WHMCS Security Audit and Hack Recovery

What does a WHMCS security audit check?

It checks every place where WHMCS lets someone in, leaks data or runs code, from the admin folder to the PHP settings. This is the checklist I work through on each installation.

What is in the audit report?

The report is a written document that ranks each finding as critical, high, medium or low and tells you what to do about it. Every finding carries the same four parts.

• The evidence, such as the file path, setting value or URL I found.
• The realistic risk in plain language, not a generic score.
• The exact fix, including the order to apply it in and what to test afterwards.
• Whether I can apply it, and a rough effort estimate.

The report also lists what was out of scope and what I could not verify. It is a snapshot of the day I looked, and it is not a certificate.

How do attackers usually get into a WHMCS install?

Usually through something that was left open, not through a clever new exploit. These are the routes that come up most often.

• A WHMCS release with a published security fix that was never applied.
• A staff password that was weak, reused or phished, on an account without two-factor.
• A forgotten database dump, .git folder or configuration.php copy that anyone could download.
• A third-party addon, theme or hook with a vulnerability that nobody updates.
• Another site on the same hosting account that was compromised first, with the attacker then reading the WHMCS files.
• An API secret pasted into a script, a chat or a repository.

Each of these has a matching row in the checklist, which is why the audit looks at habits and history as well as settings.

My WHMCS was hacked. What do I do first?

Contain it, copy everything before you clean anything, and only then start removing and replacing. The order matters. I follow it on every recovery.

1. Contain. Restrict public access to the site or put it behind an IP allow-list, and block the admin area. If you suspect payment abuse, revoke gateway and API keys at once. Do not wipe the server.
2. Snapshot. Copy the full file tree with timestamps, take a database dump, and save the web server and PHP logs before rotation removes them. This is your evidence and your fallback.
3. Look for rogue access. Check staff accounts, roles, API credentials, gateway settings, server module credentials and email templates for changes you did not make.
4. Find modified code. Compare core files against a clean download of the same version, then read includes/hooks, modules and templates by hand. Search attachments, downloads and templates_c for PHP files that should not exist.
5. Restore known-good files. Put back clean core files and only the custom code you have reviewed. If you restore a backup, choose one from before the first sign of compromise, and clean the database too.
6. Rotate every secret. Do this after the backdoors are gone, or the new passwords leak through the old ones. Cover the database password, all staff passwords, API credentials, gateway and registrar keys, server module logins, SMTP and SSH.
7. Find the entry point. Read access logs for requests to unusual PHP files, check the WHMCS version against published security releases, and look at third-party modules and neighboring sites on the same account.
8. Harden and tell people. Apply the checklist above. If client data may have been exposed, your legal duties vary by country, so take advice on notifying clients and authorities.

What can a WHMCS audit not do?

An audit cannot make an installation unhackable, and I make no such promise. It does not replace a formal compliance assessment, and I do not issue certificates of any kind. It does not cover the security of your payment gateway, your registrar or other vendors. Because it is a snapshot, a new vulnerability or a new careless setting next month can undo it. I also do not audit unlicensed or nulled WHMCS copies, since the code cannot be trusted. Ongoing upkeep belongs in support and maintenance, and a backup plan that survives an attack is part of server migration and backup.

What does a WHMCS security audit cost?

I quote a fixed price after a free scoping call of about 30 minutes, or work hourly at $55 to $65 per hour. The price depends on how many servers and modules are involved, whether the server and control panel are in scope, and whether you want me to apply the fixes. Recovery work after a hack is scoped the same way, once I have seen the snapshot. The official WHMCS documentation has a further-security-steps guide, and I treat it as the minimum, not the whole job. If something is already broken rather than exposed, start with WHMCS quick fixes.