# Shahid Malla > Shahid Malla is an AI agent and AI chat developer, a full-stack developer with server and DevOps experience, and a WHMCS developer. He builds AI agents and chatbots, SaaS products and web applications, business websites, CRM systems, workflow automation and custom WHMCS modules and integrations, mostly for companies in the United States, Canada, the United Kingdom, Europe and Australia. ## Services URL: https://shahidmalla.com/services I am Shahid Malla, a freelance developer. I build custom WHMCS modules and integrations, SaaS products, mobile apps, business websites, CRM systems, workflow automation, and AI chatbots and agents. Use this page to match your project to the right service and to see what I no longer take on. - Experience: 13+ years, 900+ projects - Reputation: Top Rated on Fiverr and Upwork, 580+ five-star reviews on Fiverr - Pricing: Fixed quote per scope, or $55-$65/hour - Languages: English, Hindi, Urdu and Kashmiri - Based in: Baramulla, India, working remotely worldwide ## Which service do you need? Find the row that describes your situation. Each page it points to states the scope, the process, what I need from you and what I will not do. Your situation | Where to go | What you will find | WHMCS cannot do something your business needs | WHMCS custom module development | Provisioning, gateway, addon and registrar modules, specced in writing and tested in staging. | WHMCS has to talk to another system | WHMCS integration and automation | CRM, alerts, accounting and control panels connected through the API and hooks. | You are moving WHMCS to a new server, host or version | WHMCS migration | A rehearsal, a planned cutover and a way back. | Your website should take orders in a conversation | AI website development (AI Mode sites) | A front door that asks, recommends and orders, with your pages still there for search. | You want support questions answered by an assistant | AI chatbot development or AI agent development | What each can do safely, what it costs to run and where a person must stay in the loop. | You want Claude, ChatGPT or your own agent to use your CRM, database or internal API safely | MCP server development | Read-only tools by default, per-user sign-in, confirmation for writes, audit logs and rate limits. | You want a big project built fast with AI agents, by someone who reviews every line | Hire Claude Code developer | How I build with Claude Code and Codex, what speeds up and what does not, and the guardrails. | Your app built with Lovable, Bolt, Replit, v0 or Cursor breaks, leaks data or will not deploy | Vibe-coded app rescue | A written audit, security and data fixes first, tests, then repair or a partial rebuild, handed back in accounts you own. | You have a product idea that needs logins, billing and an admin panel | SaaS development | How the first version is scoped, built and handed over. | You need a Laravel app, a Filament admin panel, an upgrade to a supported Laravel version or AI features in Laravel | Hire a Laravel developer | What I build in Laravel, how upgrades run one version at a time, and the AI SDK and MCP options. | Your customers should have an app on their phone | Mobile app development | Android and iOS from one codebase, the backend behind it and what the app stores require. | Your company needs a new website, store or booking site | Web design and development | How I choose the platform, what a build includes and case studies. | You run a tour company, travel agency or hotel and want online bookings | Tour and travel website development | Package pages, seasonal prices, deposits, online payment and WhatsApp inquiries. | Your travel business runs on spreadsheets and chat threads | Travel CRM development | Leads, itineraries, quotes, supplier rates, vouchers and payments in one system. | Your sales or delivery process does not fit an off-the-shelf CRM | Custom CRM development | When to build and when to buy, and what a first version contains. | You need a working CRM next week, not next quarter | Custom CRM in 7 days | What fits in 7 days, how it is tested and what the guarantee covers. | People copy data between tools by hand | Automation development | Which processes are worth automating and how failures are handled. | You run or are starting a hosting company | Web hosting expert or start a hosting business | Infrastructure decisions, reviews and the order of work for a launch. | You have a steady flow of work and want one developer on call | Monthly developer retainer | Tiers, prices, what is covered and how urgent work is handled. | ## What do you no longer sell? I no longer sell basic installations, control panel setup or one-off error fixes as services of their own. An AI assistant, the vendor's installer or a host's support desk handles those well today, and they cost less than a developer. If your whole need is "install this" or "this page shows an error", try one of those first. What remains is the work that still needs a person who has done it before: deciding what to build, writing custom code against systems with poor documentation, changing a live billing system without losing data, and being answerable for the result. The same routine steps are still done when they belong to a larger project, at no extra line on the quote. ## What do you not do at all? I do not work with nulled or pirated software, and I do not edit WHMCS core files. I do not build bots for bulk unsolicited messaging, scrapers that break a site's terms, or automation that moves money without a person approving it. Where a request falls outside the list above, I tell you on the call. ## How does a project start? It starts with a few lines about the problem, sent through the project form, and a free scoping call of about 30 minutes. A written quote follows within one business day: a fixed price for a defined scope, or an hourly estimate at $55 to $65 per hour. Work is done in a staging copy and not on your live system, with a progress update every day and two weeks of support after delivery. The terms are set out on how I work. ## Who is behind these services? One person. I am Shahid Malla, based in Baramulla, India, with 13+ years of client work and 900+ projects, including 200+ custom WHMCS modules. I am also CTO at ElySpace, a hosting company, a freelance developer for Marmaids LLC, and the founder of WHMCSPilot.com, which sells premium WHMCS modules and themes, and of MagizAI, an AI chatbot and live chat. Where one of those ties matters to a recommendation, the page says so. You can see the work in the portfolio and read more about me. Q: Which service should I start with if I am not sure? A: Start with whichever problem is costing you money or customers today. Describe it in a few lines through the project form, or book the free scoping call of about 30 minutes. I will tell you which page applies and whether I am the right person for it. If I am not, I say so on the call. Q: Do you only work with WHMCS? A: No. WHMCS is where I have done the most work, with 200+ custom modules, but the same skills carry over. I also build SaaS products, mobile apps for Android and iOS, complete business websites, custom CRM systems, workflow automation, and AI chatbots and agents. Each has its own page with scope, process and limits. Q: Do you still install WHMCS or fix small errors? A: Not as a separate service. A basic installation, a panel setup or a one-line PHP error is work that an AI assistant, the vendor's installer or your host's support desk now handles well, and you should not pay a developer's rate for it. I take the work that needs design decisions, custom code and someone accountable for the result. Installation and configuration are still included when they are part of a larger project, such as a hosting business launch or a migration. Q: Do you build complete websites? A: Yes. I design and build complete business websites, online stores and booking sites, and the web designer and developer page explains how. For businesses in Kashmir there is a separate local page, because I can meet in person there. Q: How do you price the work? A: Either a fixed quote for a written scope or $55 to $65 per hour. The free scoping call of about 30 minutes comes first, and the written quote follows within one business day. Work happens in a staging copy, and two weeks of support after delivery are included. The details are on how I work. Q: Do you use AI in your own work? A: Yes, and I say so. AI tools speed up drafting, test writing and code review, which is one reason small tasks no longer need a developer. What you pay me for is the part a tool does not own: deciding what to build, checking that it is correct against your live system, keeping it upgrade-safe and being answerable when something breaks. ## WHMCS Development Services URL: https://shahidmalla.com/whmcs WHMCS is a billing, client management and automation platform used by hosting companies and online service businesses. I am Shahid Malla, a freelance WHMCS developer. I build custom modules and integrations for it, move it between servers and versions, and audit its security, with every change kept in supported folders so it survives upgrades. - Experience: 13+ years; 200+ custom WHMCS modules built - Method: Work is built and tested in a staging copy before it touches your live system - Pricing: Fixed quote after a free scoping call, or $55-$65/hour - Handover: Written documentation and two weeks of post-delivery support ## What is WHMCS? WHMCS is a billing, client management and automation platform used by hosting companies and online service businesses to take orders, send invoices, collect payments, set up services and answer support tickets. It is a PHP and MySQL application that runs on your own server, with a client area for customers and an admin area for staff. The official documentation is at docs.whmcs.com, and my guide what WHMCS is and how it differs from cPanel covers the basics. I am a freelance WHMCS expert. I have worked on WHMCS for more than 13 years and have built more than 200 custom WHMCS modules. This page explains what separates WHMCS work from ordinary web development, how to pick a developer, and which of my services fits which problem. ## What does a WHMCS specialist do that a general PHP developer usually does not? A WHMCS specialist knows which changes WHMCS supports and which ones the next upgrade will erase. A good PHP developer can write the code. The usual failure is code placed where WHMCS does not expect it, or code that ignores how WHMCS processes payments and automation. Area | What a specialist handles | Supported folders | Custom code goes in modules/, includes/hooks/ and a custom template folder. Core files stay untouched, so an upgrade does not undo the work. | Hooks | A function registered with add_hook runs on events such as invoice creation, client registration or a client area page load, with no core change. | Module types | Provisioning, addon, payment gateway, registrar, fraud, widget and notification modules each have their own file layout and function names. | Gateway callbacks | An invoice is only paid when the callback says so. It must check the invoice and transaction, verify the signature and survive duplicate notifications. | Licensing | A WHMCS license is tied to the server's IP address and domain. Moves, IP changes and ionCube-encoded files all need to be planned around it. | Cron | Invoice generation, reminders, suspensions and terminations all run from one cron job. If it stops, billing stops quietly. | ## How do I choose a WHMCS developer? Choose a developer who can answer yes to the five checks below and will put the answers in writing before work starts. If you are ready to hire a WHMCS developer, that page covers how I scope, price and hand over the work. - Staging first. Will they build and test on a copy, with test gateway keys, before anything reaches live billing? - No core edits. Will all custom code sit in modules, hooks and template folders, so you can upgrade WHMCS later? - Version compatibility. Do they state which WHMCS and PHP versions the work was tested on, and what to retest after an upgrade? - Code ownership. Is it clear who owns the code, whether you receive the source, and whether any of it is encoded? - Documentation. Will you get written notes on what changed, where the files are and how to undo it? ## What do I do, and what do I not do? I build, move, secure and maintain WHMCS installations, always inside the structure WHMCS supports. ### What I do - Set up new installations and migrate existing ones between servers and versions. - Write custom modules, hooks, gateway integrations and API links, including a WHMCS live chat integration that knows which client is signed in. - Restyle the client area, order forms and email templates in a safe child or custom theme. - Review installations for security problems and fix what the review finds. ### What I do not do - Edit WHMCS core files. - Install or repair nulled, cracked or unlicensed WHMCS copies, modules or themes. - Write code that stores card numbers or card security codes. - Work directly on a live system before the same change has been proven in staging. ## Which WHMCS service should I start with? Start with the problem that costs you money today. If invoices or emails are failing right now, begin with the troubleshooting guide or a support plan. If you are unsure, the free scoping call exists to answer exactly that question. One disclosure. I am the founder of WHMCSPilot.com, which sells premium WHMCS modules and themes. If an existing module already does what you need, I will tell you so rather than quote a custom build, and I will say if the one I suggest is mine. Q: What is WHMCS used for? A: WHMCS handles the business side of selling online services. It takes orders, generates and emails invoices, collects payments through gateways, provisions accounts on servers, registers domains and runs a support desk. Hosting companies are its main users, but any business that bills customers on a schedule can run on it. Q: Why use a WHMCS specialist instead of any PHP developer? A: WHMCS has its own folder rules, hook system, module conventions and payment callback flow. A developer who ignores them often edits core files, and those edits vanish at the next upgrade. A specialist already knows the supported places for custom code and the failure points around billing and cron. Q: Can you work on a WHMCS installation someone else built? A: Yes. I start with a read-only audit of the version, PHP setup, modules, hooks and template changes, then tell you what is safe to keep and what should be rewritten. I work in a staging copy first, so the live system stays untouched while I learn how it was put together. Q: Do you edit WHMCS core files? A: No. Core edits are overwritten on upgrade and make support from WHMCS harder. I use hooks, modules, custom template folders and language overrides instead. If a requirement truly cannot be met without touching core, I tell you that plainly before quoting, and we pick another approach. Q: Which WHMCS service should I start with? A: Start with whatever is costing you money now. A requirement WHMCS cannot meet needs a custom module. A second system that must stay in step with billing needs an integration. A slow, aging server needs a migration. I no longer sell basic installation or one-off error fixes on their own, because an AI assistant or your host's support handles those. If you are unsure, book the free scoping call and I will tell you the order that makes sense. Q: How do you price WHMCS work? A: I quote a fixed price after the scoping call, or work hourly at $55 to $65 per hour if the scope is open-ended. The quote lists what is included. I do not add charges for work outside it without your written agreement. ## Hire WHMCS Developer: Scope, Safety and Proof URL: https://shahidmalla.com/hire-whmcs-developer I am Shahid Malla, a freelance WHMCS developer you can hire for custom modules, hooks, payment gateway work, migrations and fixes. This page shows how a developer differs from an admin or a general PHP freelancer, how I keep changes upgrade-safe, what I need before quoting, and where you can verify my record. - Experience: 13+ years, 900+ projects, 200+ custom WHMCS modules - Engagement: Fixed quote per scope, or $55-$65/hour - Before you commit: Free scoping call of about 30 minutes; written quote within one business day - Where to verify: Top Rated on Fiverr and Upwork; 580+ five-star Fiverr reviews - After delivery: Two weeks of support, then optional ongoing care ## What does a WHMCS developer do that other freelancers do not? A WHMCS developer writes and repairs the code around WHMCS, such as modules, hooks, payment integrations and API connections, without breaking billing or the next upgrade. Four other roles are often mistaken for it. Role | Usually good at | Where it goes wrong on WHMCS | WHMCS admin | Running the system: products, invoices, tickets, settings. | A need that no setting covers stops there; someone has to write code. | General PHP freelancer | Clean PHP for any website. | Edits core files or writes straight to WHMCS tables, because nobody showed them where WHMCS expects custom code. | Web designer | Layout, color and typography. | Edits the default theme in place, so the next update overwrites it, and may not test an order through to payment. | Server administrator | PHP, the control panel and a healthy machine. | Keeps the platform running; billing logic and gateway callbacks are usually outside the job. | A WHMCS developer sits across these. The work follows the billing chain from order to invoice, payment callback, renewal and suspension, and stays in folders WHMCS leaves alone during an upgrade. Buyers also search for a WHMCS expert or consultant. The title matters less than whether the person writes and ships code. ## Do I need to hire a WHMCS developer, or just get a quick fix? You need a developer when something must be built that WHMCS settings cannot do. You need only a quick fix when an installation that worked has stopped working. - Quick fix: a blank page, a stopped cron, an invalid license message, emails not sending or a failing gateway callback. Start with the WHMCS troubleshooting guide; an AI assistant or your host's support desk can usually take it from there, and it is not work I sell on its own. - Settings, no developer: email template wording, products and configurable options, promotions and automation days. Your admin can change these in the admin area. - Developer job: provisioning on a platform WHMCS has no module for, a new payment method, a CRM sync, a changed order flow, a custom admin page, or a move with many custom modules. If you cannot tell which one you have, describe the symptom on the call. If the answer is a setting you can change yourself, I will say so. ## How do you keep WHMCS changes safe through upgrades? I put custom code in places WHMCS does not overwrite, prove it on a staging copy first, and never edit core files. WHMCS describes these extension points at developers.whmcs.com. This table shows where each kind of job goes. Job | Where it goes | Why it survives an upgrade | React to an event, such as an invoice paid or a ticket opened | A file in includes/hooks/ using add_hook | Upgrades replace core files and leave this folder alone. | New admin pages, settings or database tables | An addon module in modules/addons/ | The module is self-contained and creates its own tables. | Create, suspend or terminate a service on another platform | A provisioning module in modules/servers/ | WHMCS calls it at fixed lifecycle moments. | New payment method with a callback | A gateway module in modules/gateways/ | The callback checks the invoice and transaction before marking it paid. | Change the look of the client area or order form | A custom client-area theme in templates//, and a custom order form in templates/orderforms// | The default theme is never edited, so updates do not erase the work. | Change built-in wording | A language override file | The shipped language files stay untouched. | Read or change WHMCS data from my own code | The local API, for example localAPI('GetClients') | The API runs WHMCS's own validation and hooks; a direct UPDATE on a core table skips both. | Staging means a restored copy of your files and database with test gateway keys, so a failed attempt does not touch live billing. Upgrade-safe is not upgrade-proof: a new WHMCS or PHP release can still deprecate a function a module calls, so I record the versions I tested on. Encoded (ionCube) files cannot be edited by anyone except their vendor. If a vendor module needs a change, I ask the vendor, wrap it with a hook, or rebuild the behavior from a spec. ## How does hiring work, and what does it cost? You pay a fixed quote for a defined scope, or $55 to $65 per hour when the size is unknown until someone looks. A free scoping call of about 30 minutes comes first, and a written quote follows within one business day. Two weeks of support follow delivery, and scheduled upgrades after that fall under WHMCS support and maintenance. The stage-by-stage process is on how I work, and what a WHMCS developer costs compares my rate with publicly listed ones. ## What do you need from me before you can quote? I need enough detail to see the size of the job. Rough notes are fine, and we cover the rest on the call. This list gets you the most accurate quote. - The outcome in one sentence, for example "create a VPS automatically when an order is paid". - Your WHMCS and PHP versions. - Every addon module, hook and theme installed, who wrote it, and which of them are encoded. - The payment gateways, registrars and server panels (cPanel/WHM or others) involved. - Documentation and a sandbox for any outside API the job must call. - A staging copy, or permission for me to build one from a backup. - Your deadline, and how firm it is. - Confirmation that your WHMCS license and paid modules are legitimate. ## How can I verify your record before hiring you? Check it where it is public, instead of taking my word for it. I have 13+ years of experience, 900+ projects and 200+ custom WHMCS modules. I am Top Rated on Fiverr and Upwork, with 580+ five-star reviews on Fiverr. The reviews and portfolio pages show the record and the kind of work, and my Fiverr profile and Upwork profile carry the platforms' own numbers and reviews. I work with clients worldwide from Baramulla, Jammu and Kashmir, India, and arrange overlap hours when a project needs live calls. Disclosure: I am also CTO of the hosting company ElySpace and a freelance developer for Marmaids LLC, and I previously held roles at Fada.cloud and Nuco.cloud. I founded WHMCSPilot.com, a seller of premium WHMCS modules and themes, and MagizAI, an AI chatbot and live chat. If a ready-made module would solve your problem for less than a custom build, I will say so, tell you whether it is mine and name alternatives. You never need to use any of these businesses to hire me. ## What five questions should I ask any WHMCS developer, including you? Ask these five, and expect specific answers in writing. - Where will the code live, and will any core file be edited? - Where will you build and test it, and what is the way back if live billing misbehaves? - What does your quote assume about my WHMCS version, PHP version, gateways and installed modules? - Who owns the code, and do I receive readable source or encoded files? - What happens when something breaks after delivery, and for how long is it covered? The longer version, with red flags and a comparison of platform and direct hiring, is in how to hire a WHMCS developer. ## What will you not do? I will not take on work that puts your billing or your license at risk. These limits apply to every job. - I do not work on WHMCS installations or modules that are nulled, cracked or unlicensed, and I do not bypass the license check. - I do not edit WHMCS core files. - I do not edit another vendor's encoded files, because I cannot read them. - I do not change a live system without a current backup, and anything that touches billing is proven on a staging copy first. - I do not promise results beyond the agreed scope, such as sales or rankings, or a delivery date I have not checked against your system. Q: How much does it cost to hire a WHMCS developer? A: I charge $55 to $65 per hour, or a fixed quote for a defined scope. A price list would mislead, since jobs with similar names vary a lot in effort. After a free scoping call you get a written quote within one business day. When you compare quotes, compare what each one includes, not only the total. Q: How long does a WHMCS job take? A: It depends on scope. A custom module typically takes 3 to 15 working days. A server migration typically takes 2 to 5 working days, longer with many custom modules. I give you a date only after I have seen your system and the spec is agreed, never before. Q: Should I ask for a fixed price or hourly work? A: Ask for a fixed price when you can describe the finished result, such as a gateway integration or a provisioning module. Ask for hourly work when nobody can size the job until they look inside, such as tracking down an intermittent fault. I will tell you which I think fits and put the reason in the quote. Q: Can you fix something another freelancer or agency built? A: Yes, if I can read the code. I audit it first for core edits, direct writes to WHMCS tables and functions removed in newer PHP versions, then tell you what to keep and what to rewrite. If the files are encoded and the author is unreachable, I cannot edit them, but I can often rebuild the behavior from a spec. Q: Do you sign an NDA? A: Raise it on the scoping call, before any access is shared, and we will talk it through. Whatever is agreed, I ask for temporary access limited to what the job needs, I build in a staging copy first, and you can revoke my access the day the project ends. Q: Who owns the code you write for me? A: Ownership of custom code is written into the quote before work starts, so there is no guessing later. WHMCS itself, open-source libraries and premium modules you license from others stay under their own licenses. You also receive written notes listing every file and setting I added or changed. Q: What happens after the job is delivered? A: For two weeks I fix problems in the work I delivered. Send the steps to reproduce the issue and a screenshot. New features and unrelated faults are quoted separately. If you want scheduled upgrades and monitoring after that, ongoing support is available hourly or as a monthly arrangement. ## WHMCS Custom Module Development URL: https://shahidmalla.com/whmcs-custom-module-development I am Shahid Malla, a freelance WHMCS developer. I build custom WHMCS modules for hosting companies and service businesses: provisioning, addon, payment gateway, registrar, fraud, widget and notification modules. Each is specced in writing, tested in a staging copy, kept in supported folders so it survives upgrades, and handed over with documentation. - Track record: 200+ custom WHMCS modules built - Typical timeline: Typically 3 to 15 working days, depending on scope - Pricing: Fixed quote after a free scoping call, or $55-$65/hour - Source code: You receive readable source; encoding is optional - Support: Two weeks of post-delivery support included ## What types of WHMCS module can be built? I build seven kinds of WHMCS module, and each one lives in its own folder with its own function naming. Choosing the right type decides how much of WHMCS's built-in behavior you get for free. Type | Folder | What it does | Provisioning (server) | modules/servers// | Creates, suspends, unsuspends, upgrades and terminates a service when an order or invoice event happens. | Addon | modules/addons// | Adds its own admin pages, client area pages and database tables. | Payment gateway | modules/gateways/ | Takes payment and records it against an invoice. See payment gateway integration. | Registrar | modules/registrars// | Registers, renews and transfers domains and syncs their status. | Fraud | modules/fraud// | Scores new orders and holds risky ones for review. | Widget | modules/widgets/ | Adds a panel to the admin dashboard. | Notification provider | modules/notifications// | Sends WHMCS events to a chat or messaging service. | ## Do I need a module, or is a hook enough? A hook is enough when you only need to react to something WHMCS already does. A module is needed when WHMCS must call your code as part of a service lifecycle, or when you need your own settings, screens or tables. A hook fits jobs like "when a ticket opens, post to Slack", "when an invoice is paid, tag the client in the CRM" or "change what the client area home page shows". Hooks live in includes/hooks/, so there is nothing to install or activate. A module fits jobs like "when this order is paid, create an account on our platform", "give staff a page to manage license keys" or "add a new payment method". If you are unsure, tell me the outcome you want and I will tell you which shape is smaller. A module can also carry its own hooks, which is how many addons are built. ## Which functions does a provisioning module need? A provisioning module is a PHP file named after the module, with functions that all start with that name. WHMCS calls them at fixed moments, and you return the word success or an error message. - modulename_MetaData() returns the display name and the API version the module targets. - modulename_ConfigOptions() defines the settings shown on the product's module tab, such as plan or location. - modulename_CreateAccount($params) runs when a service is activated. The $params array carries the service, the client, the server and the product settings. - modulename_SuspendAccount, _UnsuspendAccount and _TerminateAccount handle overdue, paid and canceled services. - modulename_ChangePackage handles upgrades and downgrades. - modulename_ClientArea returns a template and variables for a service page the customer sees. I wrap every outside request with logModuleCall(), so each request and response appears in the WHMCS Module Log whenever module logging is switched on. When a customer says "my server was never created", that log is where the answer is. ## How do addon modules differ? An addon module is a self-contained feature with its own screens and data, defined by a different set of functions. The module folder name is the prefix again. - modulename_config() returns the name, description, version, author and any settings fields. - modulename_activate() runs once on activation. It is where tables are created, and it returns a status array so WHMCS can show success or the reason for failure. - modulename_output($vars) draws the admin page. - modulename_clientarea($vars) returns the page a logged-in client sees, including its title and template. Addons can also define deactivate and upgrade functions, which matter when you later change the table structure of a module that is already in use. ## How does a module store data and call WHMCS? I use the Capsule database layer for storage and localAPI for actions. Both are supported WHMCS interfaces, so they are much less likely to break when internals change than raw SQL is. Capsule is WHMCS's database access layer (WHMCS\Database\Capsule). With it I create module tables, usually prefixed mod_, and query them without raw SQL strings, which lowers the risk of SQL injection. When a module needs WHMCS to do something, such as add a payment, update a client or open a ticket, I call the matching command through localAPI rather than writing to WHMCS's own tables. The API runs validation and fires the hooks other code depends on. A direct UPDATE on a core table skips that validation and those hooks, and that is how invoices and balances drift out of step. ## Where does custom code go so upgrades do not remove it? Custom code goes in the module folders, in includes/hooks/, in a custom template folder and in language overrides. A WHMCS upgrade replaces core files and leaves those locations alone. Anything I change outside them is a core edit, and I do not make core edits. Upgrade-safe does not mean upgrade-proof. A new WHMCS or PHP release can remove or change a function a module relies on. That is why I record the versions each module was tested on, and why a support plan usually includes a retest after each upgrade. ## How do I spec, build, test and document a module? I follow the same five steps every time, because most module bugs come from a missing decision, not from a missing line of code. - Spec. A written list of triggers, expected results, settings, screens, outside API calls and error behavior. You approve it before I code. - Build in staging. Code goes into a copy of your WHMCS, never straight into production. - Test. Order, pay, upgrade, suspend, unsuspend and terminate on test services, then repeat with failures: bad credentials, a slow API and a duplicate request. - Document. Install steps, every setting, every function, the database tables and how to remove the module cleanly. - Hand over. I deploy on your approval and stay available for two weeks. ## Do I receive the source code, and can it be encoded? You receive the readable source code, and who holds the rights to it is written into the quote before work starts. If you plan to sell the module to others, I can quote ionCube encoding as a separate, optional step. WHMCS itself needs the ionCube Loader, so buyers' servers normally have it already. Encoding is a one-way step, so I keep the unencoded source with you and tell you before it is applied. ## Which module requests do I turn down? I will not edit WHMCS core files, and I will not build modules that switch off or bypass the WHMCS license check. I do not modify other developers' encoded modules, because I cannot read them. I cannot integrate with a service that has no API documentation and no test environment, since guessing at a live billing API puts your money at risk. I do not write modules that store card numbers. A module also does not replace support: after the two included weeks, ongoing fixes are quoted separately. ## What does a custom module cost? Cost follows scope, so I quote a fixed price after the scoping call. The main drivers are the module type, the number of outside API calls and the number of screens. Related work is covered in API integration and automation for hook-only jobs, and the WHMCS services overview lists everything else I do. Q: How much does a custom WHMCS module cost? A: I quote a fixed price after a free scoping call of about 30 minutes, or work hourly at $55 to $65 per hour. The price depends on the module type, how many outside API calls it makes and how many admin and client area screens it needs. The quote arrives within one business day and lists what is included. Q: How long does a module take to build? A: Typically three to fifteen working days, depending on scope. A small provisioning module for a well documented API sits at the short end. A module with its own admin screens, client area pages and several third-party integrations sits at the long end. I give you a date after the spec is agreed. Q: Can you build hourly billing for WHMCS? A: Yes. WHMCS has no hourly billing cycle, so per-hour plans such as cloud VPS need a custom module, and I have built hourly billing for many WHMCS products. A standard hourly billing module, with one provisioning platform, prepaid credit or monthly usage invoices, low-balance emails and automatic suspension, is ready in 7 calendar days from a signed scope, tested on a staging copy of your WHMCS. My WHMCS hourly billing guide explains the options and how the module works. Q: Can you fix or update a module someone else wrote? A: Yes, if I can read the source. I check it for core edits, direct SQL against WHMCS tables and functions removed in newer versions, then fix or rewrite it. If the code is encoded and the author is gone, I cannot edit it, but I can often rebuild the same behavior from a spec. Q: Will the module break when I upgrade WHMCS? A: It should not break from the upgrade overwriting files, because modules live outside the core files. Compatibility is a separate question: a new WHMCS or PHP release can deprecate a function a module uses. I state the versions I tested on, and a support plan covers retesting after each upgrade. Q: Can I resell a module you build for me? A: Yes, if we agree that in the quote before work starts. I can add a license check you control and quote ionCube encoding as a separate step, so buyers cannot copy or edit the source. If you do not plan to resell, you simply receive readable source code. Q: Do you need access to my live WHMCS? A: No. I ask for a staging copy: a backup of the files and database restored on a test server, or a subdomain you set up. For a provisioning module I also need sandbox or test credentials for the service it controls. I deploy to production only when you approve. ## WHMCS Migration Service URL: https://shahidmalla.com/whmcs-migration I migrate WHMCS between servers, hosts and versions. The database, files, license, cron jobs, payment gateways and server connections are rebuilt and tested on the new machine before DNS changes, so your billing keeps running until a short, planned cutover. - Typical timeline: 2 to 5 working days, longer with many custom modules - Downtime: A short, planned cutover window; billing stays live until then - Pricing: Fixed quote after a free scoping call, or $55-$65/hour - Works with: cPanel/WHM, VPS and dedicated servers ## What a WHMCS migration includes A WHMCS migration is the move of a live billing system to a new server, hosting account or version without losing client data, invoices or recurring billing. The database is only part of it. Most failed moves go wrong in the details around the database. Part | What I check or move | Database | A consistent dump with mysqldump --single-transaction, restored and checked for table count, row counts and character set. | Files | The WHMCS directory, custom modules, hooks, client area templates, attachments, downloads and the writable templates_c folder. | configuration.php | Database credentials and the $cc_encryption_hash. Losing that hash makes stored payment data and encrypted fields unreadable. | License | Reissued for the new IP and domain, then confirmed with a license check from the admin area. | Cron | The WHMCS cron job recreated with the right PHP binary path and run frequency, then watched through one full daily run. | Integrations | Payment gateways, domain registrars, fraud tools, WHM/cPanel servers, email piping and any third-party API that whitelists by IP. | ## What usually breaks after a WHMCS move These are the problems I see most often on migrations I am asked to repair. Each one has a cheap fix if it is found before cutover and an expensive one after it. Symptom | Usual cause | How I prevent it | Blank page or error 500 | Missing ionCube Loader, wrong PHP version, or a missing PHP extension | I compare the new server against WHMCS system requirements before copying anything. | "Invalid license" message | License still bound to the old IP address | I plan the reissue for cutover time and run the license check on the new server as soon as it is done. | Invoices stop generating | Cron missing, wrong PHP path, or cron user lacks permissions | I create the cron job, run it by hand and read the activity log. | Servers show as unreachable | The cPanel/WHM server firewall does not allow the new WHMCS IP | I add the new IP to the allow list and re-test every server module. | Gateway callbacks fail | Webhook URL, SSL certificate or an IP restriction changed | I run a small live payment and check the callback reaches WHMCS. | Emails land in spam | New server IP has no SPF, DKIM or reverse DNS | I set those records and send test messages to the major mailbox providers. | If you plan to do the move yourself, my low-downtime WHMCS migration runbook lists every step in order, including the checks above. ## Should I move and upgrade WHMCS together? No, not if you can avoid it. Moving to a new server on the same WHMCS version changes one variable. Upgrading changes many, including database schema, templates and module compatibility. Doing both at once makes failures hard to trace. I move first, confirm the new server is stable for a few days, then upgrade as its own step. The exception is when the old server cannot run a PHP version the new WHMCS release needs. In that case I plan two linked stages inside one project. ## Moving to WHMCS from another billing platform Switching platforms is a data-mapping job rather than a file copy. I export clients, products, services, domains and open invoices from the old system and import them through the WHMCS API or SQL, preserving client IDs where the source allows it. Then I compare client counts, active services and outstanding balances line by line against the old system. Anything that does not match is fixed before you go live. Payment tokens stored by a previous system rarely transfer, so clients may need to re-enter card details. I tell you that up front. ## What I need from you - Admin access to the current WHMCS and SSH or root access to the old and new servers. - A list of installed addons and custom modules, and who built them if you know. - A quiet period for the cutover, ideally outside your ticket peak. - Access to DNS, so the TTL can be lowered and the switch made on time. ## What I will not do I do not move or install nulled, cracked or unlicensed WHMCS copies, and I will not edit WHMCS core files, because those edits disappear on upgrade. Customizations go in the supported hooks, modules and template folders. I also do not delete your old server. It stays as a fallback until you say otherwise. ## Cost and timing Every installation is different, so I quote a fixed price after a short scoping call, or work hourly at $55 to $65 per hour if you prefer. The main cost drivers are the number of custom modules, the number of integrations that need re-testing, and whether a version upgrade or a platform switch is included. For related work, see WHMCS development, server migration and backup and the WHMCS security audit. Q: How long does a WHMCS migration take? A: A standard server-to-server move with no custom modules usually takes two to three working days, including testing. Installations with many custom modules, several payment gateways or a version upgrade take three to five days or more. I give you a date after the audit, not before. Q: Will my clients notice any downtime? A: Only during the cutover window, normally a few minutes, planned for your quietest hours. Until then the old installation keeps taking orders and payments. I lower your DNS TTL a few days ahead so the switch propagates quickly. Q: Do I need a new WHMCS license when I change servers? A: A WHMCS license is tied to the server IP address and domain, so it must be reissued for the new server. If you bought the license from WHMCS, you reissue it from your WHMCS account, or I do it with you as part of the move, and no new purchase is needed. If the license came from your current hosting provider and you are leaving that provider, it stays with them and you need a new license key for the new server. Q: Should I upgrade WHMCS at the same time as moving it? A: Usually not. I move first on the same version, confirm everything works, and upgrade afterwards. If something breaks, you then know whether the server or the upgrade caused it. If your PHP version forces the upgrade, I plan it as two separate steps in one project. Q: Can you migrate me to WHMCS from another billing system? A: Yes. I import clients, products, services and open invoices from Blesta, ClientExec, HostBill or a CSV export, then check balances and renewal dates against the old system. Historical invoices and tickets are a separate scoping question, so ask me early. Q: What access do you need? A: SSH or root access to both servers, the WHMCS admin login, and the registrar and gateway accounts only if their IP restrictions need updating. I work in a staging copy first, not on your production system. ## Web Hosting Expert and Hosting Infrastructure Consultant URL: https://shahidmalla.com/web-hosting-expert I am Shahid Malla, a web hosting expert and hosting infrastructure consultant for owners, resellers, agencies and SaaS teams who run or are starting a hosting business. I review, build, rescue or advise on Linux servers, cPanel and WHM, WHMCS billing, mail delivery and backups, and you receive the decisions and the reasons in writing. - Ways to work: Review, build, rescue or ongoing advice - Core platforms: Linux, cPanel and WHM, WHMCS - Scoping call: Free, about 30 minutes; quote within one business day - Pricing: Fixed quote per scope, or $55-$65/hour - Not offered: Selling hosting or acting as a managed-hosting provider; I work on servers you own ## What does a web hosting expert decide for a hosting business? A web hosting expert makes the infrastructure decisions underneath your brand: the hosting model, how billing, panel and DNS connect, how mail reaches inboxes, and what happens the day something fails. The table gives the options and what I check before recommending one. Decision | The options | What I check before recommending | Hosting model | Reseller plan, VPS or dedicated server. Plain shared hosting suits your own site, not selling accounts. | Expected account count, how much server work you can carry, and how the upstream provider handles support and abuse. See starting a hosting business. | Control panel | cPanel and WHM, another panel, or none. | Whether customers need self-service, supported operating systems, a license bound to the server IP, and a maintained billing module. | Billing and provisioning | WHMCS linked to the panel, another billing tool, or hand-made accounts. | Matching package names on both sides, a working cron job, gateways for your countries and suspension rules for unpaid invoices. See my WHMCS work. | DNS and mail | Your own nameservers or external DNS; mail on the server or a separate service. | PTR record matching the hostname, SPF, DKIM and DMARC records, and the IP's blocklist history. | Backups | Provider snapshots, panel backups, an encrypted off-site copy. | Where each copy lives, whether the server can delete it, and a timed restore onto a scratch server. See migration and backup. | Abuse and spam | Hourly mail limits, outbound alerts, a written suspension process. | Exim queue size, whether anyone reads the abuse mailbox, and whether your acceptable use policy is enforceable. | Security | Firewall, SSH keys, patch schedule, per-account PHP isolation. | Ports visible from outside, whether WHM port 2087 is open to everyone, and how updates run. See server hardening. | Monitoring | A hosted uptime check, a self-hosted stack, or both. | Alerts leave by a channel that survives a server failure and reach a named person. | Capacity and cost | One larger server or several smaller ones; when to add another. | CPU, memory, disk and inode use per account, and the cost of one account in license share, support time and gateway fees. | ## What are the ways to hire a hosting infrastructure consultant? You can hire me in four ways: an infrastructure review, a new build, a rescue or ongoing advice. A review is a sensible first step, because it turns a vague worry into a ranked list. Way | It fits when | What you receive | Infrastructure review | Nobody has audited the servers, or you are buying or inheriting a setup. | A written report: what exists, what is wrong ranked by effect, what to fix first and what I could not check. I change nothing. | New build | You are launching a hosting company or adding a server. | A working setup on your chosen stack, built in staging, tested with orders, mail and a restore. | Rescue | Mail is blocklisted, servers are full or slow, a move went wrong or an intruder got in. | Containment, then the cause, then repairs in small steps with a rollback note each. If root was reached, I advise a rebuild. | Ongoing advice | The setup works and you want a second opinion on changes, capacity and incidents. | Recurring tasks listed in writing, quoted per scope or billed hourly. Alerts go to people you name. | ## What does a cPanel and WHM server setup include? A cPanel server setup for a hosting business is more than installing the panel: it is the server, mail, security and billing work that has to be right before the first customer signs up. cPanel's system requirements list AlmaLinux, CloudLinux, Rocky Linux and Ubuntu as supported operating systems, each with its own minimums. - Server and license: a supported operating system, the server hostname and its DNS, and the cPanel license. - Web stack: the EasyApache 4 PHP versions and handlers your customers need, kept on automatic updates. - Mail: SPF, DKIM and DMARC for the server and customer domains, so mail does not land in spam (see cPanel email going to spam). - Security: firewall, SSH keys, brute-force protection and server hardening. - Backups: off-server backups with a tested restore, as in server migration and backup setup. - Billing: the server connected to WHMCS, so orders create, suspend and terminate accounts on their own. - Handover: a written record of every setting and login, owned by you. I take on cPanel setup as part of launching or rebuilding a hosting platform, not as a one-off install. If you only need the panel installed on a single server, your server provider or cPanel's own installer is the cheaper route. ## Why does mail from a hosting server go to spam? Mail goes to spam when receiving servers cannot confirm who sent it, so I check reverse DNS, SPF, DKIM and DMARC first. Three commands show most of it. dig +short -x 203.0.113.10 dig +short TXT example.com dig +short TXT _dmarc.example.com The first should return the server's hostname, matching the name it announces to other mail servers. The second should show one SPF record listing your real senders. The third shows the DMARC policy. A policy of none only reports, so move to quarantine once the reports show your legitimate senders passing. DKIM sits at selector._domainkey.example.com. Reputation is shared. One hijacked mailbox can blocklist the IP and hurt every customer on it. So I read the queue with exim -bp | exiqsumm, which groups waiting mail by domain, check the hourly send limit in WHM Tweak Settings and ask who reads the abuse mailbox. The full diagnosis order, with the commands, is in cPanel email going to spam: how to find and fix the cause. ## Which hosting platforms are my core, and which are not? My core is Linux servers, cPanel and WHM, and WHMCS. Other panels and Windows hosting are not my core work, and I will tell you so before you commit. If you run Plesk, DirectAdmin or Windows servers with IIS, ASP.NET or MSSQL, I will say so on the scoping call. I may still help with parts that do not depend on the panel, such as DNS, mail records, backup design and billing, and I will say where that stops. I make no claim to every web server, caching layer or security product sold to hosts. Ask about one by name and I will answer from what I have run. On a cPanel server my review includes WHM Tweak Settings, which cPanel stores in /var/cpanel/cpanel.config. ## Do I have a stake in the providers and products I mention? Yes. I hold roles at several companies in this market, so weigh my recommendations with that in mind. - I am CTO at ElySpace, a hosting company. - I previously worked as Technical Lead at Fada.cloud and as a backend developer for Nuco.cloud. - I founded MagizAI, an AI chatbot and live chat with a free WHMCS module. - I founded WHMCSPilot.com, which sells premium WHMCS modules and themes. I also earn my living from WHMCS and cPanel work, so I am not neutral on billing software or panels either. I do not sell hosting through this site, and this page recommends no provider. When a report of mine names a provider or product I have a stake in, it says so next to the name. ## What should I ask a hosting consultant before hiring one? Ask for evidence of work done and for limits stated, not for a list of tools. Put these questions to me too. - Which panels and operating systems have you run in production? A straight answer names a few and admits the rest. - Can I see a restore procedure you wrote? It should say how long the restore took. "Backups enabled" proves nothing. - Do you or your employer sell what you recommend? You are owed the answer before the advice. - What will you not do? A consultant with no limits is guessing somewhere. - Who has access, and how is it removed? Expect named accounts or keys, revoked at the end. - What do you promise about uptime or speed? Anyone naming a number before measuring your server is guessing. ## How much does it cost, and what do I need to provide? I quote a fixed price per scope after a free scoping call of about 30 minutes, or I bill $55 to $65 per hour. Cost follows the number of servers, the state of their documentation and whether a migration is in scope. To start I need: - Your servers, where they run, and the panel and billing system in use. - Access you can revoke: SSH, WHM, DNS and the WHMCS admin area. - A short description of what hurts today and who depends on the servers. - One person who can approve changes. ## What will I not do as your hosting expert? I do not sell hosting or act as a managed-hosting provider. I advise, build and maintain on servers that you own or rent. I also do not do hardware work such as racking or drive swaps, promise uptime figures or speed-ups, install unlicensed software, or give legal or tax advice. I am a freelancer, not a staffed operations center, so alerts go to the people you name. Q: What does a web hosting consultant do? A: A hosting consultant decides and checks the technical foundations of a hosting business: server model, control panel, billing connection, DNS and mail, backups, abuse handling, monitoring, security and capacity. Some consultants only advise. I advise and also build or repair the setup, then document it, so you are not left with a report and no way to act on it. Q: Do I need a hosting consultant to start a hosting company? A: No, but a few early decisions are costly to reverse: the hosting model, the panel, how mail is set up and where backups live. A single review before launch is usually enough for those. You can run a small reseller business without a consultant, provided someone owns abuse reports, billing and backups from the first day. Q: How do I choose between cPanel and WHM and other control panels? A: cPanel is the customer-facing panel and WHM is the server and reseller administration layer. The license is commercial and tied to the server IP address. It runs Exim mail, backups and AutoSSL, and WHMCS has a provisioning module for it. Choose by whether customers expect a self-service panel, whether your billing has a maintained module for it, and the license cost at your account count. I work mainly with cPanel and WHM, so I cannot compare other panels from experience. My ties to hosting companies, listed on this page, mean my view is not neutral. Q: How much does a hosting consultant cost? A: I quote a fixed price per scope after a free scoping call of about 30 minutes, usually within one business day, or I bill $55 to $65 per hour. The price depends on the number of servers, the state of the documentation and whether mail, backups or a migration are in scope. I do not publish prices per task. Q: Can you take over my existing servers? A: Yes, in steps. I review first and change nothing, then give you a ranked list of risks and the part I am willing to take on. After that I maintain the servers for a scope we write down. They stay in your accounts at your provider, and I am a freelancer, not a staffed operations center. Q: Do you offer managed hosting? A: No. I do not sell hosting through this site. I advise, build and maintain on servers that you own or rent from a provider you choose, and the customers, data and accounts stay yours. If you want a company to run the servers and carry the pager, you need a managed hosting provider. Q: Can you help if I use Plesk, DirectAdmin or Windows servers? A: Those are not my core. I work mainly with Linux, cPanel and WHM, and WHMCS. On the scoping call I tell you plainly whether your setup falls inside that, and I will say so before you commit to anything. I can often still help with panel-independent parts such as DNS, mail records and billing. ## WHMCS Theme Customization URL: https://shahidmalla.com/whmcs-theme-customization I customize WHMCS themes for hosting companies and service businesses: client area, order forms, home page, emails and PDF invoices. All changes live in a child or custom template folder, never in core files, so your branding survives upgrades, and every changed page is checked on a phone. - Typical timeline: Typically 4 to 12 working days, depending on how many pages change - Works with: The default Twenty-One theme and commercial themes you hold a license for - Pricing: Fixed quote after a free scoping call, or $55-$65/hour - Safety: Edits sit in a child or custom theme folder, never in core files ## Which parts of the WHMCS client area can be restyled? Nearly every customer-facing screen can be restyled, because each one is rendered by a Smarty template file in the theme folder. The table lists the parts people ask about most. Part | Where it lives | What I usually change | Header and menu | header.tpl and navbar hooks | Logo, menu items and order, login and cart links | Home page | homepage.tpl | Hero area, product tiles, domain search position | Footer | footer.tpl | Links, legal text, scripts and tracking | Order forms | templates/orderforms/ | Product list layout, option fields, checkout steps | Client dashboard | clientareahome.tpl | Which panels show and in what order | Invoices | viewinvoice.tpl | On-screen layout and the position of the pay button | Login and registration | login.tpl, clientregister.tpl | Field order, wording and extra help text | Support pages | supportticketslist.tpl, knowledgebase.tpl | Layout, search box position, ticket list columns | Emails | Email Templates in the admin area | HTML, plain text, logo and merge fields | PDF invoice | A separate PDF layout, not the on-screen invoice template | Logo, company details, tax lines and footer | ## How is a WHMCS theme built? A WHMCS theme is a folder inside templates/ holding Smarty .tpl files plus the CSS, JavaScript and images they load. Order forms are separate templates under templates/orderforms/, so the cart and the client area can be styled independently. Smarty is a PHP template language. A file mixes HTML with tags such as {$variable}, {if} and {foreach}, and WHMCS supplies the variables for each page. You pick the active theme in the admin general settings and an order form per product group. Because the logic is separate from the layout, I can move, hide or restyle a section without touching how WHMCS processes the data behind it. That is also why design changes rarely threaten billing. ## Why do my changes go in a child theme and never in core files? Changes go in a child or custom theme folder because a WHMCS upgrade overwrites the default theme's files, and any edit made to them disappears. A child folder is not touched by the upgrade. A child theme holds only the files I have changed. For every other page, WHMCS falls back to the parent theme, which keeps the child small and easy to review. For the default Twenty-One theme, the child folder declares its parent in a small theme.yaml file. Where I can, I avoid editing templates at all. I use the ClientAreaHeadOutput and ClientAreaFooterOutput hooks to add CSS and JavaScript, and a file in lang/overrides/ to reword text. Each of those survives upgrades with no template copy to maintain. The trade-off is that a child theme still inherits parent updates, so I retest after each WHMCS release. ## Can you customize a commercial theme I already own? Yes, provided you hold a license for it and the vendor permits changes. I work within the vendor's own override method, which is usually a custom folder, a settings panel or a custom stylesheet. I do not edit encoded vendor files, and I do not work on pirated copies of any theme. If a theme encodes parts of its code, I can only change what the vendor exposes. Before I start, I record the theme version and list the files I change, so a vendor update can be compared with my work instead of overwriting it blindly. If you do not own a theme yet, note that I am the founder of WHMCSPilot.com, which sells premium themes. You are under no obligation to buy from it, and custom work on the default theme is a legitimate alternative. ## How do you check mobile, accessibility and speed? I test every changed page at phone, tablet and desktop widths, with a keyboard and with a contrast checker, and I time how the page loads. Order forms get the most attention because a broken cart loses sales directly. - Mobile: I test at narrow widths and on a real phone, including tapping the checkout buttons, filling the forms and paying. - Accessibility: I check text and button contrast, visible focus outlines, form labels and a keyboard-only run through the order flow. I work toward WCAG AA guidelines, but I do not certify compliance. - Speed: Smarty compiles each template once and stores the result in templates_c. The first view after a change is slower, and the folder must stay writable. I also keep heavy scripts and large images out of the page. If the client area is slow but the theme is light, the cause is usually the server or the database, not the template. I check PHP and database settings before blaming the design, and the troubleshooting guide covers that kind of check. ## How do email templates and PDF invoices fit in? Email templates are edited in the WHMCS admin area, while PDF invoices use a separate layout. Both should carry the same brand as the client area so customers see one consistent company. Email templates use Smarty merge fields such as the client name and invoice number. I restyle the shared header and footer, then open every changed template with test data to catch broken fields. I also check the plain-text version and the look in the major mail clients. For the PDF invoice, I use the override method your WHMCS release supports instead of editing core files. I match logo size, company details and tax lines, then test long item names, several currencies and right-to-left or non-Latin text, since the PDF engine needs fonts that contain the characters. ## What is outside theme work? I will not edit WHMCS core files or default theme files, install pirated themes, or promise a particular conversion rate or search ranking from a design change. I do not certify accessibility compliance, and I do not design brand identities from scratch. Theme work also stops at the template layer. If a feature needs new behavior, such as an extra page backed by its own data, that becomes a custom module and is quoted separately. For a fresh system that needs both configuration and styling, see WHMCS development. Q: Can you customize a commercial WHMCS theme I bought? A: Yes, if you hold a valid license and the vendor allows modification. I follow the vendor's documented way to override templates and styles, and I keep a record of every change so vendor updates can be reapplied. Where the vendor encodes part of the theme, I can only change what they leave open. Q: Will my theme survive a WHMCS upgrade? A: Mostly yes. Changes in a child or custom theme folder are not overwritten by the upgrade. But a new WHMCS release can change template variables or add new pages, so I recommend a quick retest of the client area and cart after each upgrade. A support plan can include that check. Q: Can you make the order form match my website? A: Yes. I restyle the order form template with your colors, fonts and layout, and adjust the steps so the product choice, options and checkout read clearly on a phone. I can also match the header and footer to your main site so customers do not feel they have left it. Q: Can you change how PDF invoices look? A: Yes, within limits. PDF invoices are produced by a different engine than the on-screen invoice, so I can change the logo, company details, tax lines and footer, but not everything a web page allows. Fonts for scripts such as Urdu or Hindi need to be checked, because a missing font shows empty boxes. Q: Do you design the look from scratch? A: I build from a given design, and I can adapt an existing theme to your brand. I am not a brand designer, so I do not create logos or full identities. If you need new visual design, bring a designer or a Figma file and I will build it into WHMCS faithfully. Q: Do you sell themes? A: I am the founder of WHMCSPilot.com, which sells premium WHMCS modules and themes, so I have a financial interest in that. You are free to choose any theme or none. Custom work on the default Twenty-One theme is a valid route, and I will tell you which option costs less for your case. ## WHMCS Payment Gateway Integration URL: https://shahidmalla.com/whmcs-payment-gateway-integration I integrate payment gateways with WHMCS for hosting companies and online businesses, including Stripe, PayPal, Razorpay, NowPayments and regional gateways. Each module verifies webhooks, ignores duplicates, handles refunds and 3-D Secure, and is tested in a sandbox before it touches a live payment. - Gateways worked with: Stripe, PayPal, Razorpay, NowPayments (crypto) and regional gateways - Typical timeline: Typically 4 to 12 working days, depending on gateway and scope - Pricing: Fixed quote after a free scoping call, or $55-$65/hour - Card data: Modules I build do not store card numbers; hosted pages or tokens only ## What kinds of WHMCS payment gateway can be integrated? WHMCS gateways fall into three designs, and the design decides how card data is handled and how renewals work. I pick the design before writing any code. Design | How the payment works | Card data on your server | Hosted or redirect | The customer is sent to the gateway's page to pay. The gateway notifies WHMCS through a callback. Renewals usually need the customer to pay each invoice. | None | Tokenized | The gateway stores the card and returns a token. WHMCS keeps only the token and charges it on the due date through the module's capture function. | None, only a token | Merchant (card form on your site) | Card details are typed into your site and passed to the gateway. | Passes through your server | I steer almost every project to the first two designs. The third one pulls your server into much heavier compliance work, and I do not write code that stores card numbers. ## Which files make up a WHMCS gateway module? A gateway module is one main file plus one callback file. The main file is modules/gateways/.php and the callback file is modules/gateways/callback/.php, both using the same lowercase module name. The main file defines _MetaData() and _config(), which draw the admin settings such as API keys and a test mode switch. A hosted gateway adds _link($params), which returns the pay button or redirect shown on the invoice. A tokenized gateway adds _capture($params) to charge a stored token, and _refund($params) handles refunds. The callback file is a plain endpoint that the gateway calls over HTTPS, and it is where the money logic lives. ## How does a callback mark an invoice as paid? A callback marks an invoice as paid by running a fixed sequence of WHMCS helper functions, after the payment has been verified. The order matters, because each step guards the next. - getGatewayVariables() loads the module's saved settings, which the callback uses to confirm the gateway is active. - Verify the signature on the raw request body before trusting any field in it. - checkCbInvoiceID() confirms the invoice exists in this WHMCS. - checkCbTransID() stops processing if this transaction ID was already recorded. - logTransaction() writes the raw data and result to the gateway log, which is where I look first when a payment looks wrong. - addInvoicePayment() records the payment and fee against the invoice and marks it paid once the balance reaches zero. I also compare the paid amount with the invoice balance before step six, so a partial or tampered amount is logged instead of being treated as full payment. ## How do I stop forged and duplicate webhooks? Verify the cryptographic signature on every request and record each transaction only once. A callback URL is public, so anyone can send it a fake "paid" message unless the signature is checked. - Stripe signs each webhook in a Stripe-Signature header and includes a timestamp, so I also reject notifications that are too old. - Razorpay sends an HMAC signature of the request body in an X-Razorpay-Signature header, checked against your webhook secret. - PayPal webhooks are verified by sending the received headers and body back to PayPal's verification API. - NowPayments signs its instant payment notifications with a secret key that I check on every call. I compare signatures with hash_equals(), which avoids timing leaks. For duplicates, gateways retry notifications, so the same event can arrive twice or out of order. checkCbTransID() stops a second payment from being recorded, and for events that carry no transaction ID I store the gateway's event ID and ignore repeats. A duplicate still gets a quick success response, so the gateway stops retrying. ## How do refunds work? A refund started from the WHMCS admin area calls the module's refund function, which asks the gateway to return the money and reports the result back. The function returns a status of success, declined or error, plus the gateway's reference. The harder case is a refund made in the gateway's own dashboard. WHMCS knows nothing about it unless the gateway sends a webhook and the callback handles it, so the invoice would still show as paid. I handle refund events in the callback where the gateway offers them, and I list in the handover notes any case, such as crypto, where the refund stays manual. ## What about 3-D Secure and strong customer authentication? For hosted and redirect gateways, the gateway runs the 3-D Secure challenge itself, so WHMCS has nothing extra to do. The difficult case is a renewal charged on a stored token, because the customer's bank may still demand authentication. When a charge needs authentication, the module must treat it as a failed attempt, not retry blindly. I record the failure, let WHMCS send its normal payment reminder, and make sure the customer can open the invoice and complete the challenge on a hosted page. This matters most for customers in regions with strong customer authentication rules, such as the EU and UK. ## How do currencies and gateway fees work? WHMCS bills each client in their own currency, and many gateways accept only some. The admin gateway settings let WHMCS convert the invoice to a currency the gateway supports, and I make the callback read the converted amount. My WHMCS multi currency setup guide covers the currency side step by step. Fees are recorded in the payment so your reports show net income. Some gateways send the fee with the notification, while others expose it only through a separate lookup after settlement. I record the fee when it is available and leave it empty when it is not, and I write down which case applies to your gateway. ## How do you test a gateway before going live? I test in the gateway's sandbox against a staging WHMCS that the internet can reach, because webhooks cannot be tested against a laptop. A public staging address or a tunnel makes that possible. The test list covers a successful payment, a decline, an expired session, the same webhook sent twice, a late webhook, a partial amount, a currency conversion and a refund. After each case I check the invoice, the gateway log and the gateway dashboard, and they must tell the same story. Only then do I switch to live keys, take one small real payment and refund it. ## Which gateways have you integrated? For the Stripe and Razorpay setups I use most, the step-by-step notes are in WHMCS Stripe integration and WHMCS Razorpay integration. I work with Stripe, PayPal, Razorpay and NowPayments, and with regional gateways that publish an API reference and a sandbox. WHMCS ships modules for several large gateways, and when one of those already does what you need, I will tell you to use it instead of paying for custom work. I build when the bundled module lacks a feature, such as a local payment method, or when the gateway has no module at all. A new module is a form of custom module development, and a gateway that touches payments is a natural place for a security review. ## What will a gateway module of mine never do? I will not store card numbers or security codes, and I will not build against a gateway that offers no documentation or sandbox. I cannot get a merchant account approved for you, since gateways make that decision. I do not edit WHMCS core files or work from cracked gateway modules. For crypto, price movement and confirmation rules are business decisions that stay with you. If you are setting up from scratch, WHMCS development includes connecting a gateway in sandbox mode. Q: Can you integrate any payment gateway with WHMCS? A: In most cases, yes, as long as the gateway publishes an API reference and a sandbox environment. That covers many card, wallet, bank and crypto processors. If the gateway has no sandbox or no documentation, I cannot test safely, and I will say so before quoting rather than build against a live account. Q: Do you store customer card numbers? A: No. I use hosted payment pages, hosted fields or gateway tokens, so card numbers go to the gateway and never reach your WHMCS server or database. This keeps your PCI scope much smaller and removes the most dangerous data from your system. I will not build a module that stores card numbers or security codes. Q: Why do some invoices show as paid twice or stay unpaid? A: Usually the callback does not handle repeated or delayed webhooks properly, or it trusts the data without checking the signature or amount. Gateways retry notifications, so the same event can arrive more than once. A correct callback records each transaction only once and checks the amount before marking an invoice paid. Q: Can customers pay in a currency different from the invoice? A: Yes, if the gateway supports it. WHMCS can convert the invoice to a currency the gateway accepts, using the exchange rates you maintain. I then check the amount the gateway reports against the converted invoice balance, so a rate difference cannot leave an invoice paid short without anyone seeing it. Q: Can you add crypto payments to WHMCS? A: Yes. I work with NowPayments and similar processors. The customer pays on a hosted crypto page, and a signed notification tells WHMCS when payment is confirmed. You decide how many confirmations you wait for and how underpayment and overpayment are handled. Crypto refunds are usually manual, and I will say so in the notes. Q: How long does a gateway integration take? A: Typically four to twelve working days, depending on the gateway and the scope. A hosted redirect gateway with a clean API is quicker. Tokenized renewals, 3-D Secure, refunds and several currencies take longer. I give you a date once I have read the gateway's documentation. ## WHMCS API Integration and Automation URL: https://shahidmalla.com/whmcs-api-integration-automation I connect WHMCS to the tools around it, such as a CRM, Slack or Telegram alerts, SMS, accounting, fraud checks, control panels and DNS. I pick the external API, localAPI() or a hook for each job, use least-privilege credentials, and test in a staging copy before live billing is touched. - Mechanisms: External API, localAPI() and hooks, chosen per job - Typical timeline: Typically 3 to 10 working days, depending on scope - Pricing: Fixed quote after a free scoping call, or $55-$65/hour - Testing: Staging copy first, then a watched go-live ## Which WHMCS automation mechanism fits which job? Use a hook to react to an event inside WHMCS, localAPI() to act on WHMCS data from code that already runs inside it, and the external API when another system must drive WHMCS from outside. Most projects use two of the three. This table is how I choose. Automation goal | Mechanism | Example | New clients into a CRM | Hook: ClientAdd | Create or update the CRM contact with a five-second timeout, and queue a retry if the CRM is down. | Slack or Telegram alerts | Hooks: InvoicePaid, TicketOpen | Post "Invoice #1042 paid" to a private channel using a bot token stored outside the code. | SMS for late payments | Hook: DailyCronJob plus localAPI GetInvoices | Text clients whose invoice is three days overdue, once, then record that it was sent. | Accounting sync | Hook: InvoicePaid, or a nightly external job using GetTransactions | Post each payment to the accounting package and store its external ID so a repeat never double-books. | Fraud checks | A fraud module, or hook AfterShoppingCartCheckout | Send IP, email and country to a risk service and hold high scores for manual review instead of canceling. | Panel or DNS provisioning | Server module for the account, hook AfterModuleCreate for follow-up steps | After the hosting account exists, add DNS records or a monitoring check through the provider's API. | Signups from another site | External API: AddClient, AddOrder | A marketing-site form creates the client and order, and WHMCS sends its normal signup email. | Custom reports | External API with paging, or an admin addon | A nightly CSV of recurring revenue, churn and failed payments, built from GetInvoices. | Renewal and dunning recovery | Hook: DailyCronJob plus localAPI SendEmail | Extra reminders before and after the due date with a pay link, stopping as soon as the invoice is paid. | Usage billing | Hook: DailyCronJob plus localAPI AddBillableItem | Read usage from the provider and add a billable item that the next invoice run collects. | ## How does the external WHMCS API work? The external API is a single HTTPS endpoint, includes/api.php, that takes a POST with an action name and returns the result. Access is controlled by API credentials: an identifier and secret pair tied to an API role that lists exactly which actions the holder may call. - Every request carries the identifier, the secret, the action and responsetype=json. - The reply has a result of success or error. Business problems such as "client not found" also come back as errors, so the caller must handle both kinds. - List calls such as GetInvoices take limitstart and limitnum. I page through results instead of pulling thousands of rows in one request. - The credential can be limited to the calling server's IP address, so a leaked secret is useless from anywhere else. Older username and password authentication still exists in some versions. I do not use it, because it ties an integration to a real admin login. ## When should I use localAPI() instead? Use localAPI() whenever the code already runs inside WHMCS, because it runs the same commands in-process, with no HTTP request and no secret to store. A hook that adds a billable item calls localAPI('AddBillableItem', $values) and gets an array back. API roles exist to limit external credentials, and code inside WHMCS is trusted by design. That is why I keep in-process code small and review it as carefully as an admin account. ## How do WHMCS hooks work, and what goes wrong with them? A hook is a function that WHMCS runs at a defined moment. You register it with add_hook() in a PHP file inside includes/hooks/, and WHMCS loads that file on every request. Events include InvoicePaid, ClientAdd, AfterModuleCreate and DailyCronJob, and each passes a $vars array with the relevant IDs. Hooks survive upgrades because they live outside the core files. These are the failures I design against. - Slow calls. An unresponsive CRM inside ClientAdd can freeze signup. I set short timeouts and, for anything non-urgent, write to a queue table and send it from the cron. - Uncaught errors. I wrap outbound work in try/catch and record failures with logActivity(), so a broken third party cannot break checkout or the cron run. - Duplicates. Events can repeat. I store a marker for each action so a client never gets two SMS messages or two accounting entries. - Loops. A hook that updates an invoice through localAPI can trigger itself. I guard against it. ## How do I keep a WHMCS API integration secure? Give every integration its own API credential and a narrow API role, and never reuse an admin login. A signup form needs the ability to add a client and an order. It does not need to read every client or delete anything. - One credential per integration, so revoking one breaks nothing else. - HTTPS only, with an IP allow-list wherever the caller has a fixed address. - Secrets in environment variables or a config file outside the web root, never in hook code or a repository. - Signature checks on inbound webhooks before any action is taken. - Logs through logActivity() and logModuleCall(), with secrets and card data stripped, plus a periodic look at the API log for unknown callers. - Credentials deleted when the integration is retired. If you are unsure what your existing credentials can do, the WHMCS security audit reviews every one of them. ## How do you test a WHMCS integration before it touches live billing? I test in a staging copy of your WHMCS with its own database, outgoing email redirected to a test address, gateways in test mode and the other service in sandbox mode where one exists. Then I work through four checks. - Trigger each event with test clients and orders, and confirm the hook fires exactly once. - Cause failures on purpose, such as a wrong secret, a timeout and a 500 response, and confirm WHMCS keeps working. - Run the daily cron through a full cycle, so DailyCronJob code is exercised. - Go live in a quiet hour and read the logs after the first real invoice and payment. ## Which integration shortcuts do I refuse? I do not edit WHMCS core files, because those edits vanish on upgrade. I do not copy card numbers out of WHMCS into another system, since card data stays with the gateway. I do not scrape the admin screens when an API command or hook exists, and I do not work on unlicensed or nulled WHMCS copies. Not every action is exposed by the API. When one is missing I say so, and the answer is usually a small addon module rather than writing straight into WHMCS tables. ## How much does a WHMCS API integration cost? I quote a fixed price within one business day of the scoping call, or work hourly at $55 to $65 per hour. The cost depends on how many systems are connected, how clean the other side's API is, how much error handling the volume needs, and whether an admin screen is required. For a full admin feature see custom module development, for payment flows see payment gateway integration, and for keeping integrations working after upgrades see support and maintenance. The official WHMCS developer documentation lists every API command and hook point. Q: What is the difference between the WHMCS API and localAPI()? A: The external API is an HTTPS endpoint, includes/api.php, used by systems outside WHMCS and protected by API credentials and roles. localAPI() runs the same commands from PHP code already inside WHMCS, such as a hook or module, with no network request. I use the external API for other servers and localAPI() for code that runs inside WHMCS, such as hooks and modules. Q: Can WHMCS send notifications to Slack, Telegram or SMS? A: Yes. A hook on an event such as InvoicePaid, TicketOpen or a daily cron run calls the chat or SMS provider's API with a short timeout. The message text, the recipients and the retry behavior are agreed up front. Tokens are kept outside the code, and a failed send is logged instead of blocking the invoice. Q: Is it safe to give an integration access to my WHMCS API? A: It is safe when the access is narrow. I create a separate API credential for each integration, attach an API role that allows only the actions it needs, and restrict the credential to the calling server's IP address. An integration never uses a staff member's password, and unused credentials should be deleted when a project ends. Q: Will an integration break when I upgrade WHMCS? A: Hooks and API commands are the supported interface, so they survive upgrades far better than edited core files. They are not immune. A release can deprecate a command or change a field, so I read the release notes and run the integration against a staging copy of the new version before you upgrade production. Q: How long does a WHMCS integration take? A: A single event-to-service job, like pushing new clients to a CRM, typically takes three to five working days including testing. Several systems, two-way sync or an admin screen can take ten days or more. You get a firm date once the scoping call has shown what is involved. Q: What access do you need to build an integration? A: An admin login with permission to create API credentials, SSH or SFTP access to a staging copy, and a sandbox or test account on the other service. I ask for production access only at go-live. Q: Can you connect WHMCS to a system that has no API? A: Sometimes. If the other system can import a CSV, accept email, read a database view or call a webhook, I can build a scheduled export or a small middleware service. I tell you early when this makes the result fragile, because a missing API usually means more manual checking later. ## Mobile App Development: Android and iOS App Developer URL: https://shahidmalla.com/mobile-app-development I am Shahid Malla, a freelance Android and iOS app developer. I handle mobile app development for businesses and founders: one Flutter or React Native codebase for both stores, a Laravel or NestJS API and an admin panel behind it, and publishing under developer accounts that belong to you. - Platforms: Android and iOS from one codebase - App frameworks: Flutter or React Native, with native code where a feature needs it - Backend: Laravel or NestJS API with a browser admin panel - Store accounts: Apple and Google developer accounts in your name - Current work: Android and iOS apps, API and CRM for Marmaids LLC (ongoing) - Pricing: Fixed quote per scope, or $55-$65/hour ## What does mobile app development with me cover? It covers four things, delivered by one person: the app for both stores, the API behind it, the admin panel your staff use and the publishing work. The quote prices each one separately. How a project runs day to day is explained on how I work. ## What mobile apps are you building now? I am currently building Android and iOS apps for Marmaids LLC, where I work as a freelance developer. For the same company I have built the API the apps talk to, a CRM and a WHMCS module, so the apps, the back office and the billing system share one set of data. The work is ongoing. The apps are the client's, so I do not publish their screens or internals here. ## What does cross-platform mean, and when is a native app the better choice? Cross-platform means one codebase produces both the Android app and the iPhone app, instead of two apps written separately. Flutter (Google's toolkit, written in Dart) draws its own interface. React Native (from Meta, written in JavaScript or TypeScript) drives the platform's own interface components. Both end up as real apps installed from the stores, not websites in a wrapper. Question | Cross-platform (Flutter or React Native) | Native (Swift and Kotlin) | How many codebases? | One, shared by Android and iOS | Two, one per platform | Device features | Camera, location, biometrics and maps through plugins, with a platform channel (Flutter) or a native module (React Native) for anything missing | Every system API, on the day Apple or Google releases it | Fits when | Forms, lists, bookings, catalogs, chat and accounts, which covers most business apps | Heavy Bluetooth or background work, augmented reality, advanced camera or audio processing, or an existing native team | Trade-off | You depend on the framework and its plugins keeping pace with new OS versions | Higher build and maintenance cost for the same screens | Some features stay native even in a cross-platform app. Home-screen widgets, an Apple Watch companion and similar system extensions are written in Swift or Kotlin and attached to the shared code, and I quote them as separate items. If the whole product leans on them, I say so before you commit. ## Why does an app need a backend and an admin panel? Because the app on the phone is only the screen. Accounts, orders, prices and rules live on a server that both platforms share. That backend and its admin panel are often as much work as the app, and a quote that leaves them out will grow later. I build the API in Laravel or NestJS, the same tools I use for SaaS products. Two decisions go in on the first day: - Versioned routes. Paths start with /api/v1, because old app versions stay on customers' phones for months and must keep working. A minimum-version check lets the server tell an outdated app to update. - Token login. The app keeps a revocable token in the phone's secure storage (Keychain on iOS, Keystore on Android), never a password. The admin panel lets staff look up a customer, edit content, refund an order and send notifications without calling a developer. Where the business already runs on a CRM, the API reads from it instead of keeping a second copy of every record. ## How do push notifications work on Android and iOS? Your server hands each message to Google's or Apple's delivery service, which passes it to the phone. On Android that service is Firebase Cloud Messaging (FCM). On iOS it is Apple Push Notification service (APNs), usually reached through FCM with an APNs key file (.p8) from your Apple developer account. The user has to agree first: iOS asks for permission, and recent Android versions do too through POST_NOTIFICATIONS, so some users never receive a push. Every phone also has a device token that changes over time, so the backend stores tokens per user and removes dead ones. I ask for permission after a first order, not on the opening screen. ## Do I have to use in-app purchase, or can I take payments with Stripe or Razorpay? That depends on what you sell, and the stores decide, not the developer. As a general rule, digital goods used inside the app, such as subscriptions, premium features or downloadable content, go through Apple's and Google's own in-app purchase systems. Physical goods and services used outside the app, such as products you ship, rides, hotel stays or tickets, are paid through an ordinary processor like Stripe or Razorpay. - Both stores keep a commission on in-app purchases, which belongs in your pricing. - For in-app purchases, the backend confirms each transaction with Apple or Google, server to server, and follows their renewal and refund notifications before it grants or removes access. - For Stripe or Razorpay, a paid order is confirmed by the provider's signed webhook event, not by the screen the customer returns to. The rules have exceptions by country and by app category, and they change. I check the current store guidelines for your case during scoping and write the result into the quote. ## What do Apple and Google need before an app can be published? They need a developer account in your name, a signed build, a complete store listing and honest privacy answers, and then they review the app. I prepare this checklist with you: - Developer accounts. You enroll in the Apple Developer Program and register a Google Play Console account as the legal owner. Company enrollment involves identity checks and a D-U-N-S number, which can take days, so start early. - App identifier. A bundle ID and application ID such as com.yourcompany.app. It cannot be changed after release. - Signed builds. An Android App Bundle (.aab) for Google Play and an iOS build compiled with Xcode on a Mac. - Privacy details. A public privacy policy URL, Apple's App Privacy answers, Google's Data safety form, and a purpose text for every permission, for example NSCameraUsageDescription in Info.plist. - Reviewer access and account deletion. A demo login for the reviewer, and a way for users to delete their account if the app lets them create one. - Test release. TestFlight on iOS and a testing track on Google Play. Google may ask a new personal account to run a closed test before it grants production access. ## Who owns the code, the store accounts and the signing keys? You do. You open the Apple and Google developer accounts in your name or your company's, and I work inside them as an invited user whose access you can remove. I do not publish client apps under my own account, because whoever holds the account controls the app, its updates and its income. At handover you receive the source repository, the Android upload keystore with its passwords, the Firebase project, the API credentials and written release steps. Rights to the custom code are spelled out in the quote before work begins. ## Which apps will I not build? I decline apps that copy someone else's product or that are designed to get around store rules. - Clones of another company's app: its name, screens, icons or content. - Apps that hide their real function from reviewers, or that collect contacts, location or messages without telling the user why. - Fake reviews, paid ratings or bought installs. - A website wrapped in a web view and submitted as an app. Apple tends to reject these, and a good mobile site does the job better. See business website development. I also do not promise approval dates, download numbers or a position in store search. Apple, Google and your own marketing decide those. ## How do I hire an app developer for my project? The first step is the free scoping call, which takes about 30 minutes. The written quote follows within one business day, as a fixed price per scope or at $55 to $65 per hour while the size is still unknown. Bring three things: who the app is for, the three screens they will use most, and how you expect to be paid. When you are ready, send me the brief. Q: How much does it cost to build a mobile app? A: There are two ways to pay: a fixed price for a scope written down in advance, or $55 to $65 per hour. What moves the price is the count of screens, user roles, payment flows and offline features, and whether the API and admin panel are new or already exist. Running costs are separate and go straight to the providers: Apple's yearly developer membership, Google's one-time registration fee, backend hosting and any paid services such as SMS or maps. The scoping call is free. Q: How long does mobile app development take? A: It depends on scope, so I name a date only once the screens and features are agreed in writing. A few screens on an API that already exists is the quickest kind of project. A new backend, an admin panel, payments and offline sync each add time. Store review comes on top and is outside my control: a first submission can come back with questions before it is approved. Q: Should I choose Flutter or React Native? A: Both produce real Android and iOS apps from one codebase, so the choice follows your situation. React Native fits when your team already writes React or TypeScript and may maintain the app later. Flutter fits when the design is heavily custom and must look identical on both platforms. I take projects as a Flutter app developer or as a React Native developer, and the written scope states which one I recommend and why. Q: Do I need a mobile app for my business, or is a website enough? A: A website is enough when customers visit now and then to read, inquire or place an occasional order. A fast mobile website costs less to build and needs no store approval. A mobile app for your business earns its cost when the same people open it often, or when it needs push notifications, the camera, location or offline use. When a website would serve you better, you will hear that from me in the first call. Q: Can you take over an app another developer started? A: Yes, once I have read the code. You get my findings in writing before any price. I need the source repository, access to the store accounts and the signing keys. A lost Android upload key can usually be reset through Google when the app uses Play App Signing. Without the source code there is nothing to continue, and a rebuild is the only route. Q: Will Apple and Google approve my app? A: Nobody outside those companies can promise approval, and I do not. What I can do is remove the usual reasons for rejection before submitting: a working demo login for the reviewer, complete privacy answers, a way to delete an account inside the app, permission prompts that explain themselves, and payments that follow the store's rules. If a build is rejected, I read the reviewer's note, fix the cause and resubmit as part of the agreed scope. Q: What happens after the app is published? A: An app needs upkeep after launch. Apple and Google release new system versions every year and raise their requirements with them, for example the Android API level that Google Play expects an app to target. Plan for at least one maintenance release a year, plus fixes when a payment or login provider changes its SDK. The two weeks of support that follow delivery are part of the price. Work after that is a new quote or hourly. ## Freelance Web Designer and Developer for Business Websites URL: https://shahidmalla.com/web-designer-developer I am Shahid Malla, a freelance web designer and developer. I design and build complete business websites from the first layout to launch: company sites, online stores, booking sites for travel and hotels, and sites for schools and non-profits, in Laravel, WordPress with WooCommerce or Astro, and I hand over every login. - Site types: Company sites, online stores, booking sites, schools and non-profits - Platforms: Laravel, WordPress with WooCommerce, or Astro - Who builds it: One person, from layout to launch - Typical timeline: Two to five weeks, depending on scope - Pricing: Fixed quote per scope, or $55-$65/hour ## What does hiring me as your web designer and developer include? It includes everything between an empty domain and a site your staff can run: layout, content structure, the build, speed, search basics, analytics and a handover. These website design and development services come as one project from one person, so the developer you brief is the one who answers when something needs changing. Part of the build | What I do | Design | Lay out each page type for a phone screen first, using your logo, colors and photos, then widen it for desktop. | Content structure | Decide which pages exist, what each one must answer and where the call, form or buy button sits. | Build | Code the templates, forms, catalog or booking flow on the platform named in the quote. | Speed | Serve WebP images at the size each screen needs through srcset, lazy-load what sits below the first screen and cache pages. | Search basics | A unique title and description per page, a clear heading order, a sitemap.xml, canonical URLs and 301 redirects from old addresses. | Analytics | Google Analytics and Search Console created in your Google account, with form sends and purchases recorded as events, and a consent banner where the law that applies to your visitors requires one. | Handover | Training for whoever will edit the site, every login and written notes. | ## What kinds of business websites have I built? Company sites, online stores, booking sites and sites for schools and non-profits, for clients in India, the United States, Canada, the United Kingdom, Australia and Nigeria. My portfolio lists them with the stack used for each. Some of what those sites do: - Company sites. A CCTV installer with a page per service and an estimate request form. A vehicle dealership whose buyers filter stock by year, make, model, mileage, transmission and condition. - Online stores. Jewelry, saffron, dry fruits, tea and caps, with collections, sale labels, bundle offers, member discounts and payment by card, UPI, wallet or cash on delivery. - Booking sites. Tour operators with search by destination, dates, guests and rooms. Hotels with room pages, nightly rates and guest accounts. - Schools and non-profits. College sites with program pages and admission inquiry forms, a research journal with a manuscript submission workflow, and a charity site with donation and volunteer forms. ## Should my site be built in Laravel, WordPress or Astro? It should be built on the simplest platform that does the job, and the quote names that platform with the reason. I work in all three, so the choice follows the site and not my habits. Platform | I choose it when | How you edit content | Trade-off | WordPress with WooCommerce | Staff will edit pages and articles often, or the store has a standard catalog, cart and checkout | The WordPress editor and the WooCommerce product screens | Core, theme and plugins need regular updates, and every extra plugin is one more thing that can break | Laravel | The site has rules of its own: search by dates and guests, customer accounts, unusual pricing, or several currencies and languages | An admin panel built around your content, such as packages, rooms or courses | More build time, and structural changes later need a developer | Astro | Content changes rarely and speed matters most, or the pages are a storefront in front of a separate API | Content files, or a content management system added to the scope | No admin screen out of the box, and anything dynamic needs a service behind it | Astro ships pages as static HTML with little or no JavaScript, which is why I used it for a used-car storefront that reads its inventory from a NestJS API. When a website turns out to need dashboards, roles and subscriptions, it is a web application, and I scope it as a SaaS product. ## How is an online store or booking site different from a brochure site? A brochure site shows information and collects inquiries. A store or booking site also has to take money and keep records straight, and that changes the scope more than the page count does. ### Online store A store adds a catalog with variants and stock, shipping rules, taxes, a payment gateway, order emails and policy pages. The step most often skipped is the gateway webhook. The store should mark an order as paid when the gateway's signed event arrives, because buyers close the tab before the thank-you page loads. Before launch I run a successful, a failed and a refunded payment in the gateway's test mode. ### Booking site As a booking website developer, the first thing I ask is whether guests send a request that you confirm by hand, or book and pay at once. A request form with dates, guest count and a phone number is a small job. Instant booking needs an availability calendar that blocks sold dates, rules for advance payment and cancellation, and often traveler accounts, which is custom work in Laravel. If customers will later want the same bookings on their phones, that API can also serve a mobile app. ## What does a website developer need from the client before starting? A developer needs the raw material of the business: words, pictures, prices, policies and access. I arrange it into a site, and a build stalls without these: - Text for each page, or rough notes that I shape into pages for your approval. - Photos you have the right to use. Real pictures of your products, premises or team work better than stock images. - Your logo as a vector file, and your brand colors. - Products, packages or rooms with prices, ideally in a spreadsheet. - Your policies: returns, cancellation, delivery and privacy. - Access to the domain, and a payment gateway account opened in the name of the business. - One person who approves work, so feedback does not arrive in conflicting versions. ## What is not part of a website build? Hosting sales, brand design, copies of other sites and ranking promises are not part of it. - Hosting sales. Hosting is not sold through this site. I set up the plan you choose, in your name. - Logo and brand design. I design the pages, not the brand. A logo or brand identity is included only when the quote says so. - Copies of other sites. Show me sites you like and tell me why. I will not reproduce another company's design, text or photos. - Ranking promises. I build the site so search engines can read it. Where it ranks depends on competition, links and time. I never use nulled themes or plugins. After launch, updates and backups for a WordPress site can continue under WordPress maintenance. ## How much does a freelance web designer and developer cost? It costs a fixed price for a listed scope, or $55 to $65 per hour where the size is unclear, for example when an old site has to be untangled first. The free scoping call takes about 30 minutes, and the quote is in your inbox within one business day. I work alone and take a limited number of builds at a time, so ask about the start date on the call. How I work has the full terms. A business in Kashmir that would rather meet in person and be quoted in rupees should read web designer in Kashmir. Q: Are you a web designer or a web developer? A: Both. I design the layout and visual style of the site and then build it myself, so nothing is lost between a designer's mockup and the code. For business website development that usually means fewer rounds of changes, because the person who decides how a page looks also knows what it costs to build and how fast it will load. Q: How much does a business website cost? A: A website is quoted as a fixed price against a written scope, or billed at $55 to $65 per hour. Cost is driven by how many page types there are, the features behind them and how much content has to be moved or prepared. A brochure site sits at the low end. Checkout, live availability, customer accounts and extra languages each add work. Domain, hosting, paid plugin licenses and payment gateway fees are ongoing costs billed to you by those companies. Q: How long does it take to build a business website? A: Typically two to five weeks, depending on scope. That is the range my published website case studies took, from a small service site to a store or a booking platform. Late text, photos or product data hold up more projects than code does, so I send a content list on the first day. Your quote carries a delivery date for your own scope. Q: Should a company website be built on WordPress or Laravel? A: WordPress fits when the site is mostly pages and articles that your staff will edit often, or a store with a standard catalog and checkout through WooCommerce. Laravel fits when the site has logic of its own, such as search by dates and guests, customer accounts or unusual pricing. I recommend one in the quote and explain why. If a plugin already does the job well, I say so instead of selling custom code. Q: Can I update the website myself after launch? A: Yes, for everyday content. On WordPress you edit pages, posts and products in the standard editor. On a Laravel site I build an admin panel for your own content types, such as packages, rooms or courses. An Astro site keeps content in files, so edits go through a developer unless a content management system is added to the scope. A training session and written notes are part of every build. Q: Will a redesign hurt my Google rankings? A: It can if old addresses are dropped, so I plan for it. Before launch I list every indexed URL of the old site and map each one to its new page with a 301 redirect. Pages that already bring visitors keep their topic and title. After launch I submit the new sitemap in Google Search Console and watch for crawl errors. Some movement is normal, and where pages rank is Google's decision, not mine. Q: Do you provide hosting, a domain and business email? A: No. Hosting is not something I sell on this site. I help you pick a plan that suits the site's traffic and software, then create the domain, hosting and mailbox accounts under your own email address, with the bills going to you. One tie to declare: I am CTO at ElySpace, which is a hosting company. You will hear that from me whenever its name comes up, and any host that meets the technical requirements is fine. Q: Do you build websites for ski schools, ski resorts and tour operators? A: Yes. I designed and developed Kohwan, a ski and tour website for an operator in Gulmarg, Kashmir. It sells ski packages, a ski school from first lessons to private coaching, lift passes and equipment rental as add-ons to a trip, alongside tours, stays and transfers, and the team posts the daily gondola status and season dates itself. A ski website needs exactly that: one booking for the whole trip, and live season information your staff can update without a developer. More on travel sites: tour and travel website development. Q: What should I ask an e-commerce website developer before hiring? A: Ask four things. Who owns the payment gateway account? It should be your business. How is a paid order confirmed? It should be by the gateway's signed webhook, not by the thank-you page. Who can add products and change prices? You should be able to, without a developer. What happens to live orders during an update? Changes should be tested on a staging copy first. Those are my answers too. ## Tour and Travel Website Development for Tour Operators and Hotels URL: https://shahidmalla.com/tour-travel-website-development I am Shahid Malla, a freelance developer who builds booking websites for tour operators, travel agencies, DMCs, hotels, houseboats and homestays. Tour and travel website development with me gives you package pages with day-wise itineraries and seasonal prices, inquiries, deposits or full online payment, an admin panel your staff run, and a site in your name. - Live proof: Seven tour and travel sites and three hotel sites, each with a case study - Typical timeline: Two to five weeks, depending on scope; your date comes in the quote - Ownership: Domain, hosting and payment accounts in your name; source code handed over - Pricing: Fixed quote after a free scoping call, or $55-$65/hour - Pricing: Fixed quote per scope, or $55-$65/hour ## What does a tour and travel booking website need? It needs pages and rules that let a traveler pick a trip, see a clear price and commit without a phone call, plus an admin area where your staff keep it current. This is the checklist I scope against: Part | What it does | What you decide | Package pages | Day-wise itinerary, inclusions, exclusions, hotels by category and photos | Whether 4-night and 6-night versions share one page with a nights selector | Seasonal prices | Date ranges with their own rates, per person by room sharing, plus child rates | Who sets next year's seasons | Booking and payment | Inquiry, reserve, or book and pay, with deposits through Razorpay, Stripe or PayPal | The deposit rule, and the cancellation terms beside the button | Availability | Seats per departure, rooms per night, blocked dates for cabs and houseboats | Whether staff update it or another system sends it | WhatsApp | A button on every package that opens a chat with the package name already typed | Which number, and who answers it | Languages and currencies | Each language on its own URL with hreflang tags, and prices in the traveler's currency | Which currency the card is charged in, stated on the page | Reviews | Real reviews, each linked to its source, such as Google or Tripadvisor | How you ask for a review after each trip | Destination pages | One page per place, linking to the packages that visit it | Which places have enough to say to earn a page | Mobile speed | WebP images through srcset, lazy loading below the first screen, no autoplay video | Which photos load first | ## Which travel and hotel booking sites have I built? These ten sites are live. Each name opens a case study that links to the site, so you can try the booking flow on your own phone. Site | Business | Feature worth copying | Kohwan | Ski and tour operator, Gulmarg | Pay online with instant confirmation, or reserve and settle later; lessons, lift passes and rentals as add-ons | Shateeta Tour and Travel | Tours, hotels and houseboats, Kashmir | Search by destination, date and travelers, and a pay-at-property option | Kashmir Flow | Tours, hotels and car hire, Kashmir | Currency and language switching, WhatsApp and live chat | Himalayan Booking | Tours in Kashmir, Ladakh and Himachal | One search across three regions, with rooms, adults and children | Wander Crew Holidays | Tours and cabs, Kashmir | A four-field booking request: name, phone, arrival date and travelers | Adventure Quest Holidays | Honeymoon, family and adventure tours | Change-of-plan terms beside the booking options | 72 Holidays | Themed packages, Jammu and Kashmir | A lead form with group size and arrival date for a call-back quote | Hotel Green Karnataka | Hotel, Srinagar | Room pages and a time-limited offer banner for direct bookings | Yashobhoomi Grand | Hotel, New Delhi | Nightly rate and guest capacity per room, and guest accounts | Hôtel Spa Le Suisse | Boutique spa hotel, Quebec | Thermal time blocks, massage and add-on packages with a stay | Most of these clients are in Kashmir, where I live, and the work runs remotely for operators anywhere. A business in the valley that would rather meet in person can read web designer in Kashmir. ## Should travelers send an inquiry, reserve, or book and pay at once? That depends on how fixed your prices and availability are. A trip priced per group needs an inquiry form; a package with set dates and a set price can take payment at once. - Inquiry. A few fields, sent from the package page. Suits tailor-made trips and DMCs quoting per group. - Reserve and pay later. The traveler holds the dates, then pays a deposit, the balance or at the property. Suits hotels, houseboats and groups who want to talk first. - Book and pay. Needs live availability, a final price and written cancellation rules. Suits fixed departures, day tours, lessons and rentals. A booking turns to paid only when the gateway's signed webhook arrives, such as Razorpay's order.paid, Stripe's checkout.session.completed or PayPal's PAYMENT.CAPTURE.COMPLETED, because travelers often close the tab before the thank-you page loads. Amounts are stored as whole minor units with a currency code, so a deposit and its balance always add up to the trip price. ## Should I build on WordPress with a booking plugin, or go custom? WordPress with a booking plugin is the cheaper route when your packages fit the plugin's model. A custom build pays off when your pricing rules or your mix of tours, rooms and vehicles do not. Question | WordPress and a booking plugin | Custom build in Laravel | Fits when | Fixed prices per person, a standard date picker and one currency | Room-sharing and child rates, seasons, add-ons, several inventory types or currencies | Running cost | Yearly plugin licenses, and updates that can clash | Hosting, and a developer for structural changes | Limit | Whatever the plugin's authors decided | A longer build before launch | The sites above run on Laravel, because each had a rule a plugin handled poorly. If a plugin covers your trips, the quote will say so. Web design and development compares Laravel, WordPress and Astro for other business sites. ## What can my staff change without a developer? Everything that changes with the season: packages, itineraries, rates, photos, offers, blocked dates and articles. On Kohwan, the operator's team keeps the season dates and the daily gondola status current through the ski season without a developer. A new product type, a new pricing rule or a new payment method is a change to the code, and I quote it as one. ## Can the website connect to WhatsApp, a CRM or a channel manager? Yes, if the other system can send or receive data. The simplest connection needs no API: a https://wa.me/ link with your number in international format and a ?text= parameter naming the package. - WhatsApp Business. When chats must be stored with the lead, I use Meta's official WhatsApp Cloud API. Outside the 24-hour window after a traveler's last message, replies must use templates Meta has approved. - CRM. Inquiries and bookings go to your CRM through its API. If your team still quotes from spreadsheets, a travel CRM can take over itineraries, quotes and supplier payments. - Channel managers and booking engines. I can connect one if the provider has an API your account may use. If not, the Book Now button hands over to its booking page. I read the provider's API documentation before I promise a connection. ## Can an AI assistant answer travelers on the site and on WhatsApp? Yes, for questions your pages already answer: what a package includes, which months suit a trip, the cancellation terms. It collects dates, group size and interests, then hands over to a person. It should not invent prices, confirm availability it cannot see or take payment. Disclosure: MagizAI is my own product, and I am its founder and CEO. It answers on websites and on WhatsApp through Meta's official WhatsApp Cloud API, in the visitor's language, and a person on your team can take over any chat. An assistant tied to your own booking data is a custom build under AI chatbot development. ## How do destination and package pages get found on Google? Each destination and package gets its own URL, its own title and enough original text to stand alone. Where a page ranks is Google's decision, and I do not promise positions. - Destination pages link to the packages that visit them, and packages link back. - Twenty packages with the same itinerary text read as near-duplicates, so each needs its own route and days, or the variants share one page. - Structured data such as TravelAgency or LodgingBusiness, a sitemap.xml submitted in Google Search Console, and 301 redirects from old URLs, as the website redesign guide explains. - Google does not show review stars for reviews a business publishes about itself, so reviews are there for travelers, not for search. Before launch I load each package page over a throttled mobile connection, then on a real phone. ## Who owns the domain, hosting and code? You hold every account, and the code is handed to you. - The domain, hosting, business email and payment gateway accounts are registered in your company's name. - You receive the full source code at handover, in a Git repository under your own account if you have one. - The quote says in writing who holds the rights to the custom code. - Search Console and analytics sit in your own Google account. If we stop working together, the site stays online for as long as you renew the hosting and the domain. ## What will I not build into a travel website? I will not build anything that misleads travelers or puts your accounts at risk. - No invented reviews, and no "only 2 seats left" notices that are not tied to real availability. - No itineraries, photos or text copied from another operator. - No rates or availability scraped from booking sites. - No card numbers stored on your server. Card data stays with the gateway. - No template installs sold as a website. Every project is designed and built against a written scope. ## What does tour and travel website development cost? The quote comes after a free scoping call, once the booking mode, the number of tours, rooms or vehicles you sell and the connections are written down. Each project is a fixed quote for a written scope, or $55 to $65 per hour. The price follows the booking mode, how many kinds of things you sell, the languages and currencies, the payment gateways and any connection to a CRM or booking system. Domain, hosting and gateway fees are billed to you by those companies. What a web designer costs explains how website prices are built. A free scoping call of about 30 minutes comes first, and the written quote with a delivery date follows within one business day. Two weeks of support follow launch, and the full terms are on how I work. Q: How much does a tour and travel booking website cost? A: I quote a fixed price for a written scope after a free scoping call, or bill $55 to $65 per hour. The price moves with the booking mode (an inquiry form is less work than instant booking with live availability), the number of things you sell, such as tours, hotels, cabs and houseboats, extra languages and currencies, and connections to a CRM or booking system. Domain, hosting and gateway fees are paid by you to those providers. The scoping call is free, and the quote arrives within one business day. Q: Can guests pay online, pay a deposit or pay at the property? A: Yes, and one site can offer all three. On Kohwan a trip can be booked and paid online with instant confirmation, or reserved and settled with the team later, and Shateeta Tour and Travel lets guests pay at the property. A deposit can be a percentage or a fixed amount per package, with a payment link for the balance. Razorpay covers UPI, cards and net banking in India, and Stripe or PayPal cover cards from abroad. The gateway account is opened in your business name. Q: Can I add tour packages, seasonal prices, hotels, cabs and houseboats myself? A: Yes. The admin panel is built around what you sell, so your staff add a package with its day-wise itinerary, set season date ranges with their own rates, upload photos and block sold-out dates without a developer. Hotels, rooms, cabs and houseboats get screens of their own if you sell them. A training call and written notes come with the handover. A new kind of product or a new pricing rule is a code change, and I quote it separately. Q: Should I use WordPress with a booking plugin or a custom build? A: Use WordPress with a booking plugin when your tours have fixed prices per person, one currency and a simple date picker, and your staff already know WordPress. It costs less to build, though plugin licenses renew every year and updates need care. Choose a custom build when prices depend on room sharing, child rates, seasons or add-ons, or when tours, hotels and cabs share one search. I recommend one in the quote and give the reason. Q: Can the site link to WhatsApp, my CRM or an existing booking platform? A: Yes. Every package can open WhatsApp with its name already typed, and chats can be stored with the lead through Meta's official WhatsApp Cloud API. Inquiries and bookings can be sent to your CRM through its API, or into a travel CRM built for your company. A channel manager or an outside booking system can be connected if the provider has an API your account may use. If it does not, the Book Now button hands over to its booking page. Q: How long does it take, and do I own the code and the domain? A: A booking website typically takes two to five weeks, depending on scope, and the booking sites on this page that state a duration took three or four weeks each. Your quote gives the date. The domain, hosting and payment accounts are registered in your name from the start, you receive the full source code at handover, and the quote states in writing who holds the rights to the custom code. If we stop working together, the site stays yours. ## Custom CRM Development: Hire a CRM Developer URL: https://shahidmalla.com/crm-development I am Shahid Malla, a freelance CRM developer. Custom CRM development with me means a Laravel system shaped around your own sales and delivery process: lead pipeline, quotes or itineraries, payments, supplier ledgers, roles and reports. It suits businesses that an off-the-shelf CRM does not fit, and the data stays on your own server. - Built with: Laravel and MySQL, with an admin area for your team - Fastest route: A standard scope in 7 days as a fixed-price build (see the 7-day custom CRM) - Your existing data: Imported from spreadsheets or an old CRM after a rehearsal in staging - Hosting and data: A server in your name; code rights agreed in the quote - Pricing: Fixed quote per scope, or $55-$65/hour ## When is custom CRM development worth it over HubSpot or Zoho? It is worth it when your business needs records and rules that a ready-made CRM does not model, and your staff have started keeping the real data somewhere else. For a plain process of contacts, deals and follow-ups, configuring a ready-made CRM such as HubSpot or Zoho is quicker and cheaper, and I will say so on the scoping call. Two CRM builds of mine show the range. JK Tour CRM is a travel CRM for tour operators, a product of ElySpace, where I am CTO. For Marmaids LLC, where I work as a freelance developer, I built a CRM together with the API, the Android and iOS apps and the WHMCS module around it, so staff, customers and billing work from the same records. Question | Configure a ready-made CRM | Build a custom CRM | Fit to your process | You work with its objects: contacts, companies, deals. Custom fields stretch them a long way. | Records match the business: bookings, itineraries, supplier payables, job costs. | Time to first use | Short. | Longer. A written scope comes first. | Cost pattern | A subscription, often per user, that grows with the team. | A build cost, then hosting and upkeep. No per-user fee. | Upkeep | The vendor patches it and adds features. | Yours to arrange, through a developer. | Data and exit | Held by the vendor. You leave with what its export offers. | A MySQL database on your server. | Buy when the standard pipeline fits, when you must start this month, or when nobody on your side will own the upkeep. Build when the side spreadsheet has become the real system. ## What should the first version of a custom CRM contain? The first version should contain the one path that earns money: a lead arrives, receives a quote, pays, and the job is delivered. Everything else waits until staff have used that path on real customers. Module | In version one | Waits | Lead pipeline | Stages, an owner, a next follow-up date, activity history and a reason when a lead is lost. | Lead scoring, automatic assignment. | Quotes or itineraries | One template with line items and taxes, a PDF or share link, numbered revisions. | A visual template designer. | Payments | A payment link, deposit and balance, a receipt once the gateway confirms. | Installment plans, extra currencies. | Supplier or partner ledger | What is owed per booking or job, what has been paid, the balance per supplier. | A login for suppliers. | Reports | Pipeline value, conversion by lead source, receivables and payables. | Chart dashboards. | Money is stored as whole minor units (cents or paise) with a currency code, never as floating-point numbers, so the ledger and the reports agree. ## How do you import data from spreadsheets or an old CRM? I rehearse the import in staging first, and you approve a written report before anything reaches the live system. - Export each sheet or table as UTF-8 CSV and agree a column mapping. - Normalize values: phone numbers to E.164 form such as +14155550123, emails to lower case, dates to one format, because 03/04/2026 is March in one country and April in another. - Merge duplicates, matched by phone and email, under a rule you approve. - Keep each old identifier in a legacy_id column, so the import can run again without creating second copies. - Reconcile row counts and money totals against the source, and list each rejected row with its reason. Free-text notes, attachments and old email threads cost the most to move, so we decide per type what to import and what to archive. ## How do roles, permissions and the audit trail work? Every user has a role, every record has an owner, and every change is written to a log that ordinary users cannot edit. In Laravel the rules live in policy classes, so one check guards the screen, the export button and the API alike. - Roles. Owner, manager, sales agent and accounts to start. Agents see their own leads, and the accounts role sees payments without being able to change a quote. - Export and delete. Separate permissions, because a full export is how a customer list leaves with a departing employee. - Audit trail. Who changed which field, the old and new values and the time. Records are soft-deleted, meaning flagged with a deleted_at date, so a mistake can be reversed. ## Which tools can a custom CRM connect to? It can connect to anything with a documented API, and the three I wire in most are WhatsApp, email and payment gateways. - WhatsApp. The official WhatsApp Cloud API. Incoming messages arrive by webhook and attach to the customer record. Outside the 24-hour window after a customer's last message, outgoing messages use templates that Meta has approved. - Email. Sent from your own domain with SPF and DKIM records set, and logged on the customer's timeline. - Payments. Stripe, PayPal or Razorpay. An invoice turns to paid only when a signed webhook arrives, such as Stripe's checkout.session.completed or Razorpay's payment_link.paid. ElyAgents, my own multi-tenant business software, connects to the WhatsApp Cloud API, Stripe, Razorpay and Meta Lead Ads. When the job is mainly moving data between tools you already have, see automation development. ## Where does an AI assistant help inside a CRM, and where should it not act alone? It helps with drafting and summarizing, and it should not send, price or record payments on its own. - Useful: drafting a quote or itinerary from the lead's notes, summarizing a long chat thread, turning a pasted inquiry into structured fields. - Not alone: sending a proposal, changing a price or discount, marking money as received, merging or deleting records, messaging many customers at once. In JK Tour CRM (an ElySpace product I built as its CTO) the assistant drafts the itinerary, and a staff member edits and sends it. It runs on the customer's own API key, so the provider bills model usage to them. For an assistant that calls tools under rules, see AI agent development. ## Can you build a CRM for a travel agency? Yes. Travel CRMs have their own page: travel CRM development covers itineraries, supplier rates, vouchers and payments, with JK Tour CRM, a product of ElySpace where I am CTO, as the example I built. ## Where is the CRM hosted, and who owns the code and the data? It runs on a server in your name, and the database on it is yours. - The quote says in writing who holds the rights to the custom code. - You receive the repository at handover, with deployment and restore steps. - Gateway, WhatsApp and mail accounts are opened in your company's name. - A nightly mysqldump is copied off the server, and one restore is tested before go-live. - Every main table exports to CSV, so leaving stays possible. Staff who work away from a desk can later get a mobile app on the same API. ## What will I not build into a CRM? I will not build anything that puts customer data or payment accounts at risk, or rebuild a product you could simply buy. - No import of scraped or purchased contact lists, and no bulk messages to people who have not opted in. - No card numbers in the CRM. Card data stays with the payment gateway. - No clone of another vendor's product and no pirated scripts. - No replacement for accounting software. The ledger tracks what is owed and paid, and your books stay where they are. - No legal sign-off. I build consent fields, export and deletion tools, and your adviser decides the privacy policy. ## What does a custom CRM cost, and how do we start? The price is a fixed quote for a written scope, or $55 to $65 per hour. It follows the number of record types, roles and integrations, and the state of the data to import. We start with a free scoping call of about 30 minutes, and the written quote reaches you within one business day. I build in a staging copy, and two weeks of support follow delivery. See how I work. A CRM you plan to sell to other businesses by subscription is SaaS development. Q: Is a custom CRM better than HubSpot or Zoho? A: Not by default. A ready-made CRM such as HubSpot or Zoho is the better choice when your sales process is a standard pipeline, the team is small and you need to start this month. A custom CRM earns its cost when you sell something the ready-made tool models poorly, such as itineraries, supplier payables or per-job costing, and staff already keep the real data in a side spreadsheet. On the scoping call I tell you plainly if buying is the better route. Q: How long does it take to build a custom CRM? A: A standard CRM with one pipeline, contacts, tasks, quotes, roles and one data import can be delivered in 7 days through my 7-day custom CRM, because it starts from my own tested CRM base and AI coding agents. Larger systems with messy import data, extra departments, a supplier ledger or outside integrations are planned in phases, and each phase gets a date once its scope is written down. Q: Can you import my customer data from Excel or another CRM? A: Yes. I take a CSV export of each sheet or table, map the columns with you, normalize phone numbers, emails and dates, and merge duplicates by a rule you approve. The import is rehearsed in staging first, and you get a report of rows imported, merged and rejected. Money totals are reconciled against the source before the final run on the live system. Q: Can a custom CRM send and receive WhatsApp messages? A: Yes, through the official WhatsApp Cloud API. Incoming messages arrive by webhook and are stored on the customer record, and staff reply from inside the CRM. Outside the 24-hour window after a customer's last message, outgoing messages must use templates that Meta has approved, and customers need to have opted in. The WhatsApp Business account and number stay in your company's name, and Meta bills its message fees to you. Q: Do you build CRM software for travel agencies and tour operators? A: Yes. I built JK Tour CRM, a travel CRM that is a product of ElySpace, where I am CTO. My travel CRM development page covers what such a CRM includes and how a build for your agency is scoped. Q: Who owns the CRM code and the customer data? A: The quote says in writing who holds the rights to the custom code, and that is settled before any work begins. Open-source packages keep their own licenses. You receive the repository at handover. The database runs on a server in your name, and the payment, WhatsApp and mail accounts are opened by your company, so the customer records and the credentials stay with you if you change developers. Q: What does custom CRM development cost? A: I give a fixed quote for a written scope, or bill $55 to $65 per hour. The price follows the number of record types, roles, reports and integrations, and how clean the data to import is. Hosting, domain, payment gateway and WhatsApp message fees are charged to you directly by those companies. The scoping call of about 30 minutes is free, and the written quote arrives within one business day. ## Custom CRM in 7 Days: Built, Tested and Handed Over URL: https://shahidmalla.com/custom-crm-in-7-days I am Shahid Malla, a freelance CRM developer with 13+ years of experience. I deliver a custom CRM in 7 days: your pipeline, records, roles and reports, built on CRM modules I have refined over years of projects, sped up with AI coding agents, and tested against a checklist you approve before you pay the balance. - Delivery: 7 calendar days, counted from the day the scope is signed and access is in place - Built on: My own Laravel CRM base, extended with Claude Code and Codex under my review - Testing: Automated tests for every module and a written acceptance checklist - Payment: The balance is paid only after the checklist passes - Pricing: Fixed quote for the 7-day scope, or $55-$65/hour for extras ## How can a custom CRM be ready in 7 days? A custom CRM is ready in 7 days because most of it already exists before your project starts. The slow parts of a CRM are the same in every business: login and roles, an audit trail, a pipeline board, tasks and reminders, an import tool that does not corrupt data, PDF documents and payment webhooks. I have built those for CRM, SaaS and WHMCS projects over 13+ years and keep them as one tested Laravel base. Two more things close the gap. AI coding agents, mainly Claude Code and OpenAI Codex, write the code that is specific to you: your fields, stages, rules and reports. I plan each task, review every change before it is merged and reject what does not meet my standard. And the tests are automated, so checking that a change did not break another module takes minutes instead of a day of clicking. The effect on timelines is large. Work I planned as a six-month build before AI agents now ships in about 7 days when it sits on modules I already have, and a roadmap I once quoted as a year of work takes about 15 days. Your decisions do not speed up the same way, which is why the 7 days start only after the scope is signed. ## What is included in the 7-day CRM? The 7-day CRM covers the modules a sales and service team uses every day, shaped to your names, fields and rules. Module | What your team gets | Typical change for your business | Contacts and companies | Records with custom fields, notes, files and a timeline of every call, email and change | Fields such as travel dates, server plan, treatment type or contract end date | Pipeline | A board of deals or jobs by stage, with owners and follow-up dates | Your own stages, and rules such as "a deal cannot be won without a signed quote" | Tasks | Tasks per user or team, reminders by email, an overdue list for managers | Automatic tasks when a deal reaches a stage | Quotes and payments | PDF quotes or invoices with your branding and a payment link | Your line items, taxes and currencies; Stripe, PayPal or Razorpay | Roles | Admin, manager and user roles, record-level rules, an audit log | "Sales sees only its own deals; accounts sees every invoice" | Import | One spreadsheet or CRM export, cleaned, de-duplicated and reconciled | Your column mapping and merge rule | Dashboard | The weekly numbers you named on the scoping call | Pipeline value by stage, won this month, overdue follow-ups | ## What does not fit in 7 days? Anything that depends on other people's approval or on data that needs weeks of cleaning does not fit in 7 days, and I say so before you sign. These go into a written phase 2 with its own date: - Migrating several years of data from an old CRM whose records contradict each other - Integrations with accounting, ERP or industry systems that have no documented API - WhatsApp messaging, because Meta must approve the business account and message templates - Native Android and iOS apps; the 7-day CRM works in a phone browser, and a store app is a separate mobile app project - Formal compliance work, such as an external audit for health or financial data - A second department with a different process, such as support tickets or warehouse stock Phase 2 work runs on the same base, so it moves just as fast once the outside approvals or the cleaned data arrive. ## What does the 7-day guarantee mean in practice? The guarantee means the date, the testing and your money are tied together in writing. The quote names the delivery date: 7 calendar days after the scope is signed and access is in place. Before handover, every line of the acceptance checklist you approved must pass on staging, in front of you or your staff. You pay the balance only after that, and if I run late for a reason on my side, the extra days are on me. It does not cover delays caused by missing access, unanswered questions or new features added after sign-off; those move the date or join phase 2, and I tell you the effect on the day it happens. After launch, defects in the agreed scope are fixed free for two weeks. Ongoing changes are billed at $55 to $65 per hour or as a small fixed quote. ## How do you test a CRM that was built in a week? Speed comes from automation, so testing is automated too. Every module carries feature tests written in Pest, the Laravel testing framework, and they run on each change before it reaches staging. They cover the things that hurt when they break: a user seeing records outside their role, a deal moving to a stage it should not reach, quote totals and taxes, the payment webhook marking an invoice paid, and the import rejecting bad rows instead of saving them. The second layer is human. Your acceptance checklist is written in plain language, one behavior per line, and you or your staff tick it on staging with your own data sample. Payments run in the provider's sandbox until the last day. Nothing goes to production until both layers pass. ## Is it cheaper than paying for HubSpot, Zoho or Pipedrive? It is cheaper over time when your team is growing or your process does not fit, and more expensive when you only need a standard pipeline for two people. Compare the two on these points before deciding: Question | Hosted CRM subscription | 7-day custom CRM | Cost model | Monthly fee per user, rising with each hire and plan tier | One fixed build price, then your own hosting | Fit to your process | Your process bends to the tool's objects | The tool follows your stages, fields and rules | Where the data lives | The vendor's servers | A server in your company's name | Time to start | Same day | 7 days after scope sign-off | Changes later | Limited to the settings the vendor offers | Any change, by me or another Laravel developer | If a hosted CRM fits, I will tell you to buy it. If you need a larger system with several departments, the full custom CRM development service plans it in phases, and the same speed applies to each phase. ## How do I hire you for a 7-day CRM? You hire me directly and work with me personally from the scoping call to the handover; no account manager or junior developer sits in between. Send a brief through the project form, book a call, email me, or hire me on Fiverr or Upwork if you prefer a marketplace's payment protection. Every option is listed at the bottom of this page. I also use the same AI-assisted way of working for SaaS products and workflow automation. Disclosure: the CRM base and the AI-assisted method are my own way of working. I am not affiliated with Anthropic, OpenAI, HubSpot, Zoho or Pipedrive. Q: Can a custom CRM really be built in 7 days? A: Yes, for a defined scope. I do not start from an empty folder. Login, roles, audit log, pipeline, tasks, import tools, PDF quotes and payment webhooks already exist in my own CRM base, built and reused over 13+ years of projects. AI coding agents then write the parts specific to your business while I review every change, and automated tests check each module. What does not fit in 7 days goes into a written phase 2. Q: What exactly does the 7-day guarantee cover? A: Three things. The delivery date, 7 calendar days after the scope is signed and access is ready, is written into the quote. Every item on the acceptance checklist you approve has to pass before handover. And you pay the balance only after it passes; if the date slips for a reason on my side, I keep working at my own cost until it does. Defects in the agreed scope are fixed free for two weeks after launch. Delays caused by missing access or answers, and features added after sign-off, move the date or go to phase 2. Q: What do I need to provide before the 7 days start? A: A person who can answer questions within a few hours during the week, a sample of your current data (a spreadsheet export is fine), your logo, the reports you look at every week, and a hosting account or VPS in your company's name. If you take payments, the Stripe, PayPal or Razorpay account must be verified by the provider before Day 4, because their checks are outside my control. Q: How is a CRM built this fast tested? A: Each module ships with automated feature tests that run on every change: permissions, pipeline moves, quote totals, payment webhooks and the import. On top of that you get a written acceptance checklist in plain language, such as "a sales user cannot see another team's deals", and you or your staff tick each line on staging. Payments are tested in the provider's sandbox before live keys go in. Q: Is a 7-day custom CRM better than HubSpot, Zoho or Pipedrive? A: Not always. If your process is a standard sales pipeline and a monthly per-user fee suits you, a hosted CRM is quicker still and needs no developer. The 7-day build makes sense when your process does not fit those tools, when per-seat fees grow with every hire, or when customer data must stay on a server you control. On the scoping call I tell you plainly if buying is the better route. Q: What happens after day 7? A: Your team starts using the CRM on day 7, and two weeks of support cover any defect in the agreed scope. Phase 2 items from the scope, such as an accounting integration or WhatsApp messaging, get their own fixed quote and date. If you expect a steady flow of changes, the monthly developer retainer keeps me available without a new quote for each request. Q: Who owns the CRM code and data? A: The CRM runs on a server in your company's name, and the database, payment accounts and email sending accounts belong to you. You receive the repository at handover. The quote states the license for the code: the parts written for you, and my reusable base, which you may use and change for your own business without a time limit. Q: How do I hire you for a 7-day CRM? A: Directly, with no sales team in between. Send a short brief through the project form, book a call at a time that suits you, or email me. If you prefer the protection of a marketplace, you can also hire me on Fiverr or Upwork for the same work. All the options are at the bottom of this page, and I reply within one business day. ## Business Automation Development: Connect the Tools You Already Use URL: https://shahidmalla.com/automation-development I am Shahid Malla, a workflow automation developer. I build rule-based automation that connects the tools your business already uses, through webhooks, APIs, scheduled jobs and queues, in n8n or in custom code. It suits teams that copy data between systems by hand, and every workflow ships with logging, retries and alerts. - Triggers: Webhooks, API polling, schedules and queues - Built in: n8n where it fits, custom Laravel or Node.js code where it does not - Failure handling: Idempotency keys, retries with backoff, a dead-letter list and alerts - Money movements: Prepared by the workflow, approved by a person - Pricing: Fixed quote per scope, or $55-$65/hour ## What does business automation development cover? It covers building rule-based workflows that move data between the tools your business already uses, so that nobody copies it by hand. Each workflow has a trigger (an event, a schedule or a new record), a fixed list of steps and a defined behavior for when a step fails. The same input gives the same result every time. If a task needs a language model to read text and decide what to do next, you need AI agent development instead. If the system in the middle is WHMCS, its hooks and API commands are covered under WHMCS API integration and automation. ## Which processes are worth automating, and which are not? A process is worth automating when it happens often, follows rules you can write down and starts from data that is already digital. It is not worth it when it is rare, still changing or needs a judgment call each time. Process | Automate? | Reason | Copying paid orders or invoices into accounting | Yes | Frequent, rule-based, and a typing mistake costs money. | Web form or ad lead into the CRM, with an owner assigned | Yes | Response speed matters and the rules are simple. | Payment received: mark the booking paid, send the receipt, tell the team | Yes | A signed gateway webhook is a dependable trigger. | Nightly comparison of two systems | Yes, as a report | The job lists mismatches. A person decides each fix. | Refunds and supplier payouts | Prepare only | The workflow drafts the payment. A person approves it. | A task done twice a year | No | Upkeep costs more than the time saved. Keep a checklist. | A process that changes every few weeks | Not yet | Let it settle first, or you pay to rebuild it. | Replies to complaints | No | They need judgment and tone. | Automating a broken process only produces the wrong result faster, so the manual steps get fixed first. ## Should I use a workflow tool such as n8n, or custom code? Use a workflow tool when the apps involved have ready connectors and the volume is modest, and custom code when the workflow needs database transactions, high volume, complex branching or automated tests. Many projects mix the two. Criterion | Workflow tool (n8n, Zapier, Make) | Custom code (Laravel or Node.js) | First working version | Fast, where connectors exist. | Slower. Each connection is written. | Who can change it | A trained staff member, for simple edits. | A developer. | Error handling | Has to be added to each workflow, and is easy to skip. | Designed in: queues, retries and a failed-jobs table. | Running cost | Hosted plans are usually priced by usage, so busy workflows cost more. | A fixed server cost. | History and tests | Limited. Where the tool exports workflows as files, I keep them in Git. | Full Git history, automated tests and review. | Where data passes | Through the vendor's cloud, unless the tool is self-hosted. | Only through your server. | Self-hosting n8n keeps data on your server but makes patching and backups your job. In n8n I attach an error workflow to every workflow, so a failed run is reported, not left unnoticed. ## How are failures handled so nothing is lost or sent twice? Every workflow I build assumes that any step can fail, run twice or arrive late, and it handles all three. Four mechanisms do the work. - Idempotency. A repeated event must do no harm. Every event gets a unique key, stored under a unique index. A repeated key is acknowledged and skipped, so a webhook delivered twice does not create two invoices. Where the receiving API accepts an Idempotency-Key header, I send one. - Retries with backoff. A timeout, a 429 or a 503 is retried after a growing delay, and a Retry-After header is respected. A 400 or 422 is not retried, because the same bad data fails again. - A dead-letter list. After the last attempt the item moves to a list of failed items, with its payload and the error. Once the cause is fixed it is replayed, in Laravel with php artisan queue:retry. - Alerts. A failure, a growing backlog or a scheduled job that did not run sends a message by email, Slack or Telegram. A nightly job checks in when it finishes, and a missed check-in raises the alert. The webhook receiver itself does little: it verifies the signature, stores the event, answers with a 2xx status and passes the work to a queue. ## How are API keys and access kept secure? Each connection gets its own credential with the narrowest permissions the workflow needs, kept outside the code. This is least privilege: a workflow that only reads orders cannot delete them. - A separate key per workflow, so one can be revoked without stopping the others. - Read-only scopes wherever the workflow only reads. No owner or admin tokens. - Secrets in environment variables or the tool's encrypted credential store, never in a workflow export, a spreadsheet or a repository. - Inbound webhooks checked by HMAC signature, with stale timestamps rejected to block replays. - Logs that keep IDs and statuses, not full payloads of personal data, and expire after a period you choose. ## What automation work have I delivered? Three projects in my portfolio show the range, from messaging and lead integrations to billing and payments. - ElyAgents. My own product, multi-tenant business software, for which I built the integrations: two-way customer chat on the official WhatsApp Cloud API, Stripe and Razorpay payments, Meta Lead Ads for incoming leads, Zoom for meetings and Google Forms for intake. - CloudByteHost. WHMCS automation for a US hosting company with several cPanel servers: a custom provisioning module, automated plan changes and billing reconciliation between WHMCS and the servers. - JK Tour CRM (a product of ElySpace, where I am CTO). Payments through Stripe, PayPal or Razorpay and a supplier ledger, so one booking runs from lead to payment to supplier settlement without retyping. When the missing piece is the system of record itself, see CRM development. ## Who monitors and owns the automation after handover? You own it, and I write the runbook so that someone other than me can operate it. The workflow tool, the server and every API app are registered in your company's name. - A searchable run log shows each run, its result and its duration. - Alerts go to a named person on your team, not only to me. - The runbook explains how to pause a workflow, replay a failed item, rotate a key and add a step. APIs change, and providers retire old versions. After the two weeks of support, someone has to watch for that and check the dead-letter list: your team, or me under a separate agreement. ## What will I not automate? I will not automate anything that breaks another party's terms, messages people who did not ask, or moves money without a person's approval. - No scraping of a site whose terms forbid automated access, and no bots that get around a login or CAPTCHA. - No bulk unsolicited messages by WhatsApp, SMS or email. Messaging goes to people who opted in, through official APIs. - No workflow that pays, refunds or transfers money on its own. It prepares the payment, and a person approves it. - No promise that nothing ever fails. Other companies' APIs go down. What I build makes each failure visible and recoverable. ## How much does it cost to hire a workflow automation developer? I quote a fixed price for a written scope, or bill $55 to $65 per hour. One workflow between two systems with clean APIs is the small end, and each extra system, two-way sync or approval screen adds to it. We start with a free scoping call of about 30 minutes, the written quote follows within one business day, and I build in a staging copy against sandbox accounts. The terms are on how I work. If the workflows are turning into a product with its own users and billing, that is SaaS development. Q: What is the difference between workflow automation and an AI agent? A: Workflow automation follows fixed rules: when this event happens, run these steps, the same way every time. An AI agent uses a language model to decide which step comes next, which suits work that needs reading and judgment, such as answering a support ticket. Most copying between systems needs rules, not a model. Where a single step needs judgment, such as sorting an incoming email, I can put a model in that step only and keep the rest rule-based. Q: Should I use n8n, Zapier or Make, or have custom code written? A: A workflow tool such as n8n, Zapier or Make fits when the apps involved have ready connectors, the volume is modest and someone on your team wants to adjust simple steps. Custom code fits when the workflow touches money-related records, needs database transactions, runs at high volume or must be covered by automated tests. I often combine them: the tool receives the event and a small service does the part that must not go wrong. Q: What happens when an automation fails? A: The failed item is retried after a growing delay if the error looks temporary, such as a timeout. If it still fails, it moves to a dead-letter list together with its data and the error message, and an alert goes to a named person by email, Slack or Telegram. Nothing is dropped silently. Once the cause is fixed the item is replayed, and duplicate protection stops it from being applied twice. Q: Can you take over automations that someone else built? A: Yes, as a defined piece of work. I first read every workflow and write down what it does, which credentials it uses and where it can fail without anyone noticing. You then get a short list: keep as it is, add error handling, or rebuild. I work on a copy wherever the tool allows it. I do not continue workflows that scrape sites against their terms or send unsolicited bulk messages. Q: Can you automate WhatsApp messages for my business? A: Yes, on the official WhatsApp Cloud API and to people who have opted in. Order confirmations, payment receipts, reminders and keyword-triggered replies are typical. Messages your business starts must use templates approved by Meta, and free-text replies are allowed inside the 24-hour window after the customer's last message. I do not use unofficial libraries that drive a personal WhatsApp account, and I do not build unsolicited bulk sending. Q: Is it safe to give an automation access to my accounts? A: Yes, provided the access is kept narrow. Each connection gets its own API key or token, limited to the permissions that one workflow needs and read-only wherever it only reads. Keys live in environment variables or the workflow tool's encrypted credential store, never in a spreadsheet or a repository. You receive a list of every credential, what it can do and how to rotate it, so any of them can be withdrawn without stopping the rest. Q: What does business automation development cost? A: I quote a fixed price for a written scope, or bill $55 to $65 per hour. One workflow between two systems with clean APIs is the small end. Each extra system, two-way sync or approval screen adds to it. Workflow tool subscriptions, server costs and API usage are charged to you directly by those companies. The scoping call takes about 30 minutes and is free, and the written quote follows within one business day. ## Travel CRM Development for Tour Operators, DMCs and Travel Agencies URL: https://shahidmalla.com/travel-crm-development I am Shahid Malla, a freelance CRM developer. Travel CRM development with me gives you a Laravel system built around how your company sells trips: leads from the website, WhatsApp and phone in one pipeline, day-wise itineraries, branded PDF quotes, supplier rates and payables, and payments. I built JK Tour CRM, a product of ElySpace, where I am CTO; its site is live at jktourcrm.com. - Built before: JK Tour CRM (an ElySpace product), built in 5 weeks in Laravel, live at jktourcrm.com - Timeline: Planned in phases; a first phase can fit the 7-day custom CRM scope - AI usage: Itinerary drafting runs on your own AI provider key, billed to you - Pricing: Fixed quote per phase after a free scoping call, or $55-$65/hour - Pricing: Fixed quote per phase, or $55-$65/hour ## When is travel CRM development worth it over a ready-made product? It is worth it when your quotes, rates or supplier payments follow rules that a ready-made product cannot model, and your staff keep the real numbers in a spreadsheet beside it. Ready-made tour operator and travel agency software is a serious option, and for many agencies it is the right one. Question | General CRM with custom fields | Ready-made tour operator or DMC software | Custom travel CRM | Itineraries and quotes | Not built in; usually a document template | Built in, in the product's format | Built around your own days, hotels and quote layout | Supplier rates and markups | A spreadsheet on the side | Built in, within the product's rate model | Your seasons, meal plans and markup rules | Time to first use | Short | Short, plus loading your rates | Longer; a written scope comes first | Cost pattern | A subscription, often per user | A subscription, often per user | A build cost, then hosting and upkeep | Data and exit | Held by the vendor | Held by the vendor | A MySQL database on your server | Upkeep | The vendor | The vendor | Yours to arrange, through a developer | Buy when the product's quote format and rate model match how you sell, or when nobody on your side will own the upkeep. Build when the side spreadsheet holds your margins, or when the CRM has to sit behind your own booking website. For a CRM outside travel, see CRM development. ## What does a travel CRM do from first inquiry to supplier payment? It follows one booking through every stage, so nobody retypes the same trip into a second tool. Stage | What the CRM records | Inquiry | The source (website, WhatsApp, phone or partner agent), travel dates, group size, interests, an owner and a follow-up date | Itinerary | A day-wise plan built from your saved days, hotels, transfers and activities | Quote | The cost from supplier rates, your markup, the selling price and a branded PDF or share link with a revision number | Confirmation | The deposit received, suppliers booked and vouchers issued for hotels, drivers and activities | Departure | The trip on a departures calendar, with the guide, the driver and the rooming list | Settlement | The balance collected, each supplier paid and the booking's margin closed | Payments run through Stripe, PayPal or Razorpay, and a payment counts only once the gateway's signed webhook arrives. Money is stored as whole minor units with a currency code, and the exchange rate used is saved on each quote, so a margin worked out in March still matches in June. ## How does the itinerary builder turn supplier rates into a quote? Staff assemble the trip from saved days and services, and the CRM prices each line from the supplier's rate for those dates, adds your markup and shows the margin before anything is sent. - Hotels and houseboats. A rate per room per night by season and meal plan, in the codes your suppliers already quote: EP (room only), CP (with breakfast), MAP (breakfast and dinner) or AP (all meals). Single, twin and triple occupancy, extra beds and child rates are separate lines. - Transport. A rate per vehicle type, per day or per route. - Activities and guides. A rate per person or per group. - Markups. A percentage or a fixed amount per supplier type, season or partner agent, with net rates visible only to the roles you choose. The quote renders from an HTML template to a PDF with your logo, colors, inclusions, exclusions and payment terms. Each revision gets a number, and the accepted version is locked, so the vouchers and the ledger work from the same figures. ## How are vouchers and supplier payments tracked? Each confirmed service produces a voucher for that supplier, and the same line becomes an amount owed in the supplier ledger. - A PDF voucher per hotel, driver or activity provider, with the guest names, the dates and the service booked. - A ledger per supplier: what is owed, what was paid with its date and reference, and the balance. - A payables list sorted by due date, so the accounts role sees what to pay this week. - A margin report per booking: selling price, supplier cost and the difference. The ledger tracks what is owed and paid. Your accounting software keeps the books, and tax filing stays with your accountant. ## How do WhatsApp, website and phone leads reach one pipeline? Each channel writes to the same lead table, tagged with its source, and duplicates are merged by phone number. - Website. The inquiry form on your booking site posts the lead to the CRM's API, with the package the visitor was looking at. A tour and travel website can be built to do this from the first day. - WhatsApp. Messages arrive through Meta's official WhatsApp Cloud API by webhook and attach to the lead. Outside the 24-hour window after the traveler's last message, replies must use templates Meta has approved, and the number stays in your company's Meta business account. - Phone. Staff log a call with a quick-add form. A calling service that offers webhooks can create the lead by itself. Phone numbers are stored in E.164 form, such as +14155550123, so a traveler who writes on WhatsApp and then calls from the same number stays one record. A report then shows inquiries and confirmed bookings by source. ## Where does AI help in a travel CRM, and who pays for it? AI helps with drafting, and staff keep every decision that involves a price or a customer. In JK Tour CRM an AI assistant can draft the itinerary using the customer's own API key, so the AI provider bills usage to that customer directly. I build it the same way for you. - Useful: a first draft of the days from the lead's notes, a summary of a long WhatsApp thread, a pasted inquiry turned into dates, group size and interests. - Not alone: sending a quote, changing a price or markup, marking money as received, messaging many travelers at once. An assistant on your website and on WhatsApp can also collect trip details and create the lead before anyone on your team replies. Disclosure: MagizAI, an AI chatbot and live chat for websites and WhatsApp, is my own product, and I am its founder and CEO. Connecting such an assistant to your CRM is a separate scope. ## Which travel CRM have I built? JK Tour CRM, a travel CRM I built in Laravel with a Tailwind CSS interface for destination management companies, tour operators and travel agencies. Disclosure: it is a product of ElySpace, the company where I am CTO, not an independent client project. It took 5 weeks, and its product site is live at jktourcrm.com. A lead moves through a pipeline from first contact to booking. Staff build an itinerary, which the AI assistant can draft, send it as a proposal and collect payment through Stripe, PayPal or Razorpay. A supplier ledger tracks what is owed to hotels and transport providers, a calendar shows departures, and access is controlled by role. The JK Tour CRM case study has the details. A CRM for your company starts from your own booking process, not from a copy of that product. Outside travel, for Marmaids LLC, where I work as a freelance developer, I built a CRM together with the API, the Android and iOS apps and the WHMCS module around it. ## Who owns the CRM, the traveler data and the supplier rates? You do. The CRM runs on a server in your name, and the database on it is yours. - Net rates and margins are visible only to the roles you choose, so an agent who leaves does not take your rate sheet. - Full exports and deletes are separate permissions, and every change is written to an audit trail. - A nightly mysqldump is copied off the server, and one restore is tested before go-live. - Payment, WhatsApp and AI provider accounts are opened in your company's name. - You receive the repository at handover, and the quote says in writing who holds the rights to the custom code. ## What will I not build into a travel CRM? I will not build anything that puts traveler data or your supplier relationships at risk. - No rates scraped from booking sites or from other operators' portals. - No card numbers in the CRM. Card data stays with the payment gateway. - No bulk WhatsApp messages to travelers who have not opted in. - No copy of another vendor's travel software and no pirated scripts. - No replacement for your accounting software. ## How long does a travel CRM take, and what does it cost? It is planned in phases, and each phase gets a date once its scope is written down. JK Tour CRM took 5 weeks. A first phase with the lead pipeline, contacts, tasks, quotes and payment links can fit the standard scope of my 7-day custom CRM, and the itinerary builder, supplier rates, vouchers and ledger follow as later phases. How long it takes to build a custom CRM explains what stretches a timeline. Each phase is quoted after a free scoping call, once your booking steps, supplier types and integrations are written down. Each phase is a fixed quote for a written scope, or $55 to $65 per hour. The price follows the number of supplier types and rate rules, the currencies, the integrations and the state of the data to import. We start with a free scoping call of about 30 minutes, the quote reaches you within one business day, and two weeks of support follow each delivered phase. Q: Should we buy a ready-made travel CRM or build our own? A: Buy first if a ready-made tour operator or travel agency product quotes the way you do. Several are built for itineraries and supplier rates, and you can start this month on a subscription. Build when your markups, meal plans, partner-agent prices or supplier payables keep ending up in a side spreadsheet, when the CRM must sit behind your own booking website, or when per-user fees grow with every agent you hire. On the scoping call I say plainly if buying is the better route. Q: Can it build day-wise itineraries and send branded PDF quotes? A: Yes. Staff assemble a trip from saved days, hotels, transfers and activities, and each line is priced from the supplier's rate for those dates plus your markup. The quote is rendered as a PDF with your logo, colors, inclusions, exclusions and payment terms, or sent as a share link. Revisions are numbered, and the version the traveler accepts is locked, so the vouchers and the supplier ledger use the same figures. Q: Can it handle supplier rates, markups, vouchers and supplier payments? A: Yes. Rates are stored per supplier, season and room or vehicle type, including hotel meal plans such as CP or MAP. A markup can be a percentage or a fixed amount per supplier type, season or partner agent, and net rates stay hidden from roles that should not see them. Each confirmed service produces a voucher, and a supplier ledger shows what is owed, paid and outstanding. In JK Tour CRM, a supplier ledger tracks what is owed to hotels and transport providers. Q: Can leads from WhatsApp, the website and phone calls land in one pipeline? A: Yes. The website form posts each inquiry to the CRM along with the package the visitor was viewing. WhatsApp messages arrive through Meta's official WhatsApp Cloud API and attach to the lead, and staff reply from inside the CRM. Calls are logged with a quick-add form, or created automatically if your calling service offers webhooks. Numbers are stored in international format, so one traveler on two channels becomes one record, and every lead keeps its source for reporting. Q: How long does a travel CRM take, and what does it cost? A: JK Tour CRM took 5 weeks. A first phase with the pipeline, quotes and payment links can fit my 7-day custom CRM scope, and the itinerary builder, supplier ledger and vouchers follow in phases, each dated once it is scoped. Each phase is a fixed quote after a free scoping call, or $55 to $65 per hour, depending on supplier types, rate rules, currencies and integrations. The guide how long it takes to build a custom CRM explains what stretches a timeline. Q: Can AI draft itineraries, and who pays for the AI usage? A: Yes. The assistant drafts the days from the lead's notes, using your own saved itinerary days and hotels, and a staff member edits, prices and sends the result. It never sends a quote or changes a price on its own. As in JK Tour CRM, it runs on your company's own API key with an AI provider such as OpenAI or Anthropic, so the provider bills usage to you directly. You can set a spending limit in that provider account. ## WHMCS Security Audit and Hack Recovery URL: https://shahidmalla.com/whmcs-security-audit I audit WHMCS installations for the weaknesses attackers actually use, such as exposed admin areas, missing two-factor, loose file permissions, leaked backups, outdated releases and over-powered API credentials. You get a ranked written report with fixes, and I can apply them. If you were hacked, I handle containment and recovery. - Typical timeline: Typically 2 to 4 working days for audit and report, depending on scope - Method: Read-only review first; changes only after you approve the fix list - Output: Ranked written report with evidence and fix steps - Pricing: Fixed quote after a free scoping call, or $55-$65/hour ## What does a WHMCS security audit check? It checks every place where WHMCS lets someone in, leaks data or runs code, from the admin folder to the PHP settings. This is the checklist I work through on each installation. Area | What I check | Admin folder | Whether the admin path is limited to known IP addresses at the web server. Renaming it with $customadminpath helps against bots but is obscurity, not protection. | Staff and two-factor | Two-factor on every staff account, shared logins, accounts of people who left, and who holds the full administrator role. I read the admin log for odd logins. | configuration.php | Read-only permissions, no copies such as configuration.php.bak, and the $cc_encryption_hash backed up somewhere other than next to the database dump. | Writable folders | Whether attachments, downloads, templates_c and the crons folder sit outside the public web root, with their paths set in configuration.php. | PHP hardening | disable_functions for shell-execution functions, open_basedir, display_errors off, and a supported PHP version. I test installed modules before and after, since some need functions you might block. | Release level | Whether WHMCS security releases have been applied promptly, whether the install folder was removed, and whether third-party addons are current. | Exposed files | Backups (.sql, .zip, .tar.gz), .git folders, .env files, phpinfo pages and error logs that a browser can fetch. | API credentials | Every credential, its role, its IP restriction, and whether any integration still uses an admin login. Unused credentials are listed for deletion. | Fraud and abuse | Fraud screening, CAPTCHA on login, registration, ticket and domain-checker forms, and login ban settings against password guessing and fake signups. | Database | A dedicated database user limited to one database, no MySQL port open to the internet, and backups stored off the server. | SSL and headers | HTTPS on the system URL with a redirect, HSTS, X-Content-Type-Options, a referrer policy and clickjacking protection, then a test of checkout and the gateway pages. | Server underneath | SSH access, firewall, patching, and other sites sharing the account. This overlaps with server security hardening. | ## What is in the audit report? The report is a written document that ranks each finding as critical, high, medium or low and tells you what to do about it. Every finding carries the same four parts. - The evidence, such as the file path, setting value or URL I found. - The realistic risk in plain language, not a generic score. - The exact fix, including the order to apply it in and what to test afterwards. - Whether I can apply it, and a rough effort estimate. The report also lists what was out of scope and what I could not verify. It is a snapshot of the day I looked, and it is not a certificate. ## How do attackers usually get into a WHMCS install? Usually through something that was left open, not through a clever new exploit. These are the routes that come up most often. - A WHMCS release with a published security fix that was never applied. - A staff password that was weak, reused or phished, on an account without two-factor. - A forgotten database dump, .git folder or configuration.php copy that anyone could download. - A third-party addon, theme or hook with a vulnerability that nobody updates. - Another site on the same hosting account that was compromised first, with the attacker then reading the WHMCS files. - An API secret pasted into a script, a chat or a repository. Each of these has a matching row in the checklist, which is why the audit looks at habits and history as well as settings. ## My WHMCS was hacked. What do I do first? Contain it, copy everything before you clean anything, and only then start removing and replacing. The order matters. I follow it on every recovery. - Contain. Restrict public access to the site or put it behind an IP allow-list, and block the admin area. If you suspect payment abuse, revoke gateway and API keys at once. Do not wipe the server. - Snapshot. Copy the full file tree with timestamps, take a database dump, and save the web server and PHP logs before rotation removes them. This is your evidence and your fallback. - Look for rogue access. Check staff accounts, roles, API credentials, gateway settings, server module credentials and email templates for changes you did not make. - Find modified code. Compare core files against a clean download of the same version, then read includes/hooks, modules and templates by hand. Search attachments, downloads and templates_c for PHP files that should not exist. - Restore known-good files. Put back clean core files and only the custom code you have reviewed. If you restore a backup, choose one from before the first sign of compromise, and clean the database too. - Rotate every secret. Do this after the backdoors are gone, or the new passwords leak through the old ones. Cover the database password, all staff passwords, API credentials, gateway and registrar keys, server module logins, SMTP and SSH. - Find the entry point. Read access logs for requests to unusual PHP files, check the WHMCS version against published security releases, and look at third-party modules and neighboring sites on the same account. - Harden and tell people. Apply the checklist above. If client data may have been exposed, your legal duties vary by country, so take advice on notifying clients and authorities. ## What can a WHMCS audit not do? An audit cannot make an installation unhackable, and I make no such promise. It does not replace a formal compliance assessment, and I do not issue certificates of any kind. It does not cover the security of your payment gateway, your registrar or other vendors. Because it is a snapshot, a new vulnerability or a new careless setting next month can undo it. I also do not audit unlicensed or nulled WHMCS copies, since the code cannot be trusted. Ongoing upkeep belongs in support and maintenance, and a backup plan that survives an attack is part of server migration and backup. ## What does a WHMCS security audit cost? I quote a fixed price after a free scoping call of about 30 minutes, or work hourly at $55 to $65 per hour. The price depends on how many servers and modules are involved, whether the server and control panel are in scope, and whether you want me to apply the fixes. Recovery work after a hack is scoped the same way, once I have seen the snapshot. The official WHMCS documentation has a further-security-steps guide, and I treat it as the minimum, not the whole job. If something is already broken rather than exposed, start with the WHMCS troubleshooting guide. Q: How long does a WHMCS security audit take? A: A single WHMCS installation typically takes two to four working days from access to written report. Adding the web server, the control panel and other sites on the same account lengthens that. The exact date depends on how many modules, servers and integrations are in play, which I learn on the scoping call. Q: Will the audit change anything on my live server? A: No. The review is read-only: I read configuration, list files and check settings. I change nothing until you have read the report and approved specific fixes. Those fixes go through a staging copy first when they could affect checkout, the cron or emails. Q: Can you make my WHMCS unhackable? A: No. No system is unhackable, and I will not promise otherwise. An audit closes the common routes, limits the damage if one is used, and makes an intrusion easier to spot. The remaining risk comes from things like stolen staff passwords and unpatched third-party modules, which need ongoing attention. Q: My WHMCS was hacked. Can you help right now? A: Yes. Tell me it is urgent when you write. I start with containment and a full snapshot so evidence is kept, then remove the compromise, restore clean files, rotate secrets and find the way in. The recovery steps are set out on this page so you can see the order I work in. Q: Is this a penetration test? A: No. I do not run exploits or load tests against your production system. I review configuration and files from the inside and check what is reachable from outside. If a payment provider or regulator requires a formal penetration test, you need a dedicated testing firm, and I can help prepare for it. Q: Should I change the encryption hash after a breach? A: Not blindly. The $cc_encryption_hash in configuration.php decrypts stored encrypted values, so replacing it without re-encrypting them makes that data unreadable. I first work out what the attacker could read, then decide whether a planned re-encryption is worth it. ## AI Website Development: AI Mode Sites That Answer and Sell URL: https://shahidmalla.com/ai-mode-website-development I am Shahid Malla, a freelance AI website developer. I build AI-powered websites I call AI Mode websites: sites that open on one question, recommend options from your own catalog and, once the visitor confirms, create the account, place the order and send the payment link. Your normal pages stay for browsing and search engines. It suits shops, hosting companies and service businesses. - Built on: Your WordPress, WooCommerce, Shopify, WHMCS or custom site, or a new build - Answers come from: Your pages, catalog, prices and policies, with prices and stock read live - Payment: On your checkout, invoice or payment provider's page, after the customer confirms - Search engines: Every page stays in HTML and in the sitemap - Pricing: Fixed quote per scope, or $55-$65/hour. Model usage is billed to you by the AI provider ## What is an AI Mode website? An AI Mode website opens on a conversation instead of a menu: the visitor reads one question, "What are you looking for?", and answers in their own words. Here "AI Mode" names a style of website, and it has no connection to Google's AI Mode search feature apart from the shared idea of asking instead of clicking. Behind the question sits an assistant that asks what a good salesperson would ask, suggests two or three options from your catalog, then fills in the order, opens the account and sends a link to pay. The visitor makes every choice; the site does the typing. Your pages stay, with a "Browse the site" switch always on screen. ## What is included in AI Mode website development? AI Mode website development covers five parts, and the AI model is the smallest of them. - The front door. The opening question, starting points in your customers' words, and a text box that works on a phone, by keyboard and with a screen reader (replies go to an aria-live region). - An assistant that knows only your business. It answers from your pages, catalog and policies. Prices and stock are read live from your system, never from the model's memory. - A connection to your order system. The assistant calls your store or billing API through a credential of its own, limited to the actions it needs. On WHMCS that is an API role under Configuration > System Settings > Manage API Credentials; on WooCommerce, a REST API key with only the access level required; on Shopify, a cart built with the Storefront API's cartCreate mutation. - The browse switch. One click back to the normal site, remembered for the next visit. - The hand-off. No answer, or a request for a person, sends your team the conversation and the cart. The answering part overlaps with AI chatbot development; AI Mode adds a real order at the end. Google and OpenAI now let people buy inside their own assistants, which is called agentic commerce. An AI Mode website does it on your domain, with your catalog, prices and payment rules. ## Which businesses suit a conversational website, and which do not? A conversational website suits businesses whose customers know their problem but not the product name. It does little for buyers who already know what to buy. Business | Fit | Why | Hosting, domains and email | Good | Visitors describe a goal, such as a shop for their bakery, not a plan name. | Shops with a large catalog | Good | A few questions narrow hundreds of products to three. One order holds several items. | Cleaning, repairs, home services | Good | A quote needs size, address and date. The assistant collects them and books the slot. | Clinics | Booking only | It finds a time and a practitioner. It never asks about symptoms. | Travel, stays, schools, courses | Good | Dates, group size, level and budget decide the offer. | Web design and custom work | Fair | It can scope the job and book a call; a firm price needs a person. | Buyers who land on an exact product page | Poor | They have already chosen, so a conversation adds a step. | Sales that need meetings and a contract | Poor | It can qualify a lead; the deal happens between people. | ## Can I add AI to my existing website, or do I need a new one? You can add AI Mode to an existing WordPress, WooCommerce, Shopify, WHMCS or custom site without a rebuild, as long as your catalog and orders live in a system with an API. - Teach it the business: pages, catalog, prices, policies and the answers staff give daily, with outdated pages removed. - Connect the order system, so accounts, orders and invoices are real records, not a form someone retypes. - Agree what it may do: what it does alone, what waits for the customer's yes, and what always goes to a person, written down before any code. - Add the front door and the browse switch, then test with real questions on a staging copy, never on the live site. On a new site I use AI-first website design: each page answers a question customers ask, so one text serves reader, search engine and assistant (see web design and development). Start with the most-asked questions and the one purchase that matters most; the platform steps are in my guide on how to add AI Mode to your website. ## Will an AI-powered website hurt my rankings or my place in Google's AI Mode? It should not, because crawlers and visitors get the same HTML pages as before, and the conversation is a layer on top. Search engines read pages; they do not talk to your assistant. Google's own AI Mode, its conversational search, links to pages that are indexed and allowed to show a snippet, so the same HTML keeps you eligible there too; my guide to Google AI Mode SEO sets out what Google says it needs. - Pages stay server-rendered HTML. The chat script loads on top of a complete page, and the page still works if the script fails. - Links stay real links. Navigation remains elements, and the home page HTML keeps its headings, text and links to every main section. - The sitemap and schema stay. sitemap.xml lists the same URLs, and the JSON-LD for products, services and the organization stays on its pages. - Conversations never become pages. Transcripts are private records, not URLs. ## What safety rules does every AI Mode site I build follow? Seven rules apply to every build. - Grounded answers. When your pages and price list are silent, it says "I don't know, let me get someone". - Confirm before charge. The visitor sees a summary built from your system's data, with items, total and renewal terms, and presses a button. A typed "ok" does not count. - Payment off the chat. Payment happens on your checkout, invoice or provider's page. A card number typed by mistake is masked before it is stored or sent to the model. - A person within reach. Complaints and refunds go to your team with the conversation attached. - AI disclosure. In the EU, Article 50 of the AI Act makes this a legal duty from 2 August 2026. I am not a lawyer; check with yours. - Accessibility. Keyboard, screen reader, small screens, and the visitor's language where your content allows. - Cost caps. The AI provider bills every reply, so conversations, visitors and daily spend each have a limit, with an alert. ## What will I not build? - A chat that replaces the pages or hides them from visitors or search engines. - A checkout that collects card numbers in the conversation, or charges without confirmation. - An assistant that pretends to be a person, invents scarcity your stock data does not show, or keeps upselling after a no. - Symptom checking, diagnosis or legal advice. - A project sold on a promised conversion rate. I measure results with you and promise none. If you only need answers, a chatbot costs less; see AI chatbot vs AI agent. Assistants that act in your back office are AI agent development. ## What should I ask any AI Mode website builder? Put these seven questions to me or anyone else, and compare the written answers. - Where do the answers come from, and what does the assistant say when it does not know? - Does it create real orders, accounts and invoices, or only collect requests that staff retype? - Where does the customer type card details, and what stops a charge they did not approve? - Can visitors switch to the normal site, and will every page stay in HTML and in my sitemap? - How does a conversation reach my team, and how soon? - What will AI usage cost each month at my traffic, and where is the cap? - Can I try a live site you built and see how its conversations are logged? My live example is ElySpace Ask AI, under recent work. Disclosure: I built it as CTO of ElySpace, my employer, not an independent client. I also founded MagizAI, an AI chatbot and live chat product. Q: Is an AI Mode website the same as Google's AI Mode? A: No. Google's AI Mode is a feature of Google Search that answers questions in an AI conversation. An AI Mode website is your own site, built to open on a conversation with an assistant that knows only your business and can place orders in your own system. The two share one idea, asking instead of clicking, and nothing else. Your site does not use Google's feature, and Google's feature does not run on your site. Q: Will visitors be forced to use the chat? A: No. A "Browse the site" switch is visible from the first screen, and the choice is remembered on the next visit, so people who prefer menus and product pages get the normal site. Every page also stays reachable through ordinary links and from search results. The conversation is an entrance, not a gate, and I do not build versions where it becomes one. Q: Can the assistant take payment inside the conversation? A: It sends the customer to pay; it never takes card details itself. After the customer confirms an order summary, the assistant hands over a payment link: your store's checkout, your billing system's invoice or your payment provider's page. A saved card is charged only when the customer confirms it there. Nothing is charged until that step is done, and the assistant has no permission to mark an order as paid. Q: How much does AI Mode website development cost? A: Building it is a fixed quote per scope, sent within one business day of a free scoping call of about 30 minutes, or $55-$65 per hour if you prefer. Running it is a separate cost: the AI provider bills model usage to your own account, and it grows with traffic. I set a per-conversation limit, a daily spend cap and alerts, and report the real cost per conversation from the first weeks of logs. Q: Can you add AI Mode to my WordPress, Shopify or WHMCS site? A: Yes, usually without a rebuild. WooCommerce has a REST API for products and orders, Shopify's Storefront API builds carts that end on Shopify's own checkout, and WHMCS has an API for clients, orders and invoices. A custom site needs an API of its own, or a small one I add. I check your platform, plugins and hosting on the scoping call before I quote. Q: What happens when the assistant does not know the answer? A: It says so and offers a person. The assistant answers only from your pages, catalog, prices and policies; when those do not cover a question, it does not guess. It tells the visitor it will get someone, sends your team the conversation and anything already in the cart, and states your normal reply time outside working hours. The unanswered questions also show which pages you should write next. ## Hire Claude Code Developer: Claude Code Expert for SaaS and CRM URL: https://shahidmalla.com/hire-claude-code-developer I am Shahid Malla, a Claude Code expert and developer with 13+ years of experience who builds software with Claude Code, OpenAI Codex and AI agents. Companies and founders hire me to turn a SaaS, CRM, app or internal tool into tested, working software in weeks instead of months, with every change planned and reviewed by me. - Tools: Claude Code, OpenAI Codex, the Claude and OpenAI APIs, MCP servers - What I build: SaaS products, CRMs, mobile apps, WHMCS modules, AI agents and automation - Speed: Work once planned as six months, delivered in about 7 days when it builds on my existing code - Quality gates: Written spec, automated tests, my review of every change, staging before production - Pricing: Fixed quote per scope, or $55-$65/hour ## What does a Claude Code developer do for your project? A Claude Code developer turns your idea into working software by directing AI coding agents the way a lead engineer directs a team. I write the spec, prepare the repository and its rules, hand small tasks to Claude Code and OpenAI Codex, and review, test and merge what they produce. You get the output of several developers working in parallel, with one experienced person answerable for every line. That last part is what separates engineering with AI from prompting until something appears to work. An agent can write a login form in a minute; it can also store passwords badly, skip a permission check or quietly change a file it was not asked to touch. Thirteen years of building SaaS products, CRMs, WHMCS modules and hosting systems is what lets me spot those mistakes in review and design the work so they are rare. ## What can I build for you with Claude Code and Codex? Anything I could build by hand, I now build faster with agents. These are the projects I take on most: Project | What the agents speed up | What I decide and check myself | SaaS product | Screens, CRUD, API endpoints, tests, admin panel | Data model, tenancy, billing logic, security | CRM or internal tool | Fields, pipelines, imports, reports, notifications | Roles and permissions, data migration rules | Mobile app and its backend | Screens, API client, push notifications, tests | App store rules, offline behavior, data sync | AI agents and chatbots | Tool wrappers, prompts, evaluation scripts | What the agent may do alone, spend limits, hand-off to people | WHMCS modules and integrations | Module functions, hooks, API calls, admin screens | Billing correctness, upgrade safety, provisioning edge cases | Automation between your tools | Webhook handlers, sync jobs, retries, logs | Failure handling and who is alerted | If you need a CRM quickly, the custom CRM in 7 days offer is this same method applied to a fixed scope. ## How much faster is development with AI agents? Much faster on the parts that are code, and no faster on the parts that are decisions. In my own work, a project I planned as six months before AI agents now ships in about 7 days when it builds on code I already have, and a roadmap I once quoted as a year takes about 15 days. Three things produce that speed: - Base code from 13+ years of projects. Authentication, roles, billing, imports, PDF documents, payment webhooks and admin panels already exist and are tested, so agents extend them instead of inventing them. - Parallel agents. Several tasks run at once in separate branches, while I plan the next ones and review the finished ones. - Automated tests. Every change is checked in minutes, so speed does not turn into regressions. What does not get faster: agreeing on the scope, waiting for outside approvals such as payment provider checks or app store review, cleaning years of messy data, and your team learning the new tool. I plan those into the date instead of hiding them. ## What should you check before you hire a Claude Code developer? Ask how the developer controls the agent, not only what it produced. Claude Code has documented controls for each point below, and a developer who uses them can explain them in plain words and show them in the repository. Check | What a good answer covers | Claude Code feature | Written project rules | Coding rules, build and test commands, and areas the agent must not touch, written down so every session starts with them | CLAUDE.md project memory | Limits on what the agent may do | Which commands and files it can use without asking, with secrets and production systems kept out of reach | Permissions | Automatic guards | Checks that run on their own, such as formatting and tests after an edit, or blocking a dangerous command before it runs | Hooks, including PreToolUse hooks that can block an action | Focused helpers | Separate agents for research, review or tests, each with its own context and its own tool access | Subagents | Connections to your tools | How it reaches your issue tracker, database or documentation, and with which access level | MCP servers | Review and tests | Who reads every change before it merges, and which tests prove it works | Your process, not a tool setting | I set these up on every client project and hand the configuration over with the code, so your own developers can keep using it. If a candidate cannot show the tests and the review step, the agent's speed is a risk rather than a saving. ## How do you run Claude Code on a client project? I run it as a controlled process, not a chat. The steps are the same on every project: - Write the spec: users, screens, data model, roles and the acceptance tests the finished work must pass. - Set the rules: a CLAUDE.md file for Claude Code and an AGENTS.md file for Codex describe the architecture, conventions, test commands and forbidden actions. - Plan before editing: the agent proposes a plan for each task, and I correct it before it writes code. - Work in branches: each task runs in its own branch or worktree, so parallel agents never overwrite each other. - Gate every change: hooks run the formatter and tests automatically, and nothing merges until the tests pass and I have reviewed the diff. - Connect tools carefully: where an agent needs documentation or a database, I connect it through an MCP server with read-only or test-only access. ## How do you keep AI-written code secure and maintainable? By treating the agent as a fast junior developer whose work always gets reviewed. Secrets and production credentials never enter a prompt or the repository. Agents get the narrowest permissions that let them do the task, and commands that delete data or touch production need my approval. Dependencies are checked before they are added. The code follows one architecture written down in the rules files, so it stays readable to the next developer, human or AI. ## Can you fix a vibe-coded app that now breaks? Yes, and it is a growing part of my work. Vibe-coded apps, generated quickly by prompting without a spec, often share the same problems: no tests, secrets in the code, missing permission checks, duplicated logic and a database that does not match the screens. I start with a written audit of what is safe, what is broken and what must be rebuilt, then add tests around the parts we keep and fix them in priority order. Sometimes a clean rebuild on my base code is faster, and I say so. ## Can you set up Claude Code or Codex for our own developers? Yes. For teams that want to keep building themselves, I set up the rules files, test and lint hooks, MCP connections and a review routine for your repository, then work alongside your developers on a real feature so the method sticks. For ongoing help after that, the monthly developer retainer keeps me available without a new quote for each request. Disclosure: Claude and Claude Code are trademarks of Anthropic, PBC, and Codex is a product of OpenAI. I am an independent developer, not affiliated with or endorsed by either company. I am the founder of MagizAI, an AI chatbot product, and CTO at ElySpace; the work shown below includes projects for both. Q: What is a Claude Code expert? A: A Claude Code expert is a developer who uses Anthropic's Claude, mainly through Claude Code, the agentic coding tool that works in a project's terminal and editor, to plan, write, test and fix software much faster than by hand, and who knows where the model goes wrong. The expertise is not in typing prompts. It is in writing the spec, setting the rules the agent follows, splitting the work, reviewing every change and keeping tests and security in place. Q: Are you certified, partnered or endorsed by Anthropic or OpenAI? A: No. I am an independent developer and a heavy daily user of Claude Code and OpenAI Codex. I am not affiliated with, certified by or endorsed by Anthropic or OpenAI. Claude is a trademark of Anthropic, and Codex is a product of OpenAI; I name them only to say which tools I build with. Q: Is software built with Claude Code reliable enough for production? A: It is when the process around the agent is strict. The same rules apply as to any developer's code: a written spec, automated tests that must pass, a human review of every change, a staging copy before production and a security check of secrets and permissions. Code that skips those steps is unreliable whether a person or a model wrote it. I do not merge anything I have not read. Q: Will my code or business data be used to train AI models? A: I work through business and API access whose terms do not use your data for model training by default, and I check the current terms of each provider for your project. I never paste passwords, API keys or customer records into a prompt. Agents work on a copy of the code with test data, and production credentials stay in your hosting account. Q: What does it cost to hire a Claude Code developer, and who pays for the AI tools? A: I quote a fixed price for a written scope, or bill $55 to $65 per hour. The Claude Code and Codex subscriptions I use while building are my own cost, not a line on your invoice. If your finished product calls an AI model while it runs, for example a chatbot or an agent, that usage is billed by the provider to your own account, and I set a monthly spending cap on it. Q: Is AI-assisted development the same as vibe coding? A: No. Vibe coding usually means accepting whatever the model generates without reading it, which is fine for a weekend prototype. AI-assisted development keeps the engineering around the agent: a written spec, rules the agent must follow, automated tests, a review of every change and a staging copy before production. The agent writes faster; the developer stays responsible for what ships. Q: Do you use Claude Code or Codex? A: Both, chosen per task. I use Claude Code for most planning, multi-file changes and long refactors, and OpenAI Codex for parallel tasks and second opinions in code review. The repository carries rules files for both, CLAUDE.md and AGENTS.md, so either agent, or your own developers later, follow the same conventions. Q: Can you work in our existing codebase with our developers? A: Yes. I start by reading the code and running its tests, then write the rules files that describe your architecture and conventions, so the agents follow your style instead of inventing their own. Work arrives as normal pull requests that your team can review. If there are no tests yet, adding them to the parts we change comes first. Q: How do I hire you? A: Directly. Send a brief through the project form, book a call, or email me, and you deal with me personally from the first call to the handover. You can also hire me on Fiverr or Upwork for the same work if you prefer a marketplace's payment protection. All the options are at the bottom of this page. ## Vibe-Coded App Rescue: Fix and Harden Your AI-Built App URL: https://shahidmalla.com/vibe-coded-app-rescue I fix vibe-coded apps built with Lovable, Bolt, Replit, v0 or Cursor that now break, leak data or will not deploy. I audit the code in writing, close exposed keys and open tables first, add tests, then repair or rebuild what the audit shows and hand the app back in accounts you own. - Built with: Lovable, Bolt, Replit, v0, Cursor, Claude Code and similar tools - First step: Free scoping call of about 30 minutes, then a written, fixed-price audit quote within one business day - Method: Audit on a staging copy; production changes only after you approve the fix list - Ownership: Repository, hosting, database and domain stay in your accounts - Pricing: Fixed quote for the audit and for the fix plan, or $55-$65/hour ## What is a vibe-coded app rescue? A vibe-coded app rescue is a scoped job in which a developer audits an app generated by prompting, closes what can leak data or lose money, adds tests, and repairs or rebuilds what fails, then hands the app back in accounts you own. Screens and data stay wherever they are sound. What changes is that someone has read the code and answers for it. The same job is also sold as vibe coding cleanup, or as hiring a Lovable, Bolt or Replit app developer. I am a full-stack developer with 13+ years and 900+ projects, and CTO at ElySpace, a hosting company, since 2016. I build with Claude Code and review every change myself, so I know where generated code tends to go wrong. To try the fix yourself first, read my guide on how to fix a vibe-coded app. This page is the service. ## What problems does a vibe-coded app rescue fix? It fixes apps that break, leak, slow down or cannot leave the builder. Each symptom has a likely cause that I check early. What you see | What often sits behind it | What I check first | It works for me but not for the second user | Records with no owner; access rules only in the browser | Each request repeated as user B and signed out | Every prompt breaks something that worked | No tests; the same logic copied into several files | Which critical flows have no test | Data may be leaking | A secret key in front-end code; tables without row-level security | What the public key can read, signed out | Payments almost work | The browser marks orders paid; webhooks unverified or processed twice | An unsigned and a repeated webhook on staging | It slows down as users arrive | Missing indexes, heavy work inside web requests, filtering in the browser | Slow queries and server logs | It will not deploy anywhere else | Secrets, database and settings that live only in the builder | A clean install from the repository onto staging | Fixes follow risk, not the order you noticed things: exposed data and money first, then data integrity, then your bug list, then new features. ## What does the rescue audit check? It checks where generated code most often looks finished but is not, and every finding comes with evidence rather than an opinion. Area | What I check | Standard | Keys and secrets | Secret keys in front-end files, repository history, logs or chat history | Supabase: a secret key "bypasses every Row Level Security policy you have." | Database access | Row-level security on every exposed table, leftover anon and authenticated grants, views | Supabase: "A table in an exposed schema without RLS is readable and writable by any role with a grant on it." | Routes and roles | Every API route, admin page and file download checked on the server | OWASP A01:2025: access control "is only effective when implemented in trusted server-side code or serverless APIs" | Payments | Signed webhooks, duplicate events ignored, prices taken from the server | Stripe: without verification "an attacker could send fake webhook events to your endpoint" | Abuse and exposed files | Rate limits on login, reset, email and paid AI calls; .env, .git and backups reachable by URL | OWASP A01:2025 calls for rate limits and for no .git or backup files "within web roots" | Data and errors | An owner or tenant on each record, migrations, npm audit or composer audit, swallowed errors | Fits the business; every failure logged | Deployment | Separate development and production databases, a tested backup restore, a repeatable deploy | Builds from the repository on a clean server | Many of these apps run on Supabase; Lovable's built-in backend "utilizes Supabase's open-source foundation." Once row-level security is on, the publishable key reaches no data "until you create policies", so I test each policy on staging first and add the pgTAP policy tests Supabase documents, so a later prompt cannot quietly reopen a table. The reasoning behind each row is in my vibe coding security checklist. ## Which AI app builders and coding tools do you work with? Lovable, Bolt, Replit, v0, Cursor, Claude Code and similar tools, as long as the code can reach a Git repository you own. The way out differs on each, and so does what stays behind. Tool | How the code reaches your repository | What I plan around | Lovable | Git sync, which "always creates a new repository", or a zip download on paid plans | The database export "does not include stored files, Edge Function code, or secrets" | Bolt | GitHub backup with "a full history of changes that lives outside Bolt", or a zip download | Branches merge in GitHub; Bolt "currently doesn't support merging branches in-app" | Replit | A zip download or two-way Git sync | Secrets, database and deployment configuration "aren't included in the copy"; production has its own database | v0 | A private repository that "becomes the source of truth for your project's code" | Changes land on a working branch, so review happens in pull requests | Cursor, Claude Code | Already in your repository | Rules files: Cursor's .cursor/rules are "version-controlled and scoped to your codebase"; Claude Code reads CLAUDE.md "at the start of every session" | If the code cannot be exported to an account you own, I recommend a rebuild, because every fix would stay locked in the platform. My guide to vibe coding tools compares what each one lets you take with you. ## Is the builder's own security scan enough? No. A builder's scanner is a useful first pass, and I run it, but its makers say it is not a full review. Lovable's security documentation says its tools "help identify common security issues, but they cannot guarantee complete security," and suggests "an additional professional security review" for apps with sensitive data. Replit's Security Center calls its build-time check "an early, lightweight check in the Agent workflow rather than a full codebase review." Scanners find patterns; they cannot know your business rules, such as which staff role may issue a refund or which customer may see which record. Testing those takes a person signed in as the wrong user on purpose. ## Will you repair my app or rebuild it? The audit decides, and the report says which and why. Repair fits when the problems sit in a few known places. A refactor fits when each change breaks something else: tests first, then restructuring in steps. A rebuild fits only when the foundation is wrong, such as records with no owner, and it is often partial, replacing one module while the data and working screens stay. A full rebuild I quote as SaaS development on tested base code. ## How do you handle my accounts, keys and customer data? Through invitations and a staging copy, never passwords pasted into a chat. You add me to GitHub, hosting and the database under my own login, so you see what I do and can remove me afterwards. If the audit finds a key that is already exposed, I tell you at once rather than waiting for the report, and we follow Supabase's order: "Fix the root cause of the leak before you rotate anything." The AI agents I run never receive production credentials or real customer records. Production changes happen only after you approve the fix list, with a backup first and a way to roll back. If the server underneath needs work too, that is server security hardening. ## Should you buy a bug-fix package or an audit first? Buy a bug-fix package when you know every problem and the app holds no real data. Start with an audit when users, payments or personal data are involved, because the costly problems are the ones nobody has reported. Whoever you hire, ask: - Will you test access as a second user and signed out? - Do I get the findings in writing, with evidence? - Where will the fixed code live, and under whose account? - Which fixes come with automated tests? - What happens to keys that were already exposed? ## What will a rescue not do? A rescue makes an app safer and easier to change; it does not make it unhackable, and I make no such promise. It is not a penetration test, a compliance assessment or a certificate; if a client or regulator asks for one, you need a dedicated firm, and the rescue helps you prepare. I fix your app and its accounts, not the builder platform. I add no features until exposed data and payment problems are closed, and I do not quote fixes for code I have not read. To start a new product with AI agents and review from day one instead, hire a Claude Code developer. Disclosure: I am independent, not affiliated with or endorsed by Lovable, Bolt, Replit, v0, Cursor, Supabase, Stripe or Anthropic. Claude and Claude Code are trademarks of Anthropic, PBC. I am CTO at ElySpace and founder of MagizAI. Vendor documentation quoted here was read on 25 October 2026. Q: Can you fix an app built with Lovable, Bolt, Replit or v0? A: Yes, once the code is in a Git repository you own. Each builder documents a way out: Lovable's Git sync creates a new GitHub repository, Bolt backs a project up to GitHub or downloads it as a zip, Replit offers a zip download or two-way Git sync, and v0 creates a private repository that becomes the source of truth for the code. I work in that repository. The database, secrets and hosting settings move separately, and the audit lists each one. Q: Can I keep using Lovable or Bolt after the rescue? A: Often, yes. Lovable's docs say changes pushed to the active GitHub branch sync back into Lovable, and Bolt checks GitHub every 30 seconds for changes made outside it. The risk is two editors on one branch: Bolt says that if both sides update at almost the same time, it keeps its own changes and overwrites the GitHub version. We agree which work stays in the builder and which goes through reviewed pull requests. Q: Do you use AI to fix AI-written code? A: Yes. I work with Claude Code, which reads an unfamiliar codebase and drafts fixes faster than I could by hand. The difference from the original build is the process around it: a written plan, rules files, tests that must pass and my review of every diff before it merges. I do not merge anything I have not read, and the agent never gets production credentials or real customer records. Q: How long does it take to fix a vibe-coded app? A: I give a date with the fix quote, after the audit, because the timeline depends on what the audit finds rather than on the number of screens. What moves it most: whether every account is handed over on day one, how clean the data is, how many outside services and webhooks are involved, whether any tests exist, and whether new features get added in the middle of the rescue. Q: Who owns the code and the accounts? A: You do. The repository, hosting, database, domain, payment and email accounts stay in your name, and I work under my own invited login, which you remove at the end. On the builder side, Lovable's FAQ says "Your apps, code, and the content you create with Lovable are yours, subject to third-party rights such as open-source licenses." For other builders, read their terms, and keep a current copy in your own GitHub account either way. Q: How much does it cost to fix a vibe-coded app? A: I do not price fixes before reading the code, because two apps with the same screens can hide very different problems. After a free scoping call of about 30 minutes, you get a fixed price for the audit within one business day. The audit then produces a fixed quote for the fixes or a partial rebuild, or I work hourly at $55 to $65. You can stop after the audit and give the report to any developer. Q: Do you work with clients in the US, UK, Canada and Australia? A: Yes, remotely, through the repository, a shared issue list and calls. Past builds include the Chargewise online store in Next.js, for a company that ships across the United States and Canada; a client portal for RealBytes, an Australian hosting provider; and the website for Krunus, a UK hosting provider. These were new builds, not rescues. ## Hire Laravel Developer: Apps, Filament Panels, Upgrades and AI URL: https://shahidmalla.com/laravel-developer I am Shahid Malla, a freelance Laravel developer with 13+ years and 900+ projects behind me. SaaS founders, businesses and agencies hire me to build Laravel applications, Filament admin panels and APIs, to move old Laravel apps to a supported version, and to add AI features to apps they already run. - What I build: Laravel applications, SaaS products, Filament admin panels, APIs and AI features - Current versions: Laravel 13 (security fixes until March 17, 2028) and Filament 5 - Way of working: Built with Claude Code; every change tested and reviewed by me - Ownership: Repository, server and service accounts in your name - Pricing: Fixed quote after a free scoping call, or $55-$65/hour ## What do I build as a freelance Laravel developer? I build the Laravel applications a business runs on: SaaS products, CRMs and internal tools, booking platforms, customer portals, APIs and the admin panels behind them. One developer handles the data model, code, tests and deployment. Project | What it usually includes | Laravel example you can look at | SaaS product or CRM | Lead pipeline, proposals, online payments, supplier ledger, role-based access | JK Tour CRM, a travel CRM I built for ElySpace, where I am CTO (an ElySpace product, not a client project) | Admin panel | Resources, filters, roles and settings for staff | This website, which runs on Laravel with a Filament admin panel | Booking website | Dates and guests, add-ons, pay now or reserve, customer accounts | Kohwan: ski packages, lessons, lift passes and rentals in Gulmarg, Kashmir | Hotel or business website | Rooms, services and add-on packages | Hôtel Spa Le Suisse, a boutique spa hotel in Quebec, Canada | Publishing or workflow platform | Submissions, editor tools, public article pages | SRJ Journal: article and issue management, DOI details, manuscript submissions | APIs for mobile apps and partners are versioned from the first route, with token authentication such as Laravel Sanctum. ## When should you hire a Laravel developer directly instead of an agency? Hire one experienced developer directly when the work fits in one person's head: one product, one admin panel, one upgrade or one set of AI features. You talk to the person writing the code, with no account manager in between. An agency or a staffing marketplace fits better when you need several developers at once, a designer and a project manager under one contract, or someone on call around the clock. I am one developer, and I say so before you sign. Whoever you hire, ask three things: which live Laravel work you can open, which Laravel and PHP versions they would choose and why, and who reads the code before it reaches production. ## Can you upgrade an old Laravel app to Laravel 13? Yes. I move an app one major version at a time, following Laravel's upgrade guide for each step, on a staging copy, with the tests run after every step. Skipping versions saves nothing, because each guide lists the breaking changes for its own step only. The support table in the Laravel release notes shows why it matters: Version | PHP | Bug fixes until | Security fixes until | Laravel 10 | 8.1 - 8.3 | August 6, 2024 | February 4, 2025 | Laravel 11 | 8.2 - 8.4 | September 3, 2025 | March 12, 2026 | Laravel 12 | 8.2 - 8.5 | August 13, 2026 | February 24, 2027 | Laravel 13 | 8.3 - 8.5 | Q3 2027 | March 17, 2028 | The framework step is rarely the slow part. The time goes into the PHP version on the server, packages nobody updated, and code that relies on old defaults. The official upgrade guide estimates 10 minutes for the move from 12.x to 13.0, and still lists changes that need a decision: - The CSRF middleware is now PreventRequestForgery; VerifyCsrfToken survives only as a deprecated alias, so references to it get updated. - The new skeleton sets the session serialization option to json. Switching an existing app from php signs every user out, so we pick the moment together or keep php. - The cache config gains serializable_classes, set to false. An app that caches PHP objects needs an explicit list of allowed classes. The guide also names Laravel Shift, a community-maintained upgrade service, and the /upgrade-laravel-v13 command that Laravel Boost adds to Claude Code for apps on Laravel 12. Whatever drafts the changes, I review each one and run the full test suite. ## What does a Filament admin panel give your team? It gives your staff a back office for lists, filters, forms, dashboards and permissions, built on your existing Laravel models in the same codebase as the app. Filament describes itself as a server-driven UI framework for Laravel: screens are defined in PHP, on top of Livewire, Alpine.js and Tailwind CSS. This website's blog posts, invoices, coupons, contact messages, menus and settings are all managed in a Filament panel. In a client panel I set up: - A resource for each business object, with the filters and bulk actions your staff use - Roles and policies, so a support agent cannot issue refunds or delete records - Dashboard widgets for the few numbers someone checks every morning - Actions that call your own services, such as sending a quote, instead of editing raw rows The current major release, Filament 5, needs PHP 8.2+, Laravel 11.28+ and Livewire 4 (Filament upgrade guide). Older panels move forward with Filament's upgrade script, but the v5 guide warns that manual changes may still be needed and that some plugins may not support v5 yet, so I check every plugin before starting. ## How do you add AI features to a Laravel app? On Laravel 12 or 13, a good base is the Laravel AI SDK, Laravel's own package that puts providers such as OpenAI, Anthropic and Gemini behind one API for agents, tools, structured output and embeddings. Its current release requires PHP 8.3 and Laravel 12 or 13, so an older app is upgraded first. - An assistant inside your app that answers from your own records, with conversations saved by the SDK's RemembersConversations trait. - Drafting of proposals, replies or summaries as structured output your code can check. In JK Tour CRM, an AI assistant can draft an itinerary using the customer's own API key. - Semantic search over documents with embeddings; Laravel 13 adds vector queries for PostgreSQL with pgvector. - An MCP server built with Laravel MCP, so AI clients can use your app's tools and data, protected by OAuth through Laravel Passport or by Sanctum tokens. Three safeguards go into every AI feature. Tools that change data are marked as needing approval, and the agent pauses until a person approves the call. Failover sends a request to a backup provider when the main one is rate-limited or unavailable. Tests fake the agent with fake() and preventStrayPrompts(), so the suite never calls a paid API. For agents that act across several systems, see AI agent development. ## How do you use Claude Code on a Laravel project without losing control? I treat Claude Code as a fast assistant whose work I check, never as the developer of record. Each task starts with a short plan I approve, runs in its own branch, and ends with passing tests and my reading of the whole diff. On Laravel 12 and newer, Laravel Boost, Laravel's first-party package for AI-assisted work, can be added. It writes Laravel guidelines into CLAUDE.md and AGENTS.md inside its own block, leaving your own rules intact, and lets the agent read the database schema, the last logged error and the docs for your installed versions. Production credentials never reach the agent; it works against a local or staging database. The full routine is in my Claude Code workflow for client projects; for work outside Laravel, see Claude Code development. ## Who owns the code, the repository and the accounts? You own the repository and every account. The repository lives in your GitHub or GitLab account, or moves there at handover if I start it in mine, and the server, domain, payment and AI provider accounts are opened in your name. I work with access you grant and can remove at any time. Who holds the rights to the custom code is written into the quote before work starts, and open-source packages keep their own licenses. ## How do you test and hand over a Laravel project? With feature tests that use the app the way a person does, written in Pest or PHPUnit to match your project and run on every change. They cover the core workflow, each permission rule, payment webhooks and AI calls with faked responses. For an upgrade, I write the tests first against the old version, so they prove the new version behaves the same. At handover you receive: - The repository, with a README that sets the project up in a few commands - Every environment variable listed and explained, with no secret values in the code - Deployment, rollback and backup-restore steps, with queue worker and scheduler settings - A walkthrough call, then two weeks of support for defects in the delivered scope The day-to-day routine is on how I work. ## Which Laravel projects do I turn down? I turn down work I cannot do well or honestly. That covers nulled or pirated scripts and paid packages without a license, copies of another company's product, and one-off error fixes with no wider project, which your host's support or an AI assistant handles faster. I do not certify apps against PCI DSS or SOC 2. Q: How much does it cost to hire a Laravel developer? A: I work at $55 to $65 per hour, or for a fixed price agreed on a written scope. There are no packages. The price follows the number of roles, screens and integrations and, for an upgrade, how many major versions and outdated packages stand between your app and Laravel 13. The scoping call is free and takes about 30 minutes, and the written quote follows within one business day. Hosting and AI usage are billed to you directly by those providers. Q: Which Laravel version should a new project start on? A: Laravel 13, the current major release. Laravel's release notes give it a release date of March 17, 2026, bug fixes until Q3 2027 and security fixes until March 17, 2028, and it requires PHP 8.3 or newer. Laravel ships a new major version about once a year, in the first quarter, so a project started on 13 has a long supported life and a documented upgrade path each year. Q: Is my current Laravel version still supported? A: Check the support table in Laravel's release notes. Each release gets bug fixes for 18 months and security fixes for 2 years. As of October 2026, Laravel 10 and 11 get no fixes at all; security fixes for Laravel 11 ended on March 12, 2026. Laravel 12 gets security fixes only, until February 24, 2027. An app on any of these keeps running, but new framework vulnerabilities will not be patched for it. Q: Can you work on Filament 3 or 4 panels, not only Filament 5? A: Yes. An older panel can be extended as it is, or moved forward when the upgrade is worth it. Filament 5 needs PHP 8.2+, Laravel 11.28+ and Livewire 4. Filament provides an automated upgrade script for each major version, vendor/bin/filament-v4 and vendor/bin/filament-v5. Its own v4 guide says the script does not handle all breaking changes, so I run it in a branch, review its changes and test every resource on staging before release. Q: Do you write the code yourself or with AI? A: Both. I build with Claude Code, Anthropic's coding agent: I write the plan, the agent drafts code, and I read every diff before it merges, with the tests run on every change. On Laravel 12 and newer, Laravel Boost, Laravel's package that gives AI agents Laravel guidelines and a documentation search tool, can be added to the project. I am not affiliated with Anthropic or Laravel; I name the tools so you know how the work is done. Q: Can you join our agency or in-house team as a Laravel developer? A: Yes. I work in your repository, follow your branching and review rules, and deliver pull requests your own developers can review. For an agency, I can take the Laravel part of a client project and work inside your process. If the code has no tests yet, I add them around the parts I change first, so my work does not break what yours depends on. Q: Do you work with clients in the US, Canada, the UK and Australia? A: Yes, remotely. My portfolio includes a Laravel website for Hôtel Spa Le Suisse in Quebec, a client portal for RealBytes, an Australian hosting provider, a website for CornerHost, an Australian managed WordPress host, a website for Krunus, a UK hosting provider, and a Next.js store for Chargewise, which ships across the United States and Canada. Of these, only the Quebec hotel site is a Laravel project. Calls, the written scope and progress updates all happen online. ## WHMCS Support and Maintenance URL: https://shahidmalla.com/whmcs-support-maintenance I look after live WHMCS installations for hosting companies and online businesses. That covers staged upgrades, PHP changes, cron and backup monitoring, module and gateway updates, a monthly health review and ad-hoc fixes. You pay by the hour or through a monthly arrangement, and I typically reply within one business day. - Engagement: Hourly at $55-$65, or a monthly arrangement quoted per scope - Response: Typically within one business day - Upgrades: Rehearsed in a staging copy before production - Monthly review: Written summary of what was checked and what needs action ## What does WHMCS support and maintenance include? It covers everything needed to keep an installation that already works running safely, plus fixes when something breaks. The routine work falls into five groups. - Upgrades. WHMCS version updates, planned, rehearsed and applied in a quiet window with a rollback path. - Platform changes. PHP version moves, ionCube Loader updates and database settings, with an eye on what your hosting provider is retiring. - Automation. The cron, the daily run and outgoing email, checked on the agreed schedule so a silent stop is caught early. - Safety nets. Backups that are checked, restored on staging and kept off the server. - Integrations. License status, addons, payment gateways, registrar modules and the notices their providers publish. Ad-hoc fixes sit on top of that. If you want to try a fix yourself first, the WHMCS troubleshooting guide lists the usual causes and safe checks. ## What does a monthly WHMCS health check cover? A monthly health check is a read-through of the parts of WHMCS that fail quietly, ending in a written summary. These are the checks I run. Check | What I look at | What I do with it | Cron and automation | The automation status page: last run time, each task finishing, no overlapping runs. | Correct the PHP path, user or schedule. | Backups | Latest database and file backups exist, are stored off the server, and the encryption hash is kept safely. | Restore one into staging on the schedule we agree and confirm it opens. | Version and security | Installed release against current releases and security notices. | Apply security releases promptly; plan the rest. | PHP and ionCube | The active PHP version, the Loader build and the provider's retirement dates. | Schedule a tested PHP change before support ends. | License | Status, plus the IP and domain it is bound to. | Reissue it after any server or IP change. | Logs | PHP error log, activity log, module log and gateway log for repeating errors. | Fix the source of repeats instead of ignoring them. | Email | Failed sends in the email log, SMTP errors, and the SPF, DKIM and DMARC records. | Repair SMTP settings or DNS records. | Gateways and registrars | Failed callbacks, module update notices and API deprecation warnings. | Update the module and test with a small live payment. | Data growth | Disk space, size of the activity and email logs, and the templates_c folder. | Archive or prune only after a fresh backup. | Access | Staff accounts, two-factor status and API credentials. | Remove stale accounts and unused credentials. | ## How do you upgrade WHMCS without breaking anything? I upgrade on a staging copy first and touch production only after the copy passes a fixed test list. The sequence is the same every time. - Take a fresh database dump and file copy, and confirm both can be restored. - Clone the site to staging with the same PHP version and ionCube Loader as production. - Run the upgrade there, then test checkout, invoice generation, a gateway payment in test mode, a provisioning action, the client area theme, your hooks and outgoing email. - Repeat on production in a quiet window, empty the template cache, and run the cron by hand. - Watch the logs through the first daily run and keep the rollback copy until you approve its removal. Security releases follow the same path on a shorter clock. The staging test is trimmed to the checks that matter most, because leaving a known hole open is a risk too. Feature releases can wait for a calmer week. ## What happens when PHP, modules or gateways change? Each change is treated as its own small project, because a provider can retire something with little warning. When a host drops an old PHP version, I check that the newer version has a matching ionCube Loader, that every encoded third-party module and theme has a build for it, and that custom code does not use functions PHP has removed. When a gateway or registrar publishes an API change, I update or patch the module and test it with a small live transaction. If a vendor no longer supports its module, I tell you early and we choose between a replacement and a small custom build. ## Should I pay hourly or monthly? Pay hourly if your needs are occasional, and monthly if you want routine checks and planned upgrades. Hourly work costs $55 to $65 per hour and only runs when you ask for it. A monthly arrangement is quoted per scope and covers the health check and upgrade planning, with the scope written into the quote. You can start hourly and move to monthly later, with the baseline review already done. ## What counts as an ad-hoc fix, and how fast will I hear back? An ad-hoc fix is any single problem you report between scheduled checks, and I typically reply within one business day. Typical jobs are a gateway callback that stopped marking invoices paid, an error after a module update, a server module that cannot reach cPanel, emails that stopped arriving, or a slow admin area. A good report makes it faster. Send what you saw, when it started, the exact error text and anything that changed just before, such as an upgrade, a PHP switch or a new addon. I work billing-stopping problems first, then checkout and client-facing faults, then everything else. ## What is not included? New feature builds are quoted separately, whether a module (custom module development), a new integration or a theme change. A move to another server is a migration project. Operating-system administration and monitoring of the server underneath fall under hosting infrastructure consulting. I do not answer your customers' tickets, give legal or tax advice, or work on unlicensed WHMCS copies. For a deeper review of exposure and access, order the security audit. The official WHMCS documentation covers release notes and system requirements. ## What do I need from you? - An admin login and SSH or panel access, which you can revoke at any time. - A list of installed addons, custom modules and who built them, if known. - Someone who can approve upgrade windows and spending on new work. Q: How much does WHMCS support cost? A: Hourly work is $55 to $65 per hour. A monthly arrangement is quoted per scope, because a small reseller with stock WHMCS and a host with a dozen custom modules need very different amounts of attention. I send a written quote within one business day of a short scoping call. Q: How quickly do you respond? A: I typically reply within one business day. I am based in India and work with clients worldwide, so time zones differ. If billing is stopped, put that in the subject line and describe the symptom. I read those first, but I do not promise round-the-clock cover. Q: Should I choose hourly support or a monthly arrangement? A: Choose hourly if you only need help now and then. Choose monthly if you want scheduled checks, planned upgrades and a person who already knows your setup. If you have used more than a few hours of fixes in each of the last few months, monthly is usually the better fit. Q: Do you answer tickets from my customers? A: No. I support your WHMCS system, not your end customers. If a client ticket reveals a fault in billing, cron or a module, send me the technical details and I will fix the cause. Your own team keeps the conversation with the customer. Q: Can you take over an installation another developer built? A: Yes. I start with a baseline review and write down what I find, including edited core files, unsupported modules and missing backups. I then fix the risky items first. I cannot work on unlicensed or nulled copies of WHMCS. Q: Do you upgrade WHMCS the day a release comes out? A: Security releases are applied promptly. Other releases wait until I have read the release notes and run the upgrade on a staging copy with your modules, hooks and theme. A few days of waiting costs little, and a bad upgrade on a live billing system costs a great deal. ## WHMCS AI Chatbot: Ready-Made Module, n8n Workflow or Custom Build URL: https://shahidmalla.com/whmcs-ai-chatbot A WHMCS AI chatbot answers client questions from your knowledge base, drafts ticket replies for staff and reads the logged-in client's own services and invoices. I build these for hosting companies. This page compares that custom route with a ready-made module and an automation workflow, so you can pick the cheapest one that fits. - Routes compared: Ready-made module, automation workflow, custom build - WHMCS access: One dedicated API credential whose role allows only the agreed actions - First launch: Draft mode on one support department, with staff approving each reply - Never automated: Refunds, suspensions, terminations and cancellations - Custom build pricing: Fixed quote or $55-$65/hour; the model provider bills usage to your account ## What can a WHMCS AI chatbot or helpdesk assistant do? A WHMCS AI chatbot can do four jobs well: answer from your knowledge base, draft ticket replies, look up the logged-in client's own services and invoices, and hand off to staff. - Answer from the knowledge base. For each question it searches your articles and policies, replies from the passages it found and links the article. When nothing matches, it says so. - Draft ticket replies. A new ticket gets a suggested answer that an agent edits and sends. This is the WHMCS AI helpdesk job, and it is the safest place to begin. - Look up account facts. "Why is my site down?" is often an overdue invoice and a suspended service. The assistant reads both and says so, for that client only. - Hand off. It opens a ticket with a summary of the chat, so the agent does not start from "how can I help?". If you only need the first and last jobs, a general AI chatbot is enough. If you want it to change things in WHMCS, that is an AI agent; chatbot vs agent explains the line. ## Should I buy a module, use n8n or commission a custom build? Buy a ready-made module if it covers your case, use an automation tool for staff-side drafts, and commission a custom build only when you need control that the other two cannot give. Point | Ready-made WHMCS module | Automation tool (such as an n8n workflow) | Custom build | Setup effort | Lowest. Install, activate and configure. | Medium. Someone wires the steps, prompts and error handling. | Highest. Scope, build and a test on your own tickets. | Control over data | Set by the vendor. Ask whether requests go straight to the model provider or through the vendor's servers. If the code is ionCube-encoded you cannot read what it sends. | High if you self-host the tool. On a hosted plan, ticket text also passes through that service. | Highest. You approve the list of fields that may leave your server. | What it can access | Whatever the vendor chose. It runs inside WHMCS, where it can use the client session and API roles do not apply. | Whatever the API role allows. It sits outside WHMCS and has no client session. | Only the actions written into the scope. | Running cost type | License fee to the vendor. Model usage is on your own provider account or included, depending on the product. | Hosting or a subscription for the tool, plus model usage and upkeep of the workflow. | Model usage, hosting for the search index, and paid changes later. | Fits when | Your support process is ordinary and the module's rules suit you. | You want ticket drafts for staff and already run automations. | You have unusual products, strict data rules or several systems to read. | ## Which WHMCS API actions does an AI assistant need? It needs about six, and half of them only read. These are action names from the WHMCS API reference at developers.whmcs.com. API action | Used for | Type | GetClientsProducts | Product name, domain, status and next due date. | Read | GetInvoices | Unpaid and overdue invoices. | Read | GetTickets | Earlier tickets, for context and for the hand-off summary. | Read | AddTicketNote | Saving a draft as a note that only staff see. | Write, internal | OpenTicket | Turning a chat into a ticket at hand-off. | Write, low risk | AddTicketReply | Sending an answer to the client. | Write, client-facing; added last, if at all | The credential should start read-only and be restricted by an API role, because ticket text is written by strangers and a model can be talked into attempting things. The limit has to sit in WHMCS, where no prompt can move it. A WHMCS API credential is an identifier and a secret that take their permissions from a role, which is a list of ticked actions. I create a role with the three read actions, then add each write action when you approve it. Actions such as ModuleSuspend, ModuleTerminate and AddCredit are never ticked, so WHMCS refuses them whatever the model writes. The caller's address also goes into the API IP access restriction setting. A role cannot limit whose data is read. That check lives in code: the client ID comes from the client-area session and is never chosen by the model. WHMCS API integration and automation covers credentials in more depth. ## What data goes to the model provider, and how do I limit it? Three things are sent: the client's message, the knowledge base passages found for it, and whatever a lookup returned. A GetClientsProducts response holds much more than a status, including the service username, so each tool passes on a short allow-list of fields and drops the rest. - Passwords, card details and API keys are never placed in a prompt. - Anything code can answer, such as "is this invoice overdue?", is answered in code and sent as one plain sentence. - Logs are kept for a period you set and are readable by named staff only. - Read the provider's current data terms for your plan, and tell clients they are talking to an AI. ## Why run in draft mode before auto-reply? Draft mode shows you how often the assistant is right on your own tickets before a client ever reads its words. In a custom build, a hook on TicketOpen or TicketUserReply triggers the draft, and the agent sees it as a private note. You then count how many drafts were sent unchanged, edited or thrown away, by question type. Auto-reply is a decision you make later with those counts in hand, one category at a time. ## How do I build a WHMCS AI chatbot? I build it in six steps, on a staging copy, and the test on past tickets comes before any client sees it. - Scope. Departments, question types and permitted actions, in writing. - Knowledge base clean-up. Two articles that disagree produce two different answers, so each fact gets one source. - Retrieval. Articles are split at headings and indexed. Below a set match score the assistant does not answer. - Tools. One small function per API action, with its arguments validated. - Test on past tickets. Closed tickets are replayed and the drafts are compared with what staff wrote. - Pilot on one department. Draft mode, with staff approving each reply, then a decision to widen or stop. ## What will a WHMCS AI support assistant not do? It will not make money or access decisions, and it will sometimes be wrong. - No automatic refunds, credits, suspensions, terminations or cancellations. - No promised resolution or deflection rate. Those depend on your articles and your clients, so I measure them on your tickets. - No pretending to be a person. A client can always ask for staff. - It will give wrong answers at times. Sources, testing and draft mode reduce that; nothing removes it. ## Is this comparison neutral? No. I own two of the ready-made options: MagizAI, an AI live chat with a free WHMCS module, which I describe on its own page, MagizAI for hosting providers, and WHMCSPilot.com, which sells WHMCS modules. I also sell custom builds, so I have a commercial interest in every route in the table above. The comparison itself names no product, so that you can apply it to any vendor. A ready-made module, from any vendor, can be the cheaper answer, and if your needs are ordinary I will say so on the call. What a WHMCS-aware chatbot needs to do gives you criteria for judging any product. ## What does a custom WHMCS AI chatbot cost? The build is a fixed quote for a written scope, or $55-$65 per hour, and the model provider bills usage to your own account. The quote grows with the number of tools, departments and languages, and with the state of your knowledge base. After the two weeks of post-delivery support, prompt changes and WHMCS upgrade checks can go under WHMCS support and maintenance. Q: Is there an AI chatbot for WHMCS? A: Yes, and there are three ways to get one. Several vendors sell ready-made WHMCS modules. Automation tools such as n8n can connect a language model to the WHMCS API. A developer can also build one to your own rules. The right route depends on how much control you need over data and behavior, and on whether your support process is ordinary enough for an off-the-shelf product. Q: Can a WHMCS AI chatbot reply to tickets automatically? A: Technically yes, through the AddTicketReply API action. I do not start there. The first version saves each suggested answer as a staff-only note, and an agent approves or edits it. After a few weeks you can see which question types the drafts get right nearly every time, and switch on auto-reply for those alone. Everything else stays with staff. Q: Can the chatbot show one client another client's invoices? A: Not if it is built correctly. The WHMCS API itself does not know who is chatting, and a read credential can read every client. So the client ID is fixed by server-side code from the client-area session, and the model cannot change it. Typing someone else's email address or invoice number into the chat returns nothing. I test this case before launch. Q: Will the assistant issue refunds or suspend services? A: No. Refunds, credits, suspensions, terminations and cancellations stay with your staff. The API role I create does not include those actions, so WHMCS rejects the call even if the model is tricked into attempting one. The assistant can explain your refund policy from the knowledge base and open a ticket for the billing department with a summary. Q: Is an n8n workflow enough for WHMCS AI support? A: For staff-side jobs, often yes. A workflow that reads a new ticket, asks a model for a draft and saves it as a note is a reasonable n8n project. It is weaker for a chat with logged-in clients, because the workflow sits outside WHMCS and has no client session, so identity checks have to be built separately. Someone also has to maintain the workflow. Q: What does a WHMCS AI chatbot cost? A: A ready-made module costs a license fee set by its vendor. A custom build from me is a fixed quote for a written scope, or $55-$65 per hour. On top of a custom build, the model provider bills usage to your own account, and that amount depends on ticket volume and the model chosen. I add a daily spend cap and an alert so that the bill stays predictable. Q: What do you need from me to start? A: An export of your knowledge base, a sample of closed tickets with personal details removed where you can, and a staging copy of WHMCS or permission to build one from a backup. I also need an admin who can create the API role and credential, and one person who decides which answers are correct when two articles disagree. ## MagizAI: AI Live Chat for Hosting Providers That Reads WHMCS URL: https://shahidmalla.com/magizai MagizAI is an AI live chat I built for hosting companies. It answers plan, domain, DNS and billing questions from your own WHMCS, shows a signed-in client their services and unpaid invoices, and hands harder cases to your staff. The WHMCS module is free and plans start at $10 a month. - My role: Founder and CEO of MagizAI. This page is about my own product - Price: From $10 a month (bring your own AI key). No free tier - WHMCS module: Free addon module; WHMCS 8.0 or newer, PHP 7.4 or newer - Setup: One line of code on a website, or the module inside WHMCS - Account actions: Each one is off until you switch it on, and the client must confirm ## What is MagizAI, and who is behind it? MagizAI is an AI chatbot and live chat for websites, with a free module that connects it to WHMCS. I am its founder and CEO, so this page describes my own product and I gain if you buy it. Everything below about features and prices is taken from magiz.ai as published on 10 October 2026, and you should check that site for the current details before you decide. The module is also listed on the WHMCS Marketplace. I built it because of what I see in hosting support queues. A large share of tickets ask the same things: which plan fits, why a domain does not resolve, why a site is suspended, where the invoice is. The answers already sit in WHMCS and in the knowledgebase. MagizAI reads them and replies at any hour, so your staff spend their time on the cases that need a person. ## What does MagizAI answer for a hosting company? It answers pre-sales and account questions from your own WHMCS data, and it treats a visitor and a signed-in client differently. Who is asking | What MagizAI can answer | Where the answer comes from | A visitor on your site | Plans and prices, domain availability and register, renew and transfer prices, open network issues, how-to questions | Your WHMCS plans, domain pricing, announcements and knowledgebase, synced nightly | A signed-in client | Service status, domain details, unpaid invoices with pay links, renewal dates, ticket status, upgrade pricing | That client's own records in WHMCS, and nobody else's | Anyone it cannot help | An offer to bring in a person | A ticket or a live hand-off to your team | Replies come in the visitor's language, and the assistant shows which of your documents an answer came from. Answers you pin are given word for word, without the AI rewriting them, which is useful for refund terms and anything legal. ## Is everything automatic? The routine work is automatic, and the risky work is deliberately not. That split is the reason I would trust it on a billing system. - Automatic: answering from your content, detecting the language, showing sources, capturing a lead's name and email from the conversation, summarizing a chat for hand-off, suggesting tags, re-checking your pages and syncing WHMCS plans and prices each night. - Automatic only after you switch it on: client actions such as changing nameservers or auto-renew, opening, replying to and closing tickets, renewing or upgrading early, resetting a control panel password, and resending a welcome or invoice email. - Never without the client's yes: each of those actions waits for a Confirm tap. Showing a password needs a one-time code emailed to the account address, which works once and expires after ten minutes. - Not handled in chat: card details and domain transfer codes. A transfer code goes only to the account email. So the honest answer is no, and you would not want it to be. An assistant that changed billing records without a confirmation step would be a liability. ## How much does MagizAI cost? MagizAI lists four plans, all billed monthly, with every AI feature included on each. There is no free tier. Plan | Price per month | Messages | Bots and seats | AI provider | BYOK | $10 | Unlimited | 3 bots, 3 seats | Your own key; you pay the provider directly | Starter | $20 | 2,000 a month | 3 bots, 3 seats | Managed keys, AI included | Pro | $49 | 5,000 a month | 15 bots, 15 seats | Managed keys, plus white label and priority support | Business | $99 | 15,000 a month | 30 bots, 30 seats | Managed keys, plus white label and priority support | Prices as listed on magiz.ai/pricing on 16 October 2026, excluding GST. Paying yearly saves up to 25%; the pricing page has the current figures. Agencies that resell it under their own brand have a separate white-label plan. Three details matter for a hosting budget: - On Starter, Pro and Business, AI replies pause when you reach the monthly message limit. You are not charged for going past it, and the inbox keeps working. - On BYOK, the AI cost is whatever your provider charges you. Set a spending limit in that provider's account. - MagizAI states a full refund within 7 days of the first payment, and none after that. ## How does MagizAI compare with other ways to add AI chat to WHMCS? It sits between a general chat widget and a custom build. Which is right depends on how much of your support is routine. | General chat widget | MagizAI | Custom build | Knows the client's services and invoices | No, unless you build the link | Yes, through the free WHMCS module | Yes, as far as you specify | Can act in WHMCS | No | A fixed list of actions, each switched on by you | Whatever you have built and tested | Time to first use | Minutes | Minutes for the widget, a short setup for WHMCS | Typically weeks, depending on scope | Cost shape | Monthly fee | Monthly fee from $10 | A build cost, then running costs | Best fit | Simple contact chat | Common hosting questions and safe account actions | Unusual rules, your own model or deep ticket changes | I describe the three routes without my own product in WHMCS AI chatbot: module, workflow or custom build. If you need the custom route, that is AI chatbot development. ## How is client data protected? MagizAI does not hold a WHMCS admin API key. According to its WHMCS page, the module signs a short-lived token on each client-area page load and checks it again before any read or change. - Lookups run for the signed-in client only. - Only public content, such as the knowledgebase, announcements, plans and prices, is synced out of WHMCS. Client data stays inside it. - Every request is written to the module's activity log, and every change to the WHMCS activity log. The client receives an email about a change. - Passwords are not saved in the chat transcript. Before you rely on this, read the MagizAI security page, and decide what your privacy policy must say about an AI provider processing chat text. That decision is yours, not the vendor's. ## When is MagizAI the wrong choice? It is the wrong choice when you need something a product cannot be bent to do. Choose another route if: - You need a free tier or a long trial. There is none. - The model must run on your own servers, with no outside AI provider. - You want the assistant to issue refunds or credits by itself. I would not automate those in any product. - Your WHMCS is older than version 8.0, or is heavily modified in ways a standard module will not expect. - Your knowledgebase is thin or out of date. An assistant answers from what you have written, so fix the content first. If you want help installing it on a staging copy first, or checking that it sits well with your other modules, that falls under WHMCS support and maintenance. Q: Is MagizAI free? A: The WHMCS module is free to download. The AI chat needs a paid MagizAI plan, and there is no free tier. Plans listed on magiz.ai on 16 October 2026 start at $10 a month if you bring your own AI provider key. MagizAI states a full refund within 7 days of your first payment, which is the closest thing to a trial. Q: Does MagizAI need my WHMCS admin API credentials? A: No. According to the MagizAI WHMCS page, it never holds admin access and has no WHMCS admin API key. The module exposes a small signed endpoint that runs only the actions you have enabled, and every lookup runs for the signed-in client only. Asking about another client's domain gets the same reply as a domain that does not exist. Q: Can MagizAI change things in a client's account? A: Only if you allow it. Each action, such as changing nameservers, opening or replying to a ticket, or renewing early, has its own switch and is off by default. When it is on, the client still has to tap Confirm, sensitive steps need a one-time code sent to the account email, and every change is written to the WHMCS activity log. Q: Which WHMCS versions does the MagizAI module support? A: The MagizAI WHMCS page lists WHMCS 8.0 or newer and PHP 7.4 or newer, with WHMCS 8.8 or newer needed for early renewal. The System URL must use https. Check that page before you install, because requirements change with new releases, and test on a staging copy of your WHMCS first, as with any module. Q: What happens when the assistant cannot answer? A: It is built to say that it does not know instead of guessing, and to offer a person. Depending on your setup, the conversation becomes a WHMCS ticket or a live hand-off that your team picks up, with the chat history attached. Unanswered questions are collected and ranked, so you can see which knowledgebase articles are missing. Q: Is MagizAI only for hosting companies? A: No. It is a general AI chat and live chat product that also serves shops, clinics, schools and other businesses, and it connects to tools such as Shopify, WooCommerce, WhatsApp and Slack. This page covers the hosting use because that is my field, and because the WHMCS module is what makes it specific to hosting providers. Q: Should I use MagizAI or have a custom chatbot built? A: Use a ready-made product such as MagizAI when your needs are the common ones: answers from your knowledgebase, account lookups and a few safe actions. Have one built when you need logic no product offers, a model running on your own servers, or deep changes to how tickets are handled. I offer both, so I gain either way, and I will tell you which fits. ## ShahidAI Studio: AI Co-Editor for Premiere Pro and After Effects URL: https://shahidmalla.com/shahidai ShahidAI Studio puts Claude, Gemini and OpenAI directly inside Adobe Premiere Pro and After Effects, so you can edit by describing what you want, in plain English or Roman Urdu. Bring your own API key. Works on Windows and macOS. - Works in: Adobe Premiere Pro and Adobe After Effects - Systems: Windows and macOS - AI models: Claude (Anthropic), Gemini (Google) or GPT (OpenAI), with your own API key - Requests: Plain English or Roman Urdu - Support: life@shahidmalla.com - Made by: Shahid Malla, AI and full-stack developer ## What is ShahidAI Studio? ShahidAI Studio is an extension for Adobe Premiere Pro and After Effects that lets an AI model work on your project from a typed request. It connects to Claude, Gemini or GPT through your own API key: you describe the result you want, and it handles subtitles, color, motion, cuts and markers in your timeline. ## How do I add an API key? ShahidAI Studio uses your own key from one of three providers. Create a key, then paste it into the extension's settings: - Claude: Anthropic Console, API keys - Gemini: Google AI Studio, API keys - GPT: OpenAI Platform, API keys Each provider bills its usage to your own account, so it is worth setting a monthly spending limit in that provider's console. ## How do I get help with ShahidAI Studio? Email life@shahidmalla.com. To get a fix quickly, include: - Premiere Pro or After Effects, and its version - Windows or macOS, and its version - Your ShahidAI Studio version - The AI provider you use: Anthropic, Google or OpenAI - What you asked for, what happened, and a screenshot of any error Never send your API key by email. If you suspect a key has leaked, revoke it in the provider's console and create a new one. Q: What is ShahidAI Studio? A: ShahidAI Studio is an AI co-editor for Adobe Premiere Pro and After Effects. It brings Claude, Gemini and GPT into your timeline, so you can ask for animated subtitles, Roman Urdu captions, color grading, motion and cuts in plain words. Q: Which apps and systems does it work with? A: Adobe Premiere Pro and Adobe After Effects, on Windows and macOS. Q: Do I need my own API key? A: Yes. ShahidAI Studio works with your own key from Anthropic (Claude), Google (Gemini) or OpenAI (GPT), and the provider bills its usage to your account. Create one at Anthropic, Google AI Studio or OpenAI. Q: Can it transcribe audio without an internet connection? A: Yes. Speech-to-text can run locally on your computer (offline), or you can transcribe in the cloud. Either way, the transcript can be turned into clean, timed captions. Q: Which languages does it support? A: You can type requests in plain English or Roman Urdu. Captions can be translated and transliterated into Roman Urdu, Urdu, Hindi, Arabic, Spanish and more. Q: What subtitle styles and animations are included? A: Styled captions with custom fonts, colors and outlines, and 7 animations, including karaoke highlight, word pop and typewriter. Q: Can ShahidAI Studio color grade my footage? A: Yes. Describe the look you want and it creates a Lumetri grade, or pick one of the built-in cinematic presets. Q: How do I get help? A: Email life@shahidmalla.com with your app and its version, your operating system, the ShahidAI Studio version, the AI provider you use, what you asked for and what happened. A screenshot of any error helps. Never send your API key by email. ## Start a Web Hosting Business: Setup and Launch Help URL: https://shahidmalla.com/start-a-hosting-business I am Shahid Malla, and I help owners start a web hosting business. We choose between reseller hosting, VPS reselling or your own hardware, then I build the working stack of WHMCS billing, a control panel, payment gateways, a registrar connection, a support desk, monitoring and backups. It suits developers, agencies and first-time founders. - Typical launch: About 7 to 14 days when niche, pricing and model are already decided - Stack: WHMCS, cPanel/WHM, payment gateways, registrar API - Starting models: Reseller hosting, VPS or cloud reselling, own hardware - Pricing: Fixed quote after a free scoping call, or $55-$65/hour ## What are the ways to start a web hosting business? There are three practical ways to start a web hosting business: resell someone else's hosting, resell VPS or cloud servers that you administer, or run your own hardware. They differ in how much you control, how much you risk and how many server problems end up on your desk. Model | Setup effort | Margin control | Risk | Support load | Reseller hosting | Low. A reseller account, WHMCS and a connection between them. | Limited. You set retail prices, but wholesale cost and resource caps belong to the upstream host. | Little capital at risk. Your customers' uptime depends on a company you do not run. | Light on servers, since the upstream host fixes them. You still answer customers first. | VPS or cloud reselling | Medium. You install and secure the panel, wire provisioning and own the operating system. | Good. You choose server size, software stack and how many accounts share a machine. | Medium. Security, capacity planning and backups become your job. | Medium to high. Customer problems and server problems both reach you. | Own hardware | High. Rack space, machines, network, IP space and spares before the first customer. | Highest. You control the whole cost base. | Highest. Money is committed up front, and a failed disk or a lease is yours to deal with. | Highest. Everything from hardware to billing is your responsibility. | For most first-time owners I suggest reseller hosting or a single VPS, proving that customers will pay, and moving up later. Moving up is routine work, covered under server migration and backup. If you want to do the groundwork yourself first, my step-by-step guide how to start a web hosting business with WHMCS covers the model, the stack, the WHMCS setup order and a launch checklist. ## What stack do I set up for a hosting company? I set up seven layers (billing, panel, payments, domains, support, monitoring and backups) and connect them so that a paid order becomes a working hosting account with no manual step in between. Layer | What I configure | What I need you to decide | Billing and automation | WHMCS products, billing cycles, tax rules, invoice and reminder emails, automation settings and the cron job. | Currencies and pricing structure. | Control panel | cPanel and WHM, linked to WHMCS through an API token. | Whether you run your own server or use a reseller account. | Payment gateways | Gateway modules, webhooks and fraud rules, tested with sandbox and small real payments. | Which countries you will sell to. | Domains | A registrar module for register, renew and transfer, plus pricing and TLD rules. | Which registrar account to use. | Support desk | Departments, canned replies, email piping and a knowledge base skeleton. | The hours you can really staff. | Monitoring | External uptime checks, disk and mail-queue alerts, routed to a named person. | Who receives alerts. | Backups | Local and off-site copies of accounts and the billing database. | Retention and storage location. | Billing is the layer people underestimate. Read WHMCS development and payment gateway integration to see what it involves. ## What should I decide before building anything? Decide four things first: your niche, your pricing structure, where the servers sit and which hours you will answer tickets. Undecided plans are the main reason a launch takes weeks. - Niche. A host that serves everyone competes on price alone. Agencies, WooCommerce stores, one region or language, or developers who want SSH access are all specific enough to describe in one sentence. - Pricing structure. Choose billing cycles, setup fees, how renewal prices differ from first-term prices, what each plan limits (disk, inodes, CPU, outgoing mail per hour) and whether upgrades are prorated. WHMCS can model all of it, but every choice changes how products are built. - Data-center location. Pick the region closest to most of your visitors, then check the provider's network quality, abuse handling and any data-residency needs of your customers. - Support hours. Publish the hours you can staff and a reply time you can keep. A modest, honest schedule beats a vague promise. ## Which legal and operational basics does a hosting company need? You need written terms of service, an acceptable use policy, a privacy policy, a working abuse process and correct tax settings before the first paid order. I configure these in WHMCS, but I am not a lawyer or an accountant, so have yours approve the wording and the rates. - Terms and acceptable use. What is banned, what happens after a breach, and your refund and cancellation rules. - Privacy. What customer data you hold, where, and for how long, plus any regional rules such as GDPR. - Abuse handling. A monitored abuse mailbox, a named owner and a written sequence from first notice to suspension. Unanswered reports damage your IP reputation. - Tax. Tax rules per country or state, VAT or GST number collection and the invoice wording your accountant requires. - Card data. Use gateway-hosted checkout or tokens so card numbers never sit on your own server. ## What mistakes sink new hosting businesses? Four mistakes cause most of the damage: underpricing, having no abuse policy, never restoring a backup and weak fraud screening. Each is cheap to prevent before launch and expensive afterwards. Mistake | What happens | What I do about it | Underpricing | The price only works if nobody opens a ticket, asks for a refund or disputes a charge. | We cost one account first: license share, gateway fees, support minutes. Then we set the price. | No abuse policy | One spammer or phishing site gets the server IP blocklisted, and honest customers' mail bounces. | Published policy, hourly mail caps in the panel, outbound mail alerts and an abuse mailbox. | No backup restore test | Jobs report success for months, then the first real restore fails on a missing database or a full disk. | I restore a sample account onto a scratch server before launch, then we repeat on a schedule. | Weak fraud screening | Stolen-card orders create real accounts, then chargebacks arrive and the account sends spam. | Fraud rules in WHMCS, review of first orders and provisioning held until payment clears for new clients. | ## How long does it take to launch a hosting business? When the plan is clear, a hosting business can usually be operational in about 7 to 14 days. When the niche, prices or model are still open, the decisions take the extra time, not the technical work. Most delays come from outside approvals. A payment gateway may review your business before it goes live. A registrar may need a deposit to clear. A panel license may need a server IP that is already provisioned. I list these on day one so that they run in parallel with the build. A tight launch also needs fast answers from you on pricing, email wording and policy text, because every open question holds up a product or template. ## Who am I, and do I recommend a hosting provider? I do not recommend any hosting provider or panel on this page. I am CTO at ElySpace, a hosting company, and I previously held roles at Fada.cloud and Nuco.cloud. I also founded WHMCSPilot.com, which sells premium WHMCS modules and themes. Because of those ties, treat any provider or product name you hear from me with that in mind. Here I stay neutral and configure whatever you choose. ## Where my help stops I do not give legal or tax advice, forecast revenue or promise customers, and I do not staff your support desk unless we scope it separately. I do not install nulled or unlicensed WHMCS, panel or plugin copies, and I do not edit WHMCS core files. Pricing is a fixed quote after a scoping call, or $55 to $65 per hour. To start, describe where you are on the project form. Q: How much does it cost to start a web hosting business? A: The costs fall into a few buckets: the WHMCS license, a panel license if you run your own server, upstream hosting or server rental, a registrar deposit, gateway fees, a brand and website, and your time. Prices differ by provider and country, so I do not quote figures here. My own fee is a fixed quote or $55-$65 per hour. Q: Is reseller hosting or a VPS better for a beginner? A: Reseller hosting is usually easier for a first business because the upstream host runs the servers and you only manage customers. A VPS gives you control over the stack and the margin, but security, updates and backups become your job. Many owners start as resellers and move to a VPS once they have paying customers. Q: Do I need technical skills to run a hosting company? A: You do not need to administer servers yourself, but someone must handle server incidents, abuse reports and billing questions. On a reseller plan, the upstream host covers the servers. On your own VPS you need either your own skills or a person you can call. I build the automation and write the handover notes. Q: How soon can I take my first order? A: When the niche, plans and prices are settled, the stack is typically operational in 7 to 14 days. Waiting for approvals can stretch that, for example a payment gateway account review or a registrar deposit clearing. I tell you which approvals to request on day one so they run in parallel with the build. Q: Can you recommend a hosting provider or control panel? A: Not on this page. I am CTO at ElySpace, a hosting company, and I previously held roles at Fada.cloud and Nuco.cloud, so I have a conflict of interest when it comes to naming providers. I explain the trade-offs between models and panels and let you decide. I then configure whichever provider and panel you choose. Q: What if a customer abuses my servers? A: You need an acceptable use policy and a written abuse process before launch. I set hourly mail limits, outbound mail alerts and an abuse mailbox, and I document the steps from notice to suspension. Spam and phishing can get your server IP blocklisted quickly, which affects every other customer on it. ## Server Hardening Service for Linux and cPanel Servers URL: https://shahidmalla.com/server-security-hardening I harden Linux and cPanel servers by closing what is not needed and testing each control from outside, covering SSH, firewall, patching, PHP isolation, mail abuse limits, logs and backups. It is for hosting owners and agencies who want less exposure and a clear plan for when something still goes wrong. - Typical timeline: About 1 to 3 days per server, depending on services and scope - Output: A written list of changes, checks run and risks left open - Platforms: Linux servers, with or without cPanel and WHM - Pricing: Fixed quote after a free scoping call, or $55-$65/hour ## What does a server hardening service check? A server hardening service reduces what an attacker can reach and what they can do if they get in. I work through twelve controls and test each one, so nothing on the list is assumed to work. Control | Why | How I verify | SSH keys only, no root password login | Passwords are what brute-force bots guess all day. | sshd -T shows passwordauthentication no and restricted root login, then a login test from a second session. | Brute-force protection | Limits repeated guesses on SSH, panel and mail logins. | Failed attempts from a spare address get blocked and the block shows in the logs. | Host firewall, minimal open ports | Every listening service is attack surface. | ss -tulpn on the server compared with an outside port scan and the list of intended ports. | Panel ports restricted | WHM on port 2087 is effectively a root login page. | Where resellers do not need WHM, the port is unreachable from an address that is not on the allow-list. | Kernel and panel patching | Mass attacks target known flaws that already have fixes. | The running kernel matches the installed one, update logs are clean and no reboot is pending. | WAF rules | Blocks common exploit probes aimed at web applications. | A harmless request that matches a rule gets a 403 and an audit-log entry. | Malware scanning | Finds web shells and injected code in customer files. | The scanner flags a harmless test file placed in a scratch account. | PHP limits | Stops one customer's code reaching system functions or other accounts. | A test script on one account cannot read another account's files or call a disabled function. | Mail abuse controls | One hijacked mailbox can blocklist the server IP within hours. | Hourly caps trigger in a controlled test and the queue alert fires. | Least privilege | Admins, databases and API tokens should hold only the power they need. | Review of sudo users, panel tokens and per-application database users. | Log review | An intrusion is invisible in logs nobody reads. | Logs are copied to a second location and I run one review pass during the job. | Protected backups | An intruder with root deletes backups stored on the same machine. | Backup credentials cannot delete old copies, and a restore from them works. | Patching has one wrinkle on cPanel servers. The panel manages its own packages, so I let its updater handle those and the operating system updater handle the rest. Kernel fixes need a reboot unless a live-patching service is in place. I schedule that reboot with you. ## How do open-source and commercial WAF and malware tools compare? Both kinds work, and the right pick depends on budget, who will read the alerts and how much false-positive tuning you will accept. I describe the trade-offs and configure the tool you choose. ModSecurity with the OWASP Core Rule Set is open source and free. It blocks common attack patterns, but it needs tuning and someone must read its audit log. Commercial server security suites, Imunify360 for example, bundle vendor-maintained rules, malware scanning, cleanup tools and support for a per-server license fee. Open-source scanners such as ClamAV and Linux Malware Detect carry no license cost, but you maintain the signatures and own the cleanup process. A cloud WAF in front of a website is a different layer. It filters web traffic before it reaches the server, but it does nothing for SSH, mail or panel ports. ## How do I harden PHP on a hosting server? The strongest PHP hardening is isolation. Each account's PHP runs as its own Unix user through PHP-FPM, and the settings in php.ini add friction on top of that. - disable_functions. Block process-execution functions such as exec, passthru, shell_exec, system, proc_open and popen. Test with real applications first, because some plugins call them legitimately. - open_basedir. Limits file access to the account's own directories. It is useful but weak alone, so I treat it as a second layer behind user separation. - Defaults. Set expose_php and allow_url_include off, and keep upload and session directories out of world-writable locations. - Old versions. Remove PHP versions that no longer receive security fixes once customers have moved off them. ## Can hardening stop every attack? No. Hardening lowers risk and shortens an attacker's window, but it cannot prevent every attack. Unknown flaws in the panel or other software, stolen customer passwords, a vulnerable plugin inside one customer's website and a phished administrator all bypass server controls. So the job includes detection, backups you can restore and a written response plan, and the report lists which risks remain open instead of calling the server secure. ## What should I do in the first hour after a compromise? In the first hour, contain the damage, keep the evidence and change credentials from a clean machine. Do not start cleaning yet. - Preserve. Take a provider snapshot if you can, and copy /var/log, the process list and the output of last -F somewhere safe. Avoid rebooting, which discards memory evidence. - Contain. Restrict inbound traffic to your own address at the firewall or the provider's network level, and stop outbound mail so the server stops spamming. - Rotate credentials. Change root and SSH keys, WHM and cPanel passwords, API tokens and database passwords, using a computer you trust. - Look for persistence. Check authorized_keys files, extra accounts with user ID 0, cron entries, new systemd units and modified system binaries (rpm -Va on RHEL-family systems). - Decide. If root was reached, rebuild on a clean system and restore data from a backup that predates the intrusion. Cleaning in place leaves doubt. - Tell people. Notify affected customers as your contracts and local law require, and keep notes of what you did and when. If WHMCS runs on the same machine, rotate its admin passwords, API credentials and gateway keys too, and consider a WHMCS security audit. Rebuilding relies on tested backups, which is the subject of server migration and backup. ## What a hardening job will not do It will not make the server unbreakable, certify compliance or replace a penetration test. I only work on servers you are authorized to give me access to. Some controls can block legitimate traffic, which is why I stage them and keep rollback notes. Pricing is a fixed quote after a scoping call, or $55 to $65 per hour. For a brand-new machine, hardening is best done before the first customer account lands on it, and alerting is set up in the same project. Q: Will hardening make my server impossible to hack? A: No. Hardening removes easy routes and shortens the time an attacker has, but it cannot prevent every attack. Unknown flaws in software, stolen customer passwords and vulnerable plugins inside customer websites still happen. That is why the work also covers detection, restorable backups and a written response plan. Q: How long does server hardening take? A: One server with a standard cPanel stack typically takes one to three working days, depending on the number of services and how much needs rebuilding. Servers that have run for years without review take longer because I test every change against live sites. I give you a date after the review step, not before. Q: Will hardening break my customers' websites? A: It can if done carelessly. Disabling PHP functions, enforcing open_basedir or switching on ModSecurity rules can block legitimate code. I apply those changes in stages, test against real sites, watch the logs for blocked requests and keep a rollback note for each change. Q: Do I need a commercial malware scanner? A: Not always. Open-source scanners cost no license but need someone to maintain signatures and handle cleanup. Commercial suites bundle rules, scanning, cleanup tools and support for a per-server fee. The right choice depends on budget and who will review alerts. I explain the trade-offs and configure the one you pick. Q: Is this a penetration test or a compliance audit? A: No. It is a configuration review and fix: I check and tighten the server and verify the controls work. It does not replace a formal penetration test or a compliance assessment. If a customer or regulator requires an independent report, that needs a specialist firm, and I will tell you so. Q: My server is already compromised. Can you help? A: Yes. First I contain the damage and preserve evidence. If an attacker had root, I recommend rebuilding on a clean system and restoring data from a backup that predates the intrusion, then hardening the new server. Cleaning a rooted machine in place always leaves some doubt about what remains. ## cPanel Server Migration and Backup Setup URL: https://shahidmalla.com/server-migration-backup I migrate cPanel servers with the WHM Transfer Tool and a planned DNS cutover, then set up local and off-site backups and prove them with restore tests. It is for hosting owners changing provider, hardware or operating system who cannot afford lost mail, broken sites or a backup that fails when needed. - Typical timeline: About 1 to 5 days, depending on data volume and number of accounts - Downtime: A short cutover window; sites stay live on the old server until DNS moves - Scope: cPanel to cPanel; other panels are scoped separately - Pricing: Fixed quote after a free scoping call, or $55-$65/hour ## How does a cPanel server migration work? A cPanel migration packages each account on the old server, restores it on the new one and then switches DNS, while the old server keeps serving visitors until you are ready. The WHM Transfer Tool on the destination server drives most of it. The Transfer Tool connects to the source server with root credentials, lists the accounts and copies them in batches. Each account is packaged much as /scripts/pkgacct does it, into a cpmove archive, and restored with the same logic as /scripts/restorepkg. I move packages and feature lists first, so accounts land in the right plan. The package carries a lot, but not everything. Item | Travels with the account? | What I check | Home directory files | Yes | Ownership, permissions and symlinks that point outside the account. | Databases and database users | Yes | MySQL or MariaDB version differences, collations and SQL modes, which can break older applications. | Mailboxes, forwarders, filters | Yes | A final sync for messages that arrive during DNS propagation. | Per-account cron jobs | Yes | Paths or URLs that mention the old hostname or IP. | Installed SSL certificates | Yes | AutoSSL cannot renew until the domain's DNS points at the new server. | DNS zones | Yes | Records that contain the old IP, such as A records and SPF. | Dedicated IPs | No | New addresses are mapped to accounts by hand. | Server-level settings: root cron, custom Exim rules, ModSecurity rules, firewall rules, Tweak Settings | No | Rebuilt and compared line by line. | cPanel license | No | A new license for the new IP. | ## How do I cut over to a new server with little downtime? Lower the DNS TTL first, test the new server through a hosts-file override, run a final sync and then change the records. Each step shrinks the window in which a visitor could land in the wrong place. - Lower the TTL. Set the zones to a few minutes, for example 300 seconds, at least one old-TTL period before cutover so resolvers already hold the short value. - Test with a hosts file. Add a line like the one below to your computer's hosts file, so the domain resolves to the new IP on your machine only. Then check pages, logins, uploads, forms, cron-driven features and mail. - Freeze and sync. At a quiet time, pause changes on shops and forums, then run a final transfer of databases and mail. - Switch. Change the A records, or the nameserver glue if the server hosts its own DNS. Watch /var/log/exim_mainlog and the web logs on both servers as traffic moves. - Keep the old server. Leave it running until its logs go quiet, then sync mail one last time. 203.0.113.10 example.com www.example.com ## Which settings depend on the server's IP address? More settings depend on the IP than most owners expect, and each one fails quietly until someone notices. - Licenses. The cPanel license and any other software license bound to the address. - Mail identity. The PTR record, SPF records that list the old IP and the new IP's reputation on blocklists. - Allow-lists. Remote database access, payment gateways, registrar APIs, firewalls on other servers and the WHM API token rule. - WHMCS. The server entry holds an IP, a hostname and a token. If billing is moving as well, plan it as its own job, described under WHMCS migration. - Hard-coded values. IP addresses written into cron jobs, scripts, monitoring targets and application configs. ## What backup strategy should a hosting server have? Keep one local copy for fast restores, one encrypted off-site copy for disasters and a retention schedule that matches how much data you can afford to lose. Two numbers drive the design: the recovery point (how much recent data can be lost) and the recovery time (how long a restore may take). Copy | Where it lives | What it protects against | Local | A separate disk or volume on the same network | Deleted files and bad updates, with the fastest single-account restore. | Off-site | A different provider or region, reached over SFTP or S3-compatible storage | Loss of the server, a provider outage or an account lockout. | Protected | Storage the server can add to but not delete from or overwrite | Ransomware, and an intruder with root. | In WHM I set up Backup Configuration with a remote destination and a retention rule you choose. I also copy system configuration such as /etc and /var/cpanel, because account archives alone cannot rebuild a server. Encrypt before data leaves the machine, store the key away from both the server and the backup store, and add a heartbeat check, as described under hosting infrastructure consulting, so a silent failure raises an alert. ## How do I know a backup actually works? You only know after you restore it, because a backup that was never restored is untested. Jobs can report success for months while archiving empty databases or missing directories. My test uses three accounts: the largest, one with heavy mail and one with many databases. I restore them onto a scratch server with /scripts/restorepkg or WHM's restore tool, load each site through a hosts-file override, compare database table counts and open a mailbox. I record the time taken and anything missing. That time is your real recovery time. I repeat the test after any change to the backup system. ## What a migration cannot do A migration cannot make DNS change instantly, repair an application that was already broken or move a server I am not authorized to access. Some resolvers ignore TTLs, so a few visitors reach the old server after cutover, which is why it stays online. I do not move unlicensed software and I do not delete your old server. Moving between different panels is scoped separately. Expect about one to five days depending on scope, with a fixed quote or $55 to $65 per hour. The destination build is part of the same project, and hardening comes next in server hardening. Q: How much downtime is there during a cPanel migration? A: Sites keep running on the old server while we test, and the switch happens through DNS. With a lowered TTL, most visitors reach the new server within minutes, although a few resolvers cache longer. A final sync catches changes made in between, and the old server stays up until its logs go quiet. Q: Will I lose email during the move? A: Not if it is planned. Mailboxes travel with each account. Messages delivered to the old server while DNS propagates are copied across by a final sync of the mail directories. I then check that new mail lands on the new server before the old one is switched off. Q: Can you migrate from Plesk or DirectAdmin to cPanel? A: Sometimes. It is a different job from moving cPanel to cPanel. Accounts are rebuilt with the target panel's migration tools or by hand, and some settings do not map across. I inspect the source first, tell you whether I can take it on and what will not carry, and quote that work separately. Q: How long does a server migration take? A: A few accounts with modest data can move in one or two days. Hundreds of accounts or very large mailboxes take longer because copying and testing take real time. The main drivers are data volume, the number of accounts and any special applications. I estimate after the inventory step. Q: How often should I test restoring backups? A: Test after the backup system is first set up, after any change to it, and then on a schedule you agree, such as monthly or quarterly. A backup that has never been restored is untested. Each test gives you a real recovery time instead of a guess. Q: Are my host's snapshots enough as backups? A: Usually not alone. Snapshots often live in the same provider account as the server, so a billing suspension, an account compromise or a provider outage can remove both together. Keep at least one encrypted copy with a different provider or in a different account, and test restoring from it. ## AI Chatbot Developer: Chatbots for Websites, WhatsApp and Support URL: https://shahidmalla.com/ai-chatbot-development I am Shahid Malla, an AI chatbot developer who builds chatbots for websites, WhatsApp and support desks that answer from your documents and hand off to a person. My own product, MagizAI, an AI chatbot and live chat, is live at magiz.ai. My AI chatbot development tests every bot on your real customer questions before launch. - Chatbots I have built: MagizAI, my own product live at magiz.ai on websites and WhatsApp, and the ElySpace Ask AI assistant - Models: OpenAI or Anthropic for custom builds, chosen by testing on your own questions - Build cost: Fixed quote, or $55-$65/hour. A chatbot is about 35-70 hours by my planning estimate - Running cost: Model usage billed to your own provider account, with a daily spend cap and alerts - When unsure: It says it does not know and hands off to a person with a summary ## What AI chatbots have I built? Three projects show my AI chatbot and copilot work, and each links to its case study. The MagizAI details also come from magiz.ai and its WHMCS Marketplace listing as I read them on 19 October 2026. Project | What the AI does | My role | Where it stands | MagizAI | An AI chatbot and live chat for websites and WhatsApp. It answers from the business's own pages and files in the visitor's language, books appointments, looks up orders, and lets a person on the team take over any chat; WhatsApp conversations arrive in the same team inbox through Meta's official WhatsApp Cloud API. A free WHMCS addon module lets it answer a signed-in client from their own services, domains, invoices and tickets. | Founder and CEO. I designed and developed the product and its website. | Live at magiz.ai. The WHMCS module is listed on the WHMCS Marketplace. | ElySpace Ask AI | An AI assistant that replaces a hosting company's menus with one question, "What are you looking for?". It recommends hosting or domains from the company's own catalog, quotes prices live from the billing system and places the order, while payment stays a separate step the customer confirms. | I built it as CTO of ElySpace. | Live at elyspace.com/ask-ai, marked as a preview. | OnDemand Psychiatry | A clinical decision-support platform for psychiatry. Its public site describes the copilot as supporting diagnostic reasoning, safer care decisions and chart-ready documentation. | Contract AI engineer for two months. I rebuilt the AI copilot. | Live at ondemandpsych.com. The internals of a healthcare product are the client's to describe, so I do not publish them. | Disclosure: MagizAI is my own product. I am its founder and CEO, so I gain if you buy it. ElySpace Ask AI belongs to my employer, where I am CTO. I list it as proof, not as a pitch: it is a chatbot I designed and built myself, and anyone can check it at magiz.ai. A custom build and MagizAI solve different problems, and if the ready-made product covers your need, I will say so on the scoping call. ## Which AI models and tools do I use? For custom builds I use the OpenAI and Anthropic APIs, and I pick the model by testing it on your own questions, not by brand. The rest of the list is what my shipped projects use; I do not list tools I have not shipped with. Layer | What I use | Where it is in use | Language model | OpenAI or Anthropic models behind a thin adapter in the code, so a later switch means changing a setting and rerunning the tests, not a rebuild. MagizAI lets its customers choose Claude, OpenAI, Gemini, DeepSeek, Kimi, Groq, Mistral or OpenRouter, with their own key or with keys included in the plan. | Custom builds; MagizAI | Retrieval from your documents | Vector search in Postgres with the pgvector extension, fused with whole-word keyword search and then reranked, plus a keyword-only mode that works without an embedding key | MagizAI | Content the bot reads | Web pages, sitemaps, written Q&A pairs and files in PDF, DOCX, HTML and Markdown | MagizAI | Channels | A website chat widget, and WhatsApp through the official WhatsApp Cloud API | MagizAI | Business systems | WHMCS through an addon module written in PHP; order lookups in Shopify and WooCommerce; connections to Telegram, Slack, Microsoft Teams, Stripe and HubSpot; any tool that has an MCP (Model Context Protocol) server | MagizAI | Connections around the bot | A REST API, signed webhooks and visual workflows, so other systems can react to conversations and leads | MagizAI | Backend for a custom build | Laravel (PHP), or JavaScript with React, Next.js or NestJS, matching what your site already runs | My working stack | ## Can you build a chatbot trained on your own documents? Yes, though "trained" is the sales word. What I build is retrieval: the bot looks up your documents at question time, and the model is never retrained on them. The technical name is retrieval-augmented generation, or RAG. - Collect and clean. I gather your pages, help articles, PDFs and policies, and we remove outdated pages and duplicate policies so each fact has one source. - Chunk and index. I split the text at headings and turn each chunk into an embedding, a list of numbers that captures its meaning, kept in a vector store with metadata such as product and language. - Retrieve. The chunks closest to each question are sent to the model with it. Below a similarity threshold the bot does not answer; it says it does not know and offers a person. - Answer with the source. The reply links its source page, and the log keeps the chunks used and the cost. - Refresh. When a page changes, its chunks are indexed again. An outdated page gives an outdated answer, so the documents matter more than the model. Rules that matter, such as never quoting a price or discount that is not on your published pages, are enforced in code as well as in the system prompt, because a prompt can be argued with. Visitor text that tries to change the rules, known as prompt injection, is part of the test set. ## Can you build a WhatsApp AI chatbot? Yes. MagizAI, my own product, answers WhatsApp through Meta's official WhatsApp Cloud API: the bot uses the same content and hand-off rules as the website chat, and WhatsApp conversations land in the same team inbox, where a person can take over. WhatsApp differs from a website widget in ways I plan for from the start. I connect the number through your own Meta business account, so the number and its message templates stay yours. Meta's rules decide when a business may write first and when it must use a pre-approved template, and campaigns need the customer's opt-in. Customers also write shorter messages and send photos and voice notes, so the hand-off triggers are tuned on real WhatsApp chats. If MagizAI already covers what you need on WhatsApp, I will say so before quoting a custom build. ## Can an AI chatbot work with WHMCS and hosting support? Yes, and two other pages cover it in depth, so this is the short version. A WHMCS chatbot answers a signed-in client from their own services, invoices and tickets, with the identity taken from the client-area session and never from what is typed, and with access limited to the actions you allow. WHMCS AI chatbot compares a ready-made module, an n8n workflow and a custom build. MagizAI for hosting providers describes my own module, which needs no WHMCS admin API key and keeps every account action switched off until you turn it on and the client confirms it. For running chat in a hosting company around the bot, read live chat for web hosting companies. Disclosure: besides MagizAI, I founded WHMCSPilot.com, which sells WHMCS modules and themes, and I am CTO at ElySpace, a hosting company. ## Can you add an AI chatbot to my website or Laravel app? Yes. On most websites the visible part is one line of code that loads a chat widget; the real work is on the server, where an endpoint fetches your documents, calls the model, enforces the limits and writes the logs. - Any website. The widget script goes before the closing body tag and should run inside a Shadow DOM, an isolated part of the page, so your site's styles and the chat cannot break each other. MagizAI's widget is built this way. - A Laravel application. The chatbot can live inside your app as a route, a queued job that indexes documents and a few tables, and use your existing login, so it knows which customer is asking. It needs no separate service unless traffic calls for one. - WordPress. A small plugin adds the widget without editing the theme. MagizAI already has a WordPress plugin. - Your own SaaS product. If the chatbot is a feature you sell to your customers, each customer's documents must stay separate from the others'; see SaaS development. ## AI chatbot or AI agent: which do you need? Choose by what the visitor needs done: find an answer, ask in their own words, or get something changed. A chatbot answers from your documents and its only write is the hand-off ticket; an agent is given tools that act in your systems. Option | Suits | What it costs to run | Main risk | FAQ page | A dozen stable questions. | Hosting and someone keeping it current. | Visitors do not find the answer. | Chatbot | Many questions in many wordings, answered from existing documents. | Model tokens on every message, plus hosting for the vector store. | A wrong or off-topic answer. Sources, "I don't know" and testing reduce it. | AI agent | Tasks that change something, such as updating an order. | The same, plus more model calls per task. | A wrong action. Narrow permissions and human approval reduce it. | If a good FAQ page would do, I will say so. AI chatbot vs AI agent compares the trade-offs in depth, and AI agent development covers bots that act. ## How much does it cost to hire an AI chatbot developer? With me, building a custom AI chatbot that answers from your documents is about 35 to 70 hours by my planning estimate, which is $1,925 to $4,550 at $55-$65 an hour, or a fixed quote. Running it is a separate monthly bill that the model provider charges to your own account. Cost | Figure | Who you pay | Build: chatbot that answers from your documents, with hand-off | 35-70 hours, $1,925-$4,550 | Me, as a fixed quote or hourly | Build: agent with two read-only lookups and one action behind approval | 81-168 hours, $4,455-$10,920 | Me, as a fixed quote or hourly | Running: model tokens | $6.90-$138 a month in my worked example of 3,000 support conversations, at list prices read on 15 October 2026 | The model provider, on your account | Upkeep: reading logs, fixing documents, retesting after a model change | 2-6 hours a month, $110-$390 | Me, or your own staff | Ready-made instead: MagizAI | From $10 a month before tax, on the plan where you bring your own AI key and pay the provider directly | MagizAI, plus your provider | The hours are planning estimates, not quotes. What an AI chatbot or agent costs breaks them down task by task and shows the token arithmetic. Document cleanup varies most: a tidy help center sits at the low end, while PDFs, conflicting policies or a second language push the hours up. After a free scoping call of about 30 minutes I send a fixed quote within one business day, as on how I work. Three limits keep the running cost predictable: a cap on messages and reply length per conversation, a per-visitor rate limit, and a daily spend cap with an alert before it is reached. From the first weeks of logs I report the real cost per conversation. ## How long does AI chatbot development take? A chatbot that answers from your documents is 35 to 70 hours of my work. The calendar time depends mostly on how quickly the questions and documents arrive, and the written quote gives you a date. Stage | Hours (planning estimate) | What decides where it lands | Scoping and gathering 50-100 real customer questions | 3-6 | Whether tickets and chat logs can be exported | Document cleanup and indexing | 4-12 | PDFs, duplicates, conflicting policies, a second language | Retrieval, system prompt, rules and hand-off triggers | 8-14 | How many topics are reserved for staff | Chat widget, streaming replies, rate limits, retries | 6-12 | Whether it must match a login or a custom design | Masked logs, spend caps, alerts | 4-8 | Retention and access rules | Running the question set, fixing causes, rerunning | 6-12 | How many answers fail the first run | Launch on one page or section, first review, handover notes | 4-6 | Traffic in the first weeks | For scale: a whole WhatsApp marketing platform I built earlier, in which the AI chatbot was one part, took five weeks. A WhatsApp, WHMCS or helpdesk connection adds hours to a chatbot; tools that change data turn it into the agent row in the cost table. ## What happens to my data and my customers' data? The visitor's message, the recent conversation and the document chunks needed for the answer go to the model provider's API, and nothing else should. - Redaction. I mask email addresses, phone numbers and card-like numbers before text is sent or logged, unless the answer needs them. Pattern matching misses some formats, so retention and access limits matter too. Card data, passwords and API keys are kept out of prompts, and text a visitor types is masked on a best-effort basis. - Retention and access. Logs are kept for a period you choose, then deleted, and only named staff accounts can read them. - Provider terms. OpenAI and Anthropic publish data-use terms for their business APIs. Read the current ones for your plan. The widget tells visitors they are talking to an AI. I do not claim a chatbot makes you compliant with any law; ask your own adviser what applies. ## What should I ask any AI chatbot developer before hiring? Put these seven questions to me or to anyone else. - Can I see a chatbot you built that is running now, and what was your part in it? - Which model is used, and can it be switched without a rebuild? - What does the bot say when it does not know? - Can I see test results on my own questions before launch? - What does one conversation cost, and what stops a runaway bill? - Who reads the logs, and for how long are they kept? - Who owns the code, prompts and accounts at handover? ## What chatbots will I not build? I will not build a chatbot that misleads people or answers where a wrong answer costs too much. - One that pretends to be a human. It says it is an AI, and a visitor can always ask for a person. - Deceptive or spam uses: fake reviews, impersonation or mass unsolicited messages. - Bots that give medical or legal advice to the public. The OnDemand Psychiatry work was a copilot for clinicians, not a bot that advises patients. - Any bot sold on a promised resolution or deflection rate. Those depend on your documents and customers, so I measure them and promise nothing. - A chatbot that refunds, cancels or changes accounts without a person confirming. Actions belong to agent work, with narrow permissions and approval. Q: Should I hire an AI chatbot development company or a freelance developer? A: I am an independent developer, not a company, so weigh my answer with that in mind. A company gives you a team: designers, testers and project managers, cover when someone is away, and continuity if one person leaves. A freelancer gives you direct access to the person who writes the code, faster decisions and usually a lower total cost, but only one person's capacity. Choose a company when you need several channels built at the same time, staff answering hand-offs around the clock, or a supplier your procurement rules require to be a firm. For one well-scoped chatbot, a freelancer whose past work you can check is usually enough. Q: Do I need a custom chatbot, or is a ready-made AI chatbot for my website enough? A: A ready-made AI chatbot for your website is enough when you need answers from your pages and files, a hand-off to staff and common integrations. You pay a monthly subscription instead of build hours. A custom build pays off when the bot must follow rules or reach systems that no product supports, or must live inside your own application. My own hosted product is MagizAI, so I gain either way, and on the call I will tell you which route costs you less. Q: Can you build a proof of concept before the full chatbot? A: Yes. The build is ordered so that the first thing you see is the bot answering your own collected questions on a test page, with every wrong or weak answer listed. If you prefer to commit in stages, the quote can cover that test as its own first stage, with the widget, logging and launch after it. If the test shows a chatbot is the wrong tool, for example because the documents are too thin, you hear that before paying for the rest. Q: Will the chatbot make things up? A: It can, and nobody honest can promise it never will. I reduce the chance: it is built to answer only from retrieved text, to show the source, and to say it does not know when nothing relevant is found. Before launch I run your real questions through it and read the failures. After launch, the logs show what went wrong, so it can be fixed. Q: Can I hire you on Upwork or Fiverr instead of directly? A: Yes. I take work through both Upwork and Fiverr, with 580+ five-star reviews on Fiverr, and the work is the same as when you hire me directly. A marketplace adds its own payment protection and its own fees. Hiring directly works through the project form, a call or email. Either way you deal with me personally, from the scoping call to the handover. Q: Who owns the chatbot, the code and the accounts when it is finished? A: Who owns the code, prompts and evaluation questions is written into the quote before work starts. The model provider and hosting accounts are opened in your name, so you can switch developers later. I hand over written documentation that explains how to update the documents and change the settings, and I give two weeks of support after delivery. Q: What happens after the chatbot launches? A: Two weeks of support after delivery are included. In the first weeks we read real conversations together, fix the documents behind unanswered questions and adjust the hand-off triggers. After that, upkeep is about 2 to 6 hours a month by my planning estimate: reading logs, updating documents and rerunning the test questions when the provider changes a model. Your staff can do it with the handover notes, or the monthly developer retainer covers it. ## SaaS Developer: Build a SaaS Website or Product URL: https://shahidmalla.com/saas-development I am Shahid Malla, a freelance SaaS developer. I build SaaS websites, products and customer portals for founders and hosting companies: a Laravel application with a Filament admin panel, Stripe, PayPal or Razorpay billing, roles, background jobs and an API, deployed to your server and handed over with the code. - Typical timeline: Depends on scope; a date follows the written scope - Main stack: Laravel, Filament, Livewire and MySQL - Billing: Stripe, PayPal or Razorpay, with webhooks - Code handover: Code and documentation handed over at delivery; rights agreed in the quote - Pricing: Fixed quote per scope, or $55-$65/hour ## What does a SaaS build with me include? It includes the application, an admin panel for your team, billing, deployment and a handover, delivered as one project. I take a product from a written scope to a live, paid-for service that your own staff can run. This site runs on the same stack: Laravel with Filament. A hosting company often wants a customer portal or reseller dashboard next to WHMCS. In that case I connect the portal to WHMCS through its API, so client and billing records are not duplicated. See WHMCS API integration. ## How do you scope an MVP? I cut the product down to one type of user, one job they need done and one way they pay. Everything else goes on a deferred list. The written scope covers user roles, the core workflow, stored data, the billing model and what is deliberately left out. Stage | What is delivered | Scope | Written scope: roles, core workflow, data entities, billing model and the deferred list. | Design | Database schema, main screens and an API outline, reviewed with you before code. | Core build | Sign-up, login, the core workflow and the Filament admin panel running in staging. | Billing | Plans, checkout, webhook handling, receipts and states for failed payments. | Hardening | Automated tests on billing and permissions, rate limits, error tracking and backups. | Launch | Production deployment, live payment keys, queue workers, scheduler and a real test payment. | Handover | Repository, environment notes, deployment and restore steps, and a walkthrough call. | ## Which stack do you build SaaS products with? My main stack is Laravel with Filament admin panels, Livewire where it fits, and MySQL for data. One framework covers authentication, validation, queues, scheduling, mail and testing, so the budget goes to your product's own logic. - Laravel and Filament: the application, plus the internal panel for users, subscriptions, refunds and settings. - Livewire: interactive screens such as dashboards and forms, without a separate JavaScript application. - Next.js, React or Astro: added when the project calls for them, such as a public marketing site. - Node.js or NestJS: an API service for real-time connections, an existing TypeScript team, or a component that does not belong in PHP. I do not add a second language where one is enough. Every extra service is another thing to deploy, monitor and pay for. ## How is subscription billing built? The payment provider is the source of truth for money, and your database follows it through webhooks. A browser redirect alone never proves a payment succeeded. Providers send events such as invoice.paid and customer.subscription.deleted (Stripe) or subscription.charged and subscription.halted (Razorpay). The webhook endpoint has to handle them safely: - Verify the signature on every request, using the Stripe-Signature or X-Razorpay-Signature header, before trusting the body. - Store each event ID and skip repeats, because providers retry and can deliver events twice or out of order. - Hand the real work to a queued job and answer the provider quickly. - Model the states you need: trialing, active, past due and canceled, with a grace period for failed cards. Plan limits stay in your own code, so a second provider can be added without a rewrite. With the provider's hosted checkout or card fields, card numbers never touch your server. ## How do roles, queues and the API fit together? They are three separate layers, designed up front instead of bolted on later. Roles and permissions. I separate platform staff, account owners and team members. Access rules live in Laravel policies, so users reach only their own account's records, and sensitive actions such as refunds go into an audit log. Queues and scheduled jobs. Emails, webhook processing, report exports and calls to outside APIs run as queued jobs with retries and a failed-jobs table you can inspect. Recurring work such as renewal reminders runs from Laravel's scheduler, which needs one cron entry: * * * * * cd /path/to/app && php artisan schedule:run >> /dev/null 2>&1 API. If customers need an API, I version it from the first route (/api/v1), use token authentication, set per-key rate limits, return one consistent error format and sign outgoing webhooks. ## Which multi-tenancy option fits my product? None is correct for every product. The choice depends on how much isolation customers need and how many of them you expect. Many early products need less than their founders think. Option | How it works | Fits when | Trade-off | Shared database, tenant column | Every table carries an account ID and queries are scoped to it. | Many small customers and a fast start. | A scoping bug can expose another customer's data, so tests must cover it. | Database per tenant | Each customer has a database, selected on every request. | Strong isolation, per-customer restores, data residency rules. | Migrations and monitoring run once per tenant. | Separate install per customer | Each customer gets their own copy of the app and database. | A few high-value customers with custom changes, similar to hosting. | Every update must be rolled out to each copy, so automation is needed. | Packages such as stancl/tenancy and spatie/laravel-multitenancy cover parts of the database-per-tenant route. I settle the choice in the scope document, because changing it later means rewriting the data layer. ## Where can the product be deployed? It can run on a VPS or on a cPanel host, and I choose by workload. A small first version often fits cPanel. A product with constant background work fits a VPS better. On a VPS I set up Nginx or Apache, PHP-FPM, MySQL, a Supervisor-managed queue worker, TLS and backups. On cPanel I point the domain's document root at Laravel's public directory, add the scheduler cron above and run the queue from cron with php artisan queue:work --stop-when-empty. Each release runs php artisan migrate --force, rebuilds the config and route caches and restarts workers with php artisan queue:restart. ## What should a first version leave out? A first version should leave out anything no paying customer has asked for yet. Each extra feature adds code to test and support, and delays the day you learn whether anyone will pay. - Native mobile apps. A responsive web app tests the idea faster. - Single sign-on (SAML) and custom role builders, until an enterprise buyer requires them. - Usage-based metering and complex proration, unless usage is what you sell. - Many languages and currencies beyond your first two or three markets. - Reporting dashboards with many charts. Start with the three numbers you check daily. - A public API, plugin system, white-labeling, referral schemes and in-app chat. These stay on the deferred list, planned for but not built. ## What do I get at handover, and who owns the code? At handover you receive the repository, environment variables, deployment and rollback steps, backup restore instructions and a walkthrough call. Who holds the rights to the custom code is written into the quote before work starts. Open-source and premium packages keep their own licenses. See how I work for how a project runs. ## Which SaaS projects do I decline? I do not copy another company's product or use nulled or pirated scripts. I am not a brand design studio, so I expect a logo and colors from you or your designer. I do not certify products against standards such as PCI DSS or SOC 2. I keep card data with the payment provider and follow sound security practice, but certification is a separate process. ## How long does a SaaS build take, and what does it cost? It depends on scope. I quote a fixed price after the scoping call, or work hourly at $55 to $65 per hour. If you already run WHMCS and want the product to bill through it, a custom WHMCS module may be the shorter route. For an assistant inside the product, see AI agent development. Q: How long does it take to build a SaaS MVP? A: It depends on scope. A product with one core workflow, sign-up, a single billing plan and a basic admin panel sits at the short end. Each extra role, integration or report adds time. I give a date after the scoping call, once the feature list is written down, and not before. Q: Why Laravel and Filament for a SaaS product? A: Laravel has authentication, queues, scheduling, validation and testing built in, so the budget goes into your product instead of plumbing. Filament gives your team an admin panel for users, subscriptions and support lookups quickly. This website runs on Laravel and Filament. If your team already works in another stack, I will say so and we can weigh the trade-off before you commit. Q: Which payment provider should I use for subscriptions? A: Choose by where your customers pay. Stripe suits card payments in many countries. Razorpay suits customers paying in India by UPI, card or net banking. PayPal suits buyers who trust it more than a card form. I keep plan logic separate from the provider, so adding a second one later is a smaller job. Availability depends on your business country and each provider's approval. Q: Can the product run on cPanel shared hosting? A: Often yes, for a small first version. Laravel needs a current PHP version, the right extensions and a document root pointing at its public folder, and background jobs run from cron instead of a permanent worker. A VPS is the better choice once you need always-running queue workers, Redis or heavier traffic. I recommend based on your workload, not by habit. Q: Can you add billing or features to an app I already have? A: Yes, for a defined piece of work such as subscription billing, a customer portal or a new module. I read the code first and tell you what I find before I quote. I work on a staging copy, and I do not work on pirated or unlicensed scripts. Where the codebase is too fragile to extend safely, I say so and explain the options. Q: Who owns the code and the customer data? A: Who holds the rights to the custom code is written into the quote before work starts. The repository is transferred to you at handover, the database sits on your server and the payment provider accounts are in your name, so you hold the customer data and the credentials. Open-source packages keep their own licenses. I ask for temporary access to your servers where possible. Q: What does a SaaS build cost? A: I quote a fixed price for a written scope, or work hourly at $55 to $65 per hour. The price follows the number of roles, billing rules, integrations and screens. Hosting, domain and payment provider fees are billed to you directly by those companies. The scoping call is free and the quote arrives within one business day. ## AI Agent Development: Hire an AI Agent Developer URL: https://shahidmalla.com/ai-agent-development I am Shahid Malla, a freelance AI agent developer for hosting and SaaS businesses. An AI agent is a language model that can use tools within rules you set: answering tickets from your own knowledge base, updating WHMCS tickets through the API, triaging abuse reports and passing anything uncertain to a person. - Models: OpenAI or Anthropic Claude APIs, chosen by testing on your data - Delivery path: Scope, prototype, evaluation, limited pilot, handover - Safeguards: Human hand-off, full logging and spending limits - Typical timeline: Depends on scope; a prototype comes before any full build - Pricing: Fixed quote per scope, or $55-$65/hour. Model usage is billed to you by the provider ## What is an AI agent, in plain terms? An AI agent is a language model that can use tools, within rules you define. The model reads a request and decides the next step: search the knowledge base, look up an order, draft a reply. My code runs that step, checks it is allowed and returns the result to the model, which continues until it has an answer or hands off. A chatbot, by contrast, answers questions, usually from retrieved documents, and changes nothing in your systems. An agent also calls tools that can read or change things in other systems. The model never touches your systems directly. It can only ask for the tools I give it, and each tool does one narrow job. ## What can an AI agent do for a hosting or SaaS business? It can take over the repetitive, well-documented parts of support and operations and pass everything else to your staff. These are the uses that suit the technology best. Use | What the agent does | What stays with a person | Ticket answers | Searches your knowledge base, drafts a reply with the source article, escalates when nothing matches. | Outages, refunds, upset customers, anything undocumented. | WHMCS ticket handling | Opens, updates, categorizes and annotates tickets through the API, for example with OpenTicket, AddTicketReply and AddTicketNote. | Billing disputes and exceptions. | Abuse report triage | Extracts the domain, IP and URL, finds the account, summarizes the evidence and proposes an action. | The decision to suspend or terminate. | Lead qualification | Asks a few fixed questions, scores answers against your criteria, routes the lead with a summary. | Pricing exceptions, contracts, the sales conversation. | Internal assistant | Answers staff questions from runbooks, price sheets and resolved tickets. | Production changes. It reads, it does not run server commands. | ## How is an AI agent built? An agent has seven parts, and the model is only one of them. Most of the work, and most of the safety, sits in the other six. - Model. The OpenAI or Anthropic Claude API, picked by testing both on your examples. A thin adapter keeps the choice reversible. - Retrieval. Your documents are split into passages and indexed. For each question the agent fetches the closest passages and answers from them, with the source shown. Weak retrieval is a common cause of bad answers. - Tool calling with strict schemas. Each tool declares its arguments as a JSON Schema. My code validates every call before running it, and tools are read-only unless a write is truly needed. - Human hand-off. Weak retrieval, certain topics or an angry tone route the conversation to a person, with a summary of what the agent already tried. - Logging. Every request, retrieved passage, tool call, answer and cost is stored, so any decision can be audited. - Evaluation set. A fixed collection of real past questions with correct answers, rerun after every change. - Cost limits. Caps on tokens, tool calls per run and spend per day, with an alert before the cap is hit. ## What are the risks of an AI agent, and how are they handled? The main risks are wrong answers, prompt injection, data exposure and runaway cost. Each can be reduced and watched. None can be reduced to zero. Risk | What it looks like | How I handle it | Wrong answers | A fluent, confident reply that is false or out of date. | Answers must come from retrieved sources and show them. When retrieval is weak the agent says so and escalates. The pilot runs in draft mode. | Prompt injection | Text in a ticket, email or web page tells the model to ignore its rules or reveal data. | Customer text is treated as data, never as instructions. Permissions are enforced in code, not in the prompt, so a tricked model still cannot use a tool it was not given or reach another customer's account. | Data privacy | Personal data goes to a model provider or sits in logs. | Send only the fields the task needs, strip card data and credentials, check the provider's data terms and set a retention period for logs. | Runaway cost | A loop of tool calls or very long documents produces a surprise bill. | Limits on steps, tokens and daily spend, alerts, and a cheaper model for simple triage steps. | Harmful actions | A tool changes or deletes something it should not. | Narrow tools, a minimal-permission API credential, human confirmation for anything destructive, and repeat-safe operations. | ## What should not be automated with an AI agent? Anything where a wrong action is costly or hard to undo should stay with a person. I would not automate: - Refunds, credits and any other movement of money. - Suspending or terminating an account after an abuse report. - Replies to legal notices, takedown requests and security incidents. - Password resets or access changes based only on a chat message. - Deleting data or running commands on production servers. - Any decision you could not explain to the customer afterwards. ## How do I know it works before customers see it? You see it work on your own past tickets first. After the prototype I run the agent against the evaluation set and send you every failure alongside the successes. A limited pilot follows: one ticket category or one group of customers, in draft mode, with every answer logged. Only then do we discuss widening the scope. I give no accuracy percentage in advance, because it depends on the quality of your documentation and on the questions you receive. ## Do you use AI tools to write the code for my project? I tell you plainly on the scoping call if and how AI tools are used on your project. Whatever tool produced a change, I read, test and take responsibility for it before it ships, and I do not paste credentials or customer data into third-party tools. This is separate from the agents I build for you. ## Which AI agent projects do I decline? I do not promise accuracy figures, train new models, or build agents that move money or administer servers without a person approving the step. I do not build bots for mass messaging or for scraping sites against their terms. Agents are most useful when they sit beside your existing tools, so see WHMCS API integration and WHMCS support and maintenance for the systems they connect to, or SaaS development if the assistant belongs inside a product. ## How long does an AI agent project take, and what does it cost? It depends on scope. A prototype on one ticket category comes first, so you see results before committing to the full build. I quote a fixed price after a free scoping call, or work hourly at $55 to $65 per hour. Model usage is a separate running cost paid to the provider. The terms are on how I work. Disclosure: I also run a ready-made product in this field. I am the founder of MagizAI, an AI chatbot and live chat with a free WHMCS module. Where a ready-made chatbot is enough, it costs less than a custom agent, and I will tell you that on the scoping call. Q: What is the difference between an AI agent and a chatbot? A: A chatbot answers questions, usually from retrieved documents, and changes nothing in your systems. An agent can also call tools: search your knowledge base, look up an invoice, open a ticket. The model decides which tool to use, my code runs it, and the result goes back to the model. Because the tools return your real data, the agent can answer and act from it, and every action is limited to the tools I give it. Q: Can an AI agent reply to customers without a person checking? A: It can, but I do not start there. The first stage is draft mode, where the agent writes a reply and a staff member approves it. Only when the logs show reliable results on real tickets do I switch specific, low-risk categories to automatic replies. Refunds, suspensions and security matters stay with people. Q: Will my customer data be sent to OpenAI or Anthropic? A: Only what the agent needs for the request is sent, and I remove card data, passwords and unneeded personal fields first. Both providers publish data-use terms for their business APIs, and you should read the current ones for your plan and region. Where possible I do the sensitive lookups in your own code, so the data never enters the prompt. Q: How do you check that the agent answers correctly? A: I build an evaluation set from your real past tickets, with the answer your staff gave. Every change to the prompt, model or knowledge base is run against that set, and I review the failures by hand. This shows the error rate on your own questions rather than a vendor's figure. It cannot prove the agent will never be wrong, which is why hand-off and logging stay on after launch. Q: Can the agent work with WHMCS? A: Yes. The WHMCS API has actions to read and open tickets, post replies, add internal notes and change a ticket's status or department. I wrap the ones needed in narrow tools with checked arguments, using a dedicated API credential restricted to those actions. The agent never receives your admin login. Details depend on your WHMCS version and API access rules. Q: What does an AI agent cost to run? A: There are two costs. Building it is quoted as a fixed price after the scoping call, or hourly at $55 to $65. Running it is billed by the model provider to your account, based on how much text is processed. I set per-request and daily spending limits and report the cost per ticket during the pilot, so you can compare it with your current support cost. ## MCP Server Development: Connect Claude or ChatGPT to Your Systems URL: https://shahidmalla.com/mcp-server-development I am Shahid Malla, a freelance AI agent and full-stack developer with 13+ years of experience. MCP server development with me gives Claude, ChatGPT or your own AI agent a small, tested set of tools for your CRM, database, WHMCS or internal API: read-only by default, signed in per user, every write confirmed and logged. - Works with: Claude (web, Desktop, Claude Code), ChatGPT, the OpenAI Agents SDK and agents you build - Transports: Streamable HTTP for shared, remote use; stdio for one person's computer - Default access: Read-only. Each write tool is added on its own, behind a person's confirmation - Stack: TypeScript on the official MCP SDK, or Laravel MCP inside a Laravel app, in front of your existing API - Pricing: Fixed quote after a free scoping call, or $55-$65/hour ## What is MCP server development? MCP server development is building the program that lets an AI application, such as Claude, ChatGPT or your own agent, read from and act on your systems through the Model Context Protocol. The official introduction calls MCP "an open-source standard for connecting AI applications to external systems." The server sits between the AI and your CRM, database or API. It holds the credentials, decides which actions exist and returns only the data each action needs. Per the specification, a server can offer tools ("Functions for the AI model to execute"), resources ("Context and data, for the user or the AI model to use") and prompts. Business servers are mostly tools. For the agent itself, see AI agent development. ## What can a custom MCP server connect Claude or ChatGPT to? Anything with an API or a database the server can reach. The common ones, with the access I start each on: System | Example tools | Starting access | CRM | find_contact, list_open_deals | Read-only API user; notes added later, behind a confirmation | SQL database | Named queries over views, such as orders_for_customer | Read-only database user, row limits, no free-form SQL | WHMCS | Client, invoice and ticket lookups through the External API | Its own API role with "Get" actions only, from one allowed IP | Internal API | One tool per endpoint people actually need | Each user's OAuth token or a service account, scoped to those endpoints | To connect Claude to your database, the read-only user matters most. Anthropic's Claude Code MCP docs say: "Use a read-only database user in the connection string so the queries Claude runs can't modify data." For WHMCS, my WHMCS MCP server guide compares the packages that already exist. ## Which AI clients can use your MCP server? Claude, Claude Code, ChatGPT and the OpenAI Agents SDK all accept MCP servers, but reach them differently. Per each vendor's documentation on 25 October 2026: Client | How it is added | What your server needs | Claude (web, Desktop, Cowork, mobile) | Custom connector by URL; on Team and Enterprise an Owner adds it, then members connect | A URL "reachable over the public internet from Anthropic's IP ranges"; per-user OAuth, a header credential or no sign-in | Claude Code | claude mcp add --transport http , or a stdio command; .mcp.json shares it with a team | An HTTP endpoint or a launch command | ChatGPT | ChatGPT Plugins, then Add custom MCP server; workspace policies apply | Public HTTPS with streamable HTTP, or OpenAI's Secure MCP Tunnel | OpenAI Agents SDK | In code, over Streamable HTTP, SSE or stdio, or as a hosted MCP tool | A reachable transport; per-tool approval and tool filters are built in | A ChatGPT connector is, in OpenAI's current docs, a custom MCP server created as a plugin. Anthropic's connector guide says "Claude implements a subset of the MCP specification", with limits of about 150,000 characters per tool result and 240 seconds per call on claude.ai and Desktop. I test in every client you use. ## Should your MCP server run locally or remotely? Locally over stdio when one person uses it on their own computer; remotely over Streamable HTTP when a team, claude.ai or ChatGPT needs it. The transports page defines stdio as messages "over the standard streams of a client-launched subprocess" and Streamable HTTP as "each message is an HTTP POST to a single MCP endpoint". - stdio: private and simple, with credentials taken "from the environment", per the authorization spec. claude.ai and Cowork cannot use it, and ChatGPT reaches it only through the Secure MCP Tunnel. - Streamable HTTP: one deployment for many people, with hosting, HTTPS and sign-in. Servers "MUST validate the Origin header on all incoming connections to prevent DNS rebinding attacks". Claude connects "from Anthropic's cloud infrastructure, rather than from your local device", so a server behind a VPN must allow Anthropic's IP ranges. ## How do you keep an MCP server secure? Assume the model can be talked into anything, and make the server and your systems refuse. The specification admits "MCP itself cannot enforce these security principles at the protocol level," so these controls live in the server and its credentials. Control | What I build | Source | Least privilege | One narrow tool per job, strict input schema, no catch-all query tool | Tools spec: servers MUST "Implement proper access controls" | Read-only by default | A read-only database user or API role, so writes are impossible, not just discouraged | OpenAI: writes can occur "even if the MCP server has tagged the action as read only" | Confirmation for writes | A write creates a pending action that a person confirms on the server | Tools spec: "there SHOULD always be a human in the loop with the ability to deny tool invocations" | Per-user sign-in | OAuth, so each person reaches only their own data; tokens checked, never passed through | Authorization spec: servers "MUST NOT accept or transit any other tokens"; Anthropic: a shared key "gives everyone who uses it that credential's access" | Secrets out of prompts | Credentials in the server's secret store, never in tool text, results or URLs | Authorization spec: tokens "MUST NOT be included in the URI query string" | Logging | Every call, user, tool, redacted arguments and refusal | Tools spec: "Log tool usage for audit purposes" | Rate limits | Per user and per tool, with timeouts and row caps | Tools spec: servers MUST "Rate limit tool invocations" | Prompt injection | Ticket, email and web text comes back as trimmed data; a session that reads it gets no write tools | OpenAI: "an attacker could send you a customer support request with a prompt injection attack" | Tool labels do not replace this: clients "MUST consider tool annotations to be untrusted unless they come from trusted servers," so the credential, not the label, blocks a write. ## What should you ask any MCP server developer before hiring? Ask where a write is stopped when the model gets it wrong: - Which tools can change data? - Does each tool run with the user's own credentials or one shared key? - If the model is tricked, what blocks the write: the client, the server or your API? - What is logged, and for how long? - How will prompt injection be tested? - How do we revoke all access in one step? ## What will I not build into an MCP server? Anything that gives a model more power than a careful new employee would get on day one: - A free-form SQL or shell tool against production. - Tools that move money, delete records or change access without a person confirming each call. - Token passthrough, which the MCP security best practices call "an anti-pattern". - A custom server where the vendor's official one fits. OpenAI advises to "choose official servers hosted by the service providers themselves", and I will say when that is cheaper. I give no accuracy figure in advance; tool choice is measured on your own prompts. ## What MCP and AI experience do I bring? If you are deciding whether to hire an MCP developer like me, here is my proof, and where it stops. - MagizAI: I am founder and CEO of MagizAI, an AI chatbot and live chat with a free WHMCS addon module. According to MagizAI's MCP page, it connects to a company's own MCP servers, calls only the tools the owner ticks ("Anything unticked is never called"), and holds Sensitive tools "until the visitor types back a six-digit code". It also publishes small PHP, WordPress and Next.js starter servers. - WHMCS: 200+ custom modules and a published guide to WHMCS MCP servers. I have not published a WHMCS MCP server of my own. - Claude Code: I build client software with it daily, connecting agents to documentation and test databases through MCP servers with read-only or test-only access. See hire a Claude Code developer. I work remotely, for example for RealBytes (a client portal for an Australian hosting provider), Krunus (a website for a UK hosting provider, connected to cPanel) and Chargewise (a Next.js store shipping across the United States and Canada). None were MCP projects; they are the kind of systems an MCP server sits in front of. ## How much does MCP server development cost? A fixed quote after a free scoping call of about 30 minutes, written within one business day, or $55 to $65 an hour. No packages: the price depends on how many tools write, the sign-in method, which clients must work and how well your API is documented. Hosting and model usage are separate costs on your own accounts. If a plain integration through automation development would do the job for less, I will say so. Terms are on how I work. Disclosure: Claude is a trademark of Anthropic; ChatGPT is a product of OpenAI. I am not affiliated with either company or the MCP project. I founded MagizAI and WHMCSPilot and am CTO at ElySpace. Documentation linked here was read on 25 October 2026. Q: What is an MCP server, in plain terms? A: An MCP server is a small program that offers an AI application a list of actions, called tools, plus optional data and prompt templates, using the open Model Context Protocol. The AI client, such as Claude or ChatGPT, reads the list and asks the server to run a tool when a request needs one. The server holds the credentials and runs the action against your system. The model never logs in to your CRM, database or API, and can only use the tools the server offers. Q: Can one MCP server work with both Claude and ChatGPT? A: Usually, yes, if it is a remote server over Streamable HTTP with a sign-in method both clients accept. Claude connects from Anthropic's cloud, so the URL must be reachable from Anthropic's IP ranges. ChatGPT needs a public HTTPS endpoint or OpenAI's Secure MCP Tunnel. Anthropic's documentation says Claude implements a subset of the specification, with its own size and timeout limits, so I test the same server in every client you plan to use before launch. Q: How do you connect Claude to a database safely? A: Through a server with named, read-only queries rather than open SQL. The server connects with a read-only database user, which Anthropic's Claude Code documentation also recommends so that the queries Claude runs can't modify data. Each tool runs one parameterized query over a view, returns a capped number of rows and leaves out columns such as password hashes, card data and private notes. If writes are ever needed, they go through your application's API with a confirmation step, not straight into tables. Q: Do we need an MCP server or a normal API integration? A: If a task runs the same way every time, such as copying new orders into a CRM, a normal integration or webhook is cheaper and easier to test. An MCP server pays off when people ask varied questions in an AI client, or when you want one tool layer that Claude, ChatGPT and your own agent can all use. Often the answer is both: an integration for the fixed jobs and a read-only MCP server for the questions. Q: Can you build an MCP server for WHMCS? A: Yes. I have built 200+ custom WHMCS modules and work with the External API and its API roles. I have not published a WHMCS MCP server of my own, and several modules and open-source packages already exist, so I start by checking whether one fits. When your products, approval rules or data limits are unusual, I build a custom server on its own read-only API role first. See custom WHMCS module development. Q: Are you affiliated with Anthropic, OpenAI or the MCP project? A: No. I am an independent developer who builds with Claude, the OpenAI API and MCP. I am not affiliated with, certified by or endorsed by Anthropic, OpenAI or the Model Context Protocol project. I name their products only to say which clients a server will work with, and every product detail on this page links to the vendor's own documentation. Q: What do you hand over at the end? A: The source code in your repository, the deployed server, a list of every tool with its inputs, outputs, credential and risk level, the OAuth or token setup, and the steps to revoke access or rotate credentials. You also get the test prompts used to check which tool the model picks, the prompt injection test, and two weeks of support after delivery. ## WordPress Maintenance and Malware Removal URL: https://shahidmalla.com/wordpress-services I look after WordPress sites for businesses and agencies: tested updates, restore-tested backups, malware cleanup, migrations, WooCommerce fixes, speed work and custom plugins. Hacked sites get a fixed eight-step method, and I say plainly when a full recovery is not possible. - Typical cleanup time: 1 to 3 days, depending on site size and damage - Maintenance: Tested updates, restore-tested backups, uptime checks - Plugin experience: 50+ custom WordPress plugins built - Pricing: Fixed quote after a free scoping call, or $55-$65/hour - Not accepted: Nulled or pirated themes and plugins ## What does WordPress maintenance include? It covers the routine work that stops a site from breaking or being hacked: tested updates, backups you know can be restored, uptime checks and a regular review of what is installed. - Updates tested before release. Core, plugin and theme updates go to a staging copy first. I click through forms, login, search and checkout, and only then update production. - Backups with restore tests. Files and database are copied off the server on a schedule. A backup that has never been restored is only a hope, so I restore one into a test environment and confirm the site loads. - Uptime checks. An outside monitor requests your homepage and one key page and alerts me when the response or the expected text is wrong. A hosting panel that says the server is up does not prove the site works. - Housekeeping. Unused plugins and themes come off, administrator accounts are reviewed, and old revisions and spam comments are cleared from the database. I agree maintenance as an ongoing arrangement after seeing the site, because a small brochure site and a busy shop need different attention. Alerts reach me and I respond during my working day in India Standard Time. ## How do you remove malware from a hacked WordPress site? I follow the same eight steps every time, because cleaning visible symptoms without finding the entry point is how sites get reinfected within days. - Isolate and snapshot. I limit public access, usually by IP allow-list or maintenance mode, and copy all files and the database before changing anything. That gives me evidence and a way back. - Scan. I run server-side and WordPress-aware scanners, then search by hand for typical code such as eval(base64_decode(, gzinflate and recently modified PHP files. - Check the usual hiding places. wp-content/uploads should hold no PHP files. wp-content/mu-plugins loads automatically and is easy to miss. wp-config.php, .htaccess and .user.ini can carry injected code or an auto_prepend_file line. I list every administrator account, since attackers add their own, and search the database for injected scripts in posts and in wp_options. - Replace core and plugin files from fresh copies. I compare against official checksums and reinstall instead of hand-editing infected files. - Rotate secrets. New keys and salts in wp-config.php log everyone out. Then new passwords for WordPress admins, the database, the hosting panel, SFTP and any API keys. - Close the entry point. From logs and file dates I find the likely way in: an outdated plugin, a nulled theme, a stolen password, or another infected site on the same account. Until that is fixed, the site will be hit again. - Harden. I disable the built-in file editor, block PHP execution in uploads, correct file permissions, add login protection and remove unused code. - Monitor. I watch for file changes, rescan after a day and after a week, and check Google Search Console for security warnings. The checksum comparison in step 4 uses WP-CLI. The plugin check covers plugins hosted on wordpress.org only: wp core verify-checksums wp plugin verify-checksums --all ## What causes common WordPress problems, and what do you do? Most problems have a short list of usual causes. I start with those and confirm them from logs before changing anything. Problem | Typical cause | What I do | White screen or critical error after an update | A plugin or theme that conflicts with the new version, or an unsupported PHP version | Turn on WP_DEBUG_LOG, read wp-content/debug.log, disable the culprit by renaming its folder, then fix or replace it. | Spam pages in Google, or visitors sent to other sites | Injected code in files or the database, often through an outdated plugin | Run the cleanup method above, then request a review in Google Search Console. | Checkout loops, empty cart or failed payments | Cart and checkout pages served from cache, an outdated gateway plugin, or a firewall blocking the gateway callback | Exclude cart, checkout and account pages from caching, read the gateway log in WooCommerce and test in the gateway's test mode on staging. | Orders paid but still pending | The gateway webhook never reaches the site | Check the webhook URL, security plugin rules and SSL, then replay a failed event. | Slow pages | Heavy plugins, no page cache, oversized images or a bloated autoload in wp_options | Measure first, then add caching, resize images, replace slow plugins and trim the autoload. | Form emails not arriving | Server mail blocked, or sent without SPF and DKIM | Send through authenticated SMTP and set the DNS records. | Redirect loop after moving to HTTPS | Mismatched home and siteurl values, or a proxy not passing the HTTPS header | Correct the URLs and the server or CDN setting. | ## Can you migrate my WordPress site to a new host? Yes. I copy files and database to the new host, test the site there before DNS changes, and switch at a quiet time. URL changes go through a tool that understands serialized data, such as wp search-replace, because a plain find-and-replace in SQL corrupts theme and plugin settings. Afterwards I check permalinks, SSL, email delivery, scheduled tasks and forms. For larger server projects, see server migration and backup. ## Do you build custom WordPress plugins? Yes. I have built more than 50 WordPress plugins, from small admin utilities to WooCommerce extensions and connections to outside systems, including WHMCS. A plugin is the right home for custom logic because it survives a theme change, which code pasted into functions.php does not. I use nonces and capability checks on every action, sanitize input, escape output, run queries through $wpdb->prepare() and clean up on uninstall. For a WordPress site that talks to a billing system, see WHMCS API integration. ## How do you approach speed work? I measure real page timings first and change one thing at a time. Typical wins are page caching, correctly sized images, fewer or lighter plugins and a smaller database autoload. I do not promise a particular score, because results depend on your host, theme and plugins. ## What can I not do for a WordPress site? There are cases where I decline the work or limit what I promise. - I do not install, clean around or keep nulled themes and plugins. They are a common entry point for infections. I replace them with licensed versions or alternatives. - If the site was heavily altered and no clean backup exists, I cannot promise full recovery. I rebuild from what can be verified as clean and tell you what could not be saved as soon as I know. - I cannot control how fast Google lifts a warning. I submit the review and Google decides. - I cannot protect a site on a hosting account shared with other infected sites. The account has to be cleaned or the site moved. ## What does it cost? I quote a fixed price within one business day of the scoping call and a first look at the site, or work hourly at $55 to $65 per hour. Maintenance is quoted as a recurring arrangement once I know what the site needs. If the site sits on your own VPS, server security hardening closes the gaps at server level. The terms are on how I work. Q: How long does WordPress malware removal take? A: Typically one to three days, depending on the size of the site and how deep the infection goes. A single site with a few infected files is faster. A site with a modified database, several backdoors and a shared hosting account that also needs cleaning takes longer. I give a more exact estimate after a first look at the files and logs. Q: Will my site be offline while you clean it? A: Not necessarily. I often work on a copy and keep the live site running, but if it is spreading malware to visitors or sending spam I may restrict access for a short time. I tell you before I do. The final switch from the cleaned copy to the live site usually takes minutes. Q: Why do hacked WordPress sites get infected again? A: Usually because only the visible damage was removed. The entry point stayed open: an outdated plugin, a nulled theme, a weak or stolen password, or another infected site on the same hosting account. Cleanup therefore includes finding the way in, closing it, and rotating every password and key. Until that is done, reinfection is likely. Q: Can you remove the Google warning about my site? A: After the site is clean I submit a review request through Google Search Console and check that the warning conditions are gone. Google makes the decision and sets the timing, so I cannot control how quickly the warning disappears. Fixing the real infection first matters, because a review of a still-infected site is rejected. Q: How do you test updates before applying them? A: I update a staging copy first, then click through the pages that earn you money or inquiries: forms, login, search and the full checkout in the gateway's test mode. If something breaks, I find the plugin or theme responsible before touching the live site. Only a tested set of updates goes to production, after a fresh backup. Q: What access do you need for a WordPress job? A: Usually an administrator login, or SFTP and database access if the dashboard is unreachable, plus the hosting panel for backups and logs. Temporary accounts are best, and I remove my access when the work ends. ## How I Work: Process, Rates and Payment URL: https://shahidmalla.com/how-i-work I am a freelance WHMCS developer. This page explains how hiring me works: a free scoping call of about 30 minutes, a written quote within one business day, fixed price or $55-$65 per hour, work in a staging copy, daily updates, written handover and two weeks of support. - Scoping call: Free, about 30 minutes - Quote: Written, within one business day of the call - Rate: Fixed price per scope, or $55-$65/hour - After delivery: Two weeks of support - Time zone: India Standard Time, with overlap hours arranged ## How does hiring me work from first message to delivery? You send a short brief, we hold a free call of about 30 minutes, and I send a written quote within one business day. After you accept, the work happens in a staging copy with a daily update, and it ends with written handover documentation and two weeks of support. This table shows what each side does. Stage | What I do | What I need from you | Scoping call | Ask about the goal, the setup, the deadline and the risks. | Someone who knows the business goal. A screen share helps. | Quote | Write the scope, the price, the assumptions and what is excluded. | A yes, a no, or questions. Changes to scope are re-quoted. | Setup | Take backups and build a staging copy. | Temporary admin, SSH or database access. | Work | Build or fix in staging and send a daily update. | Quick answers to questions and a review when I ask for one. | Delivery | Deploy with you and hand over written documentation. | Testing your own workflows and reporting anything that fails. | Support | Fix problems in the delivered work for two weeks. | Steps to reproduce and a screenshot for each issue. | ## How much does a WHMCS developer cost? My rate is $55 to $65 per hour, or a fixed price for a defined scope that I quote after the scoping call. I do not publish a price list, because two projects with the same name can differ by days of work. Fixed prices suit work with a clear end point. Hourly suits debugging, audits and support, where the size is unknown until I look. These factors move the price of WHMCS and server projects. The table shows the direction, not an amount. Cost driver | Effect on the price | Why | Number of custom modules | More modules raise it | Each one has to be read, tested and sometimes updated for a new WHMCS or PHP version. | Integrations to re-test | More integrations raise it | Gateways, registrars, server panels and fraud tools each need their own live test. | Versions involved | A bigger gap raises it | Database changes, removed functions and template changes pile up between releases. | Urgency | A tight deadline can raise it | Other commitments may have to be rearranged to fit the work in. | Data volume | More data raises it, mostly on migrations | Transfer, verification and rehearsal take longer with large client, invoice and ticket tables. | Quality of the brief | A clear brief with access ready lowers it | Less time goes on finding out what the problem is. | You can lower the price without cutting quality. Send the brief and access up front, keep each project to one outcome, and do not combine a migration with an upgrade, which adds work and risk. If a quote looks high, ask which parts drive it, and I will show where a smaller first phase is possible. ## How do I prepare a good brief for a WHMCS developer? A good brief states the outcome you want, what is broken now and what the system looks like. It can be short. The more of this you include, the faster and more accurate the quote: - The outcome in one sentence, for example "invoices should be issued in two currencies". - For a fault, the exact error message, the page address, the steps to reproduce and when it started. - Your WHMCS version, PHP version and hosting type. - The custom modules, hooks and themes you use, and who built them if you know. - The integrations involved: payment gateways, registrars, cPanel or WHM servers, other APIs. - Your deadline, and whether it is fixed or flexible. - Whether a staging copy exists. If not, I build one. If you are unsure about any of it, send what you have. I fill the gaps on the call. For a specific fault, the WHMCS troubleshooting guide shows where to look first. ## How does payment work? You can pay through Fiverr or Upwork, using their payment protection, or by direct invoice. I am Top Rated on both platforms, with 580+ five-star reviews on Fiverr, so you can start there if you prefer. On a platform, its payment terms and dispute process apply. With a direct invoice, the payment terms are in the quote before work starts. See my reviews if you want to check my record first. For ongoing work there is also a monthly developer retainer: a fixed monthly, six-monthly or yearly fee that covers development, maintenance and urgent help without a new quote for each task. ## What time zone do you work in, and how do we communicate? I work in India Standard Time (UTC+5:30) and arrange overlap hours for clients in Europe and the Americas when a project needs live conversation. We communicate by email or by call, whichever you prefer. The daily update arrives in the channel you choose, so you do not need to be online when I am. You can also contact me directly. ## Who owns the code I pay for? Ownership of custom code is agreed in writing in the quote before work starts. WHMCS itself, open-source libraries and any premium module you license stay under their own licenses. The written handover documentation lists what I changed, which files and settings were touched, how to test it and how to roll it back. ## Which companies are you connected to? I hold roles at four businesses. I am CTO at ElySpace, a hosting company, and a freelance developer for Marmaids LLC. I founded WHMCSPilot.com, which sells premium WHMCS modules and themes, and MagizAI, an AI chatbot and live chat with a free WHMCS module. I was previously Technical Lead at Fada.cloud and a backend developer for Nuco.cloud. When one of them is a sensible fit for your project, I say whose it is and name alternatives so you can compare. You never need to use any of them to work with me. For custom modules built for you, see WHMCS custom module development. ## What working practices do I rule out? I rule out these five practices. - I do not work on nulled, cracked or unlicensed software. - I do not edit WHMCS core files, because the edits vanish on upgrade. - I do not start changes on a live system without a current backup and a way back. - I do not promise a delivery date before I have looked at your system. - I do not take on work that someone else would do better. I say so on the call. Q: Is the scoping call really free? A: Yes. The scoping call lasts about 30 minutes and costs nothing, and you are under no obligation afterwards. I use it to understand your system and goals, ask what I need to see, and tell you honestly whether I am the right person. The written quote follows within one business day. Q: Should I choose a fixed price or hourly work? A: Choose a fixed price when the end point is clear, such as a module, a migration or a gateway integration. Choose hourly when the size is unknown until someone looks, such as debugging, an audit or ongoing support. Hourly work is $55 to $65 per hour. I recommend whichever I think fits your job, and I explain why in the quote. Q: Can I hire you through Fiverr or Upwork? A: Yes. I am Top Rated on both platforms, and the platform's payment protection applies to work booked there. If you prefer, I can work from a direct invoice instead. The payment terms for either route are written down before work starts, so nobody is guessing later. Q: What happens if something breaks after delivery? A: For two weeks after delivery I fix problems in the work I delivered. Report the issue with the steps to reproduce it and a screenshot, and I respond in my working hours. New features and unrelated problems are quoted separately. Longer-term care is available as a support arrangement. Q: How do you handle access to my systems and data? A: I ask for temporary admin, SSH or database access instead of your main logins where possible, and I work in a staging copy first. Revoke the access when the project ends, and I will tell you what to remove. If you need a confidentiality agreement, raise it on the scoping call so we can discuss it before any access is shared. Q: Which time zone do you work in? A: I work in India Standard Time, which is UTC+5:30. For clients in Europe and the Americas I arrange overlap hours so we can talk live when the project needs it. Between calls, communication is by email, and the daily update means you do not have to be online at the same time as me. ## Web Designer and Developer in Kashmir for Local Businesses URL: https://shahidmalla.com/web-designer-in-kashmir I am Shahid Malla, a web designer and developer based in Baramulla, and I build websites, booking sites and online stores for businesses across Kashmir: shops, hotels, houseboats, tour operators, schools and clinics. Your site loads on a slow mobile connection, takes inquiries or payments, and stays in your name. - Based in: Baramulla, Jammu and Kashmir - Meetings: In person in Baramulla or Srinagar when useful, otherwise by phone or video - Languages: Kashmiri, Urdu, Hindi and English - Local pricing: Fixed quote in rupees after a free first conversation - Ownership: Domain, hosting and Google accounts in your name ## Who do I build websites for in Baramulla, Srinagar and the valley? I build websites for businesses in Kashmir: shops and showrooms, hotels, guest houses and houseboats, tour and cab operators, schools, clinics, exporters of saffron, dry fruits and handicrafts, and local service businesses. For hotels, houseboats and tour operators, my tour and travel website development page covers booking, deposits and WhatsApp inquiries in detail. Most of my work is for hosting and software companies in the United States, the United Kingdom and Europe: WHMCS development, servers, SaaS products and AI integrations, listed on my services page. I have 13+ years of experience and live in Baramulla, so I take local projects too. Those have included tour and cab booking sites, online stores for jewellery, saffron and dry fruits, institute websites, and sites for event planners and NGOs. I am one freelancer, not a website design company in Kashmir with a sales team. You talk to the person who builds the site. The trade-off is capacity: I take only a few local projects at a time. ## Which towns in Kashmir do you serve? I work with businesses across the valley. These towns are within about two hours of Baramulla, so a meeting at your shop, hotel or office is easy to arrange when it helps. My Google Business Profile lists the same area: District | Towns | Baramulla | Baramulla, Sopore, Pattan, Uri, Tangmarg and Gulmarg | Kupwara | Kupwara and Handwara | Bandipora | Bandipora | Srinagar, Budgam and Ganderbal | Srinagar, Budgam and Ganderbal | Further away in the valley, and anywhere else in India or abroad, the work runs online by call, video and WhatsApp in the same way. For businesses outside Kashmir, my web design and development page covers how remote projects run. ## Which Kashmir businesses have I built websites for? These sites are live today. Each name opens a short case study that says what I built, and the case study links to the site so you can try it on your own phone. Business | Type | What the site does | Kohwan | Travel and tours | Gulmarg ski packages and lessons, Kashmir and Ladakh tours, stays and car hire, searched by destination and dates | Shateeta Tour and Travel | Travel and tours | Tour packages, hotels and houseboats, with a pay-at-property option | Himalayan Booking | Travel and tours | Tour packages for Kashmir, Ladakh and Himachal, with rooms and guest counts | Adventure Quest Holidays | Travel and tours | Honeymoon, family and adventure packages with clear change-of-plan terms | Wander Crew Holidays | Travel and tours | Tour packages and cab rentals, with a four-field booking request | 72 Holidays | Travel and tours | Themed tour packages and a lead form the agency calls back from | Kashmir Flow | Travel and tours | Tours, hotels and car hire, with currency and language switching | Hotel Green Karnataka, Srinagar | Hotels and events | Room pages and direct booking for a hotel in Khanyar | Lake View Kashmir Events | Hotels and events | Wedding and event services with a gallery and an event request form | SK Jewellers Kashmir | Shops and food brands | An online jewelry store with collections and a cart | Saffron Star Kashmir | Shops and food brands | Kashmiri saffron and saffron coffee, with origin explained on each product | Noonley | Shops and food brands | Instant Kashmiri noon chai, explained for buyers outside the valley | Srinagar Institute of Pharmacy | Colleges, health and services | Program pages and admission inquiries | Srinagar Institute of Nursing | Colleges, health and services | Courses, clinical training and faculty pages | Bittu Critical Care Ambulance | Colleges, health and services | Six ambulance service types, with the phone number first on every screen | Web Design Kashmir, Baramulla | Colleges, health and services | An agency website built with Astro | The full list, including work for clients outside Kashmir, is in my portfolio. ## What kind of website do you need? That depends on the one thing a customer must be able to do on it. Business type | What the site must do | What I would build | Shop, showroom or local service business | Show what you offer, your hours and your location or service area, and make calling easy | A small site with a gallery of products or real work, a map, a tel: call button and a WhatsApp chat link (wa.me) | Shop or exporter selling online | Take orders and payment, and show delivery charges | A WooCommerce store with Razorpay, cash on delivery if you offer it, and a wholesale inquiry form | Hotel, guest house or houseboat | Show rooms, photos and rates, and collect direct booking requests | Room pages, an inquiry form with dates and guest count, and optional advance payment | Tour, travel or cab operator | Present packages with itinerary and price | Package pages you can add yourself, an inquiry form on each, and optional online advance payment | School, college or coaching center | Admission information, notices and downloads | A notice board that staff update, an admission inquiry form and document downloads | Clinic or doctor | Timings, services, location and appointment requests | Doctor and timing pages, an appointment request form and a call button. No patient records on the website | Some needs go beyond a plugin, such as live seat availability or tracking travel leads. That is custom software, and I scope it like my SaaS and web application projects. ## What do I build and set up for a local business? I build the site and set up what a business needs around it to be found, contacted and paid. - Business websites. Usually WordPress, on a theme that still receives updates. My changes go into a child theme, so an update does not erase them. - Booking and inquiry sites. Forms that email you and store each entry in the dashboard, so a missed email is not a lost inquiry. - Online stores. WooCommerce with Razorpay. I connect the gateway webhook, so an order is marked paid even if the customer closes the browser before returning to the shop. - Hosting, domain and business email. Addresses such as info@yourbusiness.com, with MX, SPF and DKIM records so your mail is less likely to land in spam. - Ongoing care. Updates, backups and small edits, described under WordPress maintenance. ## What is different about a website for a Kashmir business? Four things: how we work together, how your customers connect, how they pay and how they find you. Meeting and language. I can meet you in Baramulla or Srinagar when that is useful, and we can work in Kashmiri, Urdu, Hindi or English. Slow mobile connections. Expect most visitors to arrive on a phone, often on slow or unsteady mobile data. I build mobile-first: WebP images sized for the screen, lazy loading below the first screen, a page cache, and no autoplay video or heavy sliders. I test with the browser throttled to a slow connection, then on a real phone. Payments Indian customers use. UPI first, then cards and net banking, and cash on delivery where you offer it. Razorpay asks for your business and bank documents before it activates an account. That approval is theirs, and accepting cards from buyers abroad usually needs a separate one. Google Maps and search. I create or claim your Google Business Profile in your own Google account and fill in the category, address or service area, hours, phone number, photos and website link. Google verifies the business and chooses the method. The website carries the same name, address and phone number, plus LocalBusiness structured data, and I submit its sitemap in Google Search Console. That makes the business eligible to appear on Maps. It does not decide where. ## How does a local project run, and what do I receive at the end? It starts with a free conversation and a written quote, moves to a staging link you can open on your phone, and ends with training and handover. The method is the one described on how I work. You receive: - The domain registrar login, with the domain registered in your name. - The hosting panel login, the business email passwords and an administrator account on the website. - Ownership of the Google Business Profile and the Search Console property. - The payment gateway account, opened in your business name from the start. ## How much does a website cost in Kashmir? I quote a fixed price in rupees after the first conversation, so there is no price list on this page. The price follows the number of pages and the features. A site of a few pages costs less than a store with payments, and a store costs less than a custom booking system. International work is quoted differently, at $55 to $65 per hour or a fixed price per scope. Plan for running costs too: yearly domain renewal and hosting, any paid theme or plugin license, and the gateway's fee on each online payment. You pay those to the providers. Tell me about the business and I will say what I think it needs, including when a simpler site is enough. ## How do you choose the best web developer in Kashmir? Ask these five questions before you pay anyone an advance. Nobody can prove they are the best web developer in Kashmir, and I will not claim it. These answers you can check. - Who owns the domain and hosting? A domain registered in the designer's account is under the designer's control, whatever the invoice says. My answer: both are registered in your name. - Will I get the logins? Ask for registrar, hosting, website administrator and Google access. My answer: all of them, in writing, at handover. - Is the site mobile-first? Open the designer's earlier work on your own phone, on mobile data. My answer: you test the staging link on your phone before launch. - Who updates it? If every text change needs a paid request, costs add up. My answer: I train you to change text, photos and prices, and I handle larger changes. - What happens if I stop paying? Some monthly-plan websites disappear when the plan ends. My answer: your site stays online while you renew hosting and domain. Only my updates and backups stop. ## What will I not do? I turn down work that would mislead your customers or put your business at risk. - I do not promise first place on Google or any fixed position. - I do not write or buy fake reviews, on Google or on your site. - I do not copy another business's design, text or photos. - I do not build websites for gambling or for businesses that depend on deceiving customers. - I do not install pirated themes or plugins. Q: How much does a website cost in Kashmir? A: There is no single price, because a five-page business site and an online store with payments are different amounts of work. I quote a fixed price in rupees after a free first conversation, and the quote lists the pages and features it covers. Domain renewal, hosting and payment gateway fees are separate running costs that you pay to those providers. For clients outside India I charge $55 to $65 per hour or a fixed price. Q: How long does it take to build a website? A: A business site of a few pages typically takes one to two weeks after I have your text and photos, depending on scope. An online store or a booking site takes longer, because products, payment setup and testing add work. The most common delay is content, so I ask for text, photos and prices early. The written quote gives you a date. Q: Can you make an online store for my shop? A: Yes. For most shops I build the store on WordPress with WooCommerce, so you can add products, prices and stock yourself. Payments go through a gateway such as Razorpay, which lets customers pay by UPI, card or net banking, and cash on delivery can be switched on if you offer it. The gateway account is opened in your business name and needs your bank and identity documents. Delivery charges and the returns policy are your decisions. I set them up. Q: Do you provide hosting and a domain? A: I set both up in your name. You pay the domain registrar and the hosting company directly, so the accounts and the renewal reminders are yours. I advise on a plan sized for your site and connect the domain, SSL certificate and business email. A disclosure: I am CTO at ElySpace, a hosting company. If I suggest hosting there I will say so, and you are free to choose any other provider. Q: Will my website show on Google? A: I set it up so Google can find and read it: a sitemap submitted in Google Search Console, clear page titles, your address and phone number as text, and a Google Business Profile linked to the site so the business can appear on Maps. Where it ranks is Google's decision and depends on competition, reviews and time. Nobody can honestly promise you a position, and I do not. Q: Are you a website design company in Baramulla? A: I am an independent web designer and developer based in Baramulla, not an agency. You deal with me from the first call to handover, so the person who quotes your website is the person who builds it and answers your calls after launch. I work for businesses in Baramulla, Srinagar and across the valley, and we can meet in person when it helps. Q: Can we meet in person? A: Yes, when it helps. I am based in Baramulla and can meet there or in Srinagar, for example to see the shop, go through your products or train your staff. Most of the building itself happens online, and updates come by phone or message. We can talk in Kashmiri, Urdu, Hindi or English, whichever is easiest for you. Q: Do you maintain the website after it is live? A: Yes, if you want that. Two weeks of support after delivery are included. After that you can look after the site yourself with the training and notes I leave, or agree an ongoing care arrangement that covers updates, backups and small changes. If you end the arrangement, the site stays online and stays yours for as long as your hosting and domain are renewed.