup manifest with checksums
cat > "$BACKUP_DIR/${BACKUP_NAME}_manifest.txt" << EOF
WHMCS Secure Backup Manifest
Created: $(date)
Backup ID: $BACKUP_NAME

Files:
$(ls -la "$BACKUP_DIR/${BACKUP_NAME}"*)

Checksums:
$(sha256sum "$BACKUP_DIR/${BACKUP_NAME}"*)

System Info:
WHMCS Version: $(grep "Version:" "$WHMCS_DIR/admin/templates/blend/header.tpl" | head -1)
Database Size: $(mysql -e "SELECT ROUND(SUM(data_length + index_length) / 1024 / 1024, 1) AS 'DB Size in MB' FROM information_schema.tables WHERE table_schema='$DB_NAME';" | tail -1)
File Count: $(find "$WHMCS_DIR" -type f | wc -l)
EOF

# Encrypt manifest
gpg --cipher-algo AES256 --symmetric \
    --output "$BACKUP_DIR/${BACKUP_NAME}_manifest.txt.gpg" \
    --batch --yes --quiet --passphrase "$ENCRYPT_KEY" \
    "$BACKUP_DIR/${BACKUP_NAME}_manifest.txt"

rm "$BACKUP_DIR/${BACKUP_NAME}_manifest.txt"

# 4. Set secure permissions
chmod 600 "$BACKUP_DIR/${BACKUP_NAME}"*

# 5. Upload to secure remote storage (example with rsync over SSH)
if [ -n "$REMOTE_BACKUP_SERVER" ]; then
    rsync -avz --chmod=600 \
          "$BACKUP_DIR/${BACKUP_NAME}"* \
          "$REMOTE_BACKUP_USER@$REMOTE_BACKUP_SERVER:/encrypted_backups/whmcs/"
fi

# 6. Clean up old backups
find "$BACKUP_DIR" -name "whmcs_backup_*" -mtime +$RETENTION_DAYS -delete

echo "Secure backup completed: $BACKUP_NAME"

# 7. Backup verification
echo "Verifying backup integrity..."
if gpg --batch --yes --quiet --passphrase "$ENCRYPT_KEY" \
       --decrypt "$BACKUP_DIR/${BACKUP_NAME}_db.sql.gpg" > /dev/null 2>&1; then
    echo "Database backup encryption: OK"
else
    echo "Database backup encryption: FAILED"
fi

if gpg --batch --yes --quiet --passphrase "$ENCRYPT_KEY" \
       --decrypt "$BACKUP_DIR/${BACKUP_NAME}_files.tar.gz.gpg" > /dev/null 2>&1; then
    echo "Files backup encryption: OK"
else
    echo "Files backup encryption: FAILED"
fi

#!/bin/bash
# WHMCS Security Update Monitor and Automation
# File: whmcs_security_updater.sh

WHMCS_DIR="/var/www/html/whmcs"
BACKUP_DIR="/secure/backups/pre-update"
LOG_FILE="/var/log/whmcs_updates.log"
NOTIFICATION_EMAIL="[email protected]"

log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

send_notification() {
    local subject="$1"
    local message="$2"
    
    echo "$message" | mail -s "$subject" "$NOTIFICATION_EMAIL"
}

check_whmcs_version() {
    if [ -f "$WHMCS_DIR/admin/templates/blend/header.tpl" ]; then
        CURRENT_VERSION=$(grep -oP 'Version:\s*\K[\d.]+' "$WHMCS_DIR/admin/templates/blend/header.tpl" | head -1)
        echo "$CURRENT_VERSION"
    else
        echo "unknown"
    fi
}

check_security_advisories() {
    # Check WHMCS security announcements
    LATEST_ADVISORY=$(curl -s "https://docs.whmcs.com/Security_Advisories" | \
                      grep -oP 'WHMCS-SA-\d{4}-\d{3}' | head -1)
    
    if [ -n "$LATEST_ADVISORY" ]; then
        log_message "Latest security advisory: $LATEST_ADVISORY"
        
        # Check if we've already processed this advisory
        if ! grep -q "$LATEST_ADVISORY" "$LOG_FILE" 2>/dev/null; then
            log_message "NEW SECURITY ADVISORY DETECTED: $LATEST_ADVISORY"
            
            send_notification "URGENT: New WHMCS Security Advisory" \
                "A new security advisory has been published: $LATEST_ADVISORY
                
                Please review: https://docs.whmcs.com/Security_Advisories
                
                Current WHMCS Version: $(check_whmcs_version)
                
                Update immediately if affected."
        fi
    fi
}

pre_update_backup() {
    log_message "Creating pre-update backup..."
    
    TIMESTAMP=$(date +%Y%m%d_%H%M%S)
    BACKUP_NAME="pre_update_${TIMESTAMP}"
    
    # Create backup directory
    mkdir -p "$BACKUP_DIR/$BACKUP_NAME"
    
    # Backup files
    tar -czf "$BACKUP_DIR/$BACKUP_NAME/whmcs_files.tar.gz" -C "$WHMCS_DIR" .
    
    # Backup database
    mysqldump --single-transaction wh_4k9j2m8x > "$BACKUP_DIR/$BACKUP_NAME/whmcs_db.sql"
    
    # Create rollback script
    cat > "$BACKUP_DIR/$BACKUP_NAME/rollback.sh" << 'EOF'
#!/bin/bash
# Automatic rollback script
WHMCS_DIR="/var/www/html/whmcs"
BACKUP_DIR="$(dirname "$0")"

echo "Rolling back WHMCS..."
rm -rf "$WHMCS_DIR"/*
tar -xzf "$BACKUP_DIR/whmcs_files.tar.gz" -C "$WHMCS_DIR"
mysql wh_4k9j2m8x < "$BACKUP_DIR/whmcs_db.sql"
echo "Rollback completed"
EOF
    
    chmod +x "$BACKUP_DIR/$BACKUP_NAME/rollback.sh"
    
    log_message "Pre-update backup completed: $BACKUP_NAME"
}

verify_update_integrity() {
    local update_file="$1"
    
    # Verify file integrity
    if [ ! -f "$update_file" ]; then
        log_message "ERROR: Update file not found: $update_file"
        return 1
    fi
    
    # Check file size (updates should be substantial)
    FILE_SIZE=$(stat -f%z "$update_file" 2>/dev/null || stat -c%s "$update_file")
    if [ "$FILE_SIZE" -lt 1000000 ]; then  # Less than 1MB
        log_message "WARNING: Update file seems too small: ${FILE_SIZE} bytes"
        return 1
    fi
    
    # Verify it's a valid zip file
    if ! unzip -t "$update_file" >/dev/null 2>&1; then
        log_message "ERROR: Update file appears corrupted"
        return 1
    fi
    
    return 0
}

apply_security_update() {
    local update_file="$1"
    
    log_message "Applying security update from: $update_file"
    
    # Create maintenance mode
    echo "Under maintenance for security update" > "$WHMCS_DIR/maintenance.html"
    
    # Set maintenance redirect in .htaccess
    cat >> "$WHMCS_DIR/.htaccess" << 'EOF'

# Maintenance mode for security update
RewriteCond %{REQUEST_URI} !^/maintenance\.html$
RewriteRule ^(.*)$ /maintenance.html [R=503,L]
EOF

    # Apply update
    cd "$WHMCS_DIR"
    if unzip -o "$update_file"; then
        log_message "Update files extracted successfully"
        
        # Run post-update tasks
        if [ -f "update.php" ]; then
            log_message "Running update script..."
            php update.php
        fi
        
        # Remove maintenance mode
        rm -f maintenance.html
        sed -i '/# Maintenance mode for security update/,+2d' .htaccess
        
        log_message "Security update completed successfully"
        
        send_notification "WHMCS Security Update Applied" \
            "Security update has been successfully applied.
            
            Version: $(check_whmcs_version)
            Time: $(date)
            
            Please verify system functionality."
        
    else
        log_message "ERROR: Failed to extract update files"
        
        # Remove maintenance mode on failure
        rm -f maintenance.html
        sed -i '/# Maintenance mode for security update/,+2d' .htaccess
        
        send_notification "WHMCS Update FAILED" \
            "Security update failed to apply. System remains in current state.
            
            Please investigate and apply update manually."
        
        return 1
    fi
}

# Main execution
log_message "Starting WHMCS security update check"

# Check current version
CURRENT_VERSION=$(check_whmcs_version)
log_message "Current WHMCS version: $CURRENT_VERSION"

# Check for security advisories
check_security_advisories

# Check for available updates (you would integrate with WHMCS update system)
# This is a placeholder - actual implementation depends on your update source
if [ -f "/tmp/whmcs_security_update.zip" ]; then
    if verify_update_integrity "/tmp/whmcs_security_update.zip"; then
        pre_update_backup
        apply_security_update "/tmp/whmcs_security_update.zip"
    fi
fi

log_message "Security update check completed"