Website Malware Cleanup Service Module for WHMCS
Sell hacked site recovery as a WHMCS product: collect encrypted access, log every infection found and show customers each cleanup step.
What does the malware cleanup module do?
It gives every security service you sell in WHMCS its own case page. When the order is activated, the case opens in Pending Information status with a ten-step cleanup checklist: receive credentials, full backup, security assessment, malware scan, remove threats, clean the database, hardening, testing, report and delivery. The customer receives an email asking them to send access, and their service page shows an Action Required notice until they do.
The access form takes the site URL, the platform, the hosting provider, the admin login, FTP or SFTP details, cPanel details, the database name and a description of what went wrong. Logins and passwords are encrypted with AES-256 before they are stored, and the customer can update them later. Supported platforms in the form are WordPress, WHMCS, Laravel, Joomla, Drupal, Magento, PrestaShop, OpenCart and custom PHP sites.
What is included?
| Area | What it covers |
|---|---|
| Status | Ten statuses, from Pending Information through Testing and Review to Delivered, including On Hold and Canceled |
| Issue log | Malware, backdoor, defacement, SEO spam, vulnerability or other, with low to critical severity and the files affected |
| Work log | Work updates, milestones, issues found and issues fixed, each visible to the customer or internal |
| Files | Reports, screenshots, backups and documents up to 10 MB, checked by extension and file type |
| Messages | Customer and staff messages on the case, with internal notes |
| Client view | Progress, current step, assigned staff member, activity timeline, messages and reports |
| Admin view | Case dashboard on the service page and a home page widget with counts by status |
How does it keep a cleanup on track?
Each product carries a service type for the platform, an expected turnaround such as 24 to 48 hours, and switches for whether a full backup and hardening are included, so the scope is clear from the order. Staff move the case forward with Mark In Progress and Mark Completed buttons or by setting the status, step and activity text on the service page. A daily task writes a note to the WHMCS activity log for any case still waiting on access after three days, so stalled orders get a follow-up. When a service is deleted, its case records are removed with it.
Who is it for?
Hosting companies, agencies and freelancers who already clean hacked sites and want to sell that work as a fixed product rather than through tickets. Customers in a stressful situation can see what has been found and what is being done, which cuts down on update requests.
What do you need, and what is outside its scope?
Requirements: WHMCS 8.12 or newer (exact version confirmed at purchase) and PHP 7.4 or newer with the OpenSSL extension.
Limits: this module manages the service, not the cleanup itself. It does not scan sites, remove malware or connect to customer servers; your team does the work with its own tools and records it here. For hardening WHMCS itself I sell a separate security hardening module.
It costs $119 once for a lifetime license with twelve months of updates and support, an instant download and license key, and a seven-day refund window.
Key features
- Case page for every security service order
- Ten-step cleanup checklist created on activation
- Encrypted access form for admin, FTP, cPanel and database details
- Issue log with infection type, severity and affected files
- Ten statuses from Pending Information to Delivered
- Report, screenshot and backup files shared with the customer
- Messages with internal staff notes
- Welcome email asking the customer for access
- Admin home widget with case counts by status
- Daily check for cases still waiting on access
Why customers buy this module
- →Hack recovery becomes a product customers can order and pay for
- →Access details arrive in one place, encrypted, not in email threads
- →Customers see what was found and fixed without asking
- →Every case ends with a written record and a report file
Frequently asked questions
Does the module remove malware from websites?
<p>No. It runs the service around the cleanup: the order, the access details, the checklist, the issue log, the files and the messages. Your team scans and cleans the site with its own tools and records each finding and fix in the case, which the customer follows from their client area.</p>
How are the customer's logins protected?
<p>Usernames, passwords, admin and cPanel addresses and FTP hosts from the access form are encrypted with AES-256-CBC before they reach the database. Client actions check that the service belongs to the logged-in customer, and file downloads are checked the same way before anything is sent.</p>
Is this the same as your WHMCS security hardening module?
<p>No. The hardening module protects your own WHMCS installation from attacks. This module is for selling a security service to your customers, such as cleaning a hacked WordPress or Magento site, and tracking that work from order to delivery.</p>
Technical specifications
- WHMCS
- 8.12+ (confirmed at purchase)
- PHP
- 7.4+ with OpenSSL
- Credential storage
- AES-256-CBC encryption
- Platforms in the form
- WordPress, WHMCS, Laravel, Joomla, Drupal, Magento, PrestaShop, OpenCart, custom PHP
- License
- Lifetime, 1 year of updates and support included
- Delivery
- Instant download and license key
- Refund window
- 7 days