Web Hosting Talk : Web Hosting Main Forums : Hosting Software and Control Panels : Hosting Software and Control Panels Tutorials : WHMCS Security: How To Remove The "Forgot your password?" Link From Admin Login Area.

[cd/home]

Hello,

To stop the "Forgot your password?" link from displaying on your admin login area on WHMCS.

Simply edit and add the following line (below) to your root WHMCS "configuration.php" file:

$disableadminforgottenpw = true;

By disabling this feature it will reduce the risk of someone gaining access to your WHMCS admin area should your email account be compromised.

Regards,

[rsfk]

Thank you. Doing this right now.

[cd/home]

Originally Posted by rsfk

Thank you. Doing this right now.

Thank You, Please help spread the word

Regards,

[kbeezie]

ditto.

Do they happen to have a list of variables you can set in the config at WHMC's documentation?

[SirMarcel]

Setup > General Settings > Security > Disable Admin Password Reset [x]

[cd/home]

Originally Posted by kbeezie

ditto.

Do they happen to have a list of variables you can set in the config at WHMC's documentation?

I dont think they do

Originally Posted by SirMarcel

Setup > General Settings > Security > Disable Admin Password Reset [x]

Although this is available for newer WHMCS installations...

The older ones dont have this option available as it was only implemented into WHMCS during the Version 5.0 release

[SirMarcel]

is there any particular reason one wouldn't want to upgrade to the most recent version? surely just by having an outdated installation you're risking your system being compromised

[cd/home]

Originally Posted by SirMarcel

is there any particular reason one wouldn't want to upgrade to the most recent version? surely just by having an outdated installation you're risking your system being compromised

Mainly because people have heavily modified WHMCS installations which includes various modules so some people find it easyer to stay patched and focused on security rather than being an upgrade junkie

A patched WHMCS 4.5 is just as secure as an patched WHMCS 5.0

However this isnt a debate about release notes and release candidate security, Its merely a tutorial to help all WHMCS users disable the link.

[kbeezie]

Originally Posted by cd/home

Mainly because people have heavily modified WHMCS installations which includes various modules so some people find it easyer to stay patched and focused on security rather than being an upgrade junkie

A patched WHMCS 4.5 is just as secure as an patched WHMCS 5.0

Adding to this, in theory you only lacking 'new features' and such, as any security patches they release tend to be available for as far back as version 4.0 (as you would have noticed from their most recent patch). The upgrades aren't really for security fixes but rather features and such.

[cd/home]

Originally Posted by kbeezie

Adding to this, in theory you only lacking 'new features' and such, as any security patches they release tend to be available for as far back as version 4.0 (as you would have noticed from their most recent patch). The upgrades aren't really for security fixes but rather features and such.

Thank You for adding additional information on the subject.

The more information we can get around about securing WHMCS the better

However I shall forward my opinion about having this included to the WHMCS documentation to Matt.

Regards,

[SafeSrv]

Why not just VPN the backend altogether ? i mean this is going to do very little security wise !

[Simplex-Ed]

Originally Posted by SafeSrv

Why not just VPN the backend altogether ? i mean this is going to do very little security wise !

Indeed, a lot of people miss this...

[kbeezie]

Originally Posted by SafeSrv

Why not just VPN the backend altogether ? i mean this is going to do very little security wise !

Wouldn't that throw off the licensing? (i.e.: thinks the app being hosted on a internal/VPN IP then won't let you login on account of the licensing) ?

[SafeSrv]

Originally Posted by kbeezie

Wouldn't that throw off the licensing? (i.e.: thinks the app being hosted on a internal/VPN IP then won't let you login on account of the licensing) ?

No it won't affect licensing at all, i have always restricted backends to either my ISP IP or VPN, its the best way to keep your backend secure.

[KiBaHost]

Thanks for tutorial.