WHMCS.Community

A complete passwordless authentication addon for WHMCS that lets your clients log in to the client area with a single click — no password required. Magic Login Link sends a secure, time-sensitive login link straight to the client's email address; opening it signs the user in through WHMCS' native Single Sign-On engine. The module eliminates login friction while keeping accounts thoroughly protected. Every token is single-use, expires automatically, is bound to the requester's IP address and browser fingerprint, and is protected by a built-in rate limiting engine (per-IP and per-email throttling with a configurable decay window). Clients can request a magic link themselves from the login page, and administrators can generate or send one directly from the Client Summary page or the Client Users table. The addon ships with a full analytics Dashboard (token metrics, login trends, security events and system health), a dedicated Activity Logs screen with a filterable, server-side audit trail of every event, two ready-made email templates (Magic Link Request and Magic Link Security Alert) that install into WHMCS' email template editor with registered merge fields, and a single Configuration page for expiry, throttling, fingerprint binding, security alerts and automatic log pruning — everything governed by modern, secure, CSRF-protected admin screens. Owned License ($40.00) - https://www.hardsoftcode.com/cart/link/magic-login-link-for-whmcs/owned Source Code License ($280.00) - https://www.hardsoftcode.com/cart/link/magic-login-link-for-whmcs/source What's new in v2.5 v2.5 adds full observability and tighter admin control on top of the existing passwordless login engine: Module Activity Logs — a new dedicated audit screen (hsc_magiclink_activity_logs) recording every event with a severity level (success / info / warning / danger), the acting user or admin, IP address and browser/device. Events include token requests, admin sends, every email send (and failure), login successes and failures, IP / browser mismatches, rate-limit hits, manual invalidations and record deletions. Analytics Dashboard — metric cards for token counts by status, successful logins with a month-over-month trend, security events, throttled/blocked attempts, top users by logins, recent activity, and a system health panel. Audit table management — the Dashboard audit table now supports per-row Invalidate and Delete actions (AJAX, no page reload), and the Browser & Device column was removed for a cleaner layout. Email send logging — every dispatched email (client request, admin send and security alerts) is recorded in the Activity Logs as email_sent / email_failed. Automatic pruning — the daily cron job now also prunes old activity log rows (PruneActivityLogsDays), in addition to old tokens (PruneLogsDays). Granular admin configuration — strict IP matching, login limit threshold, security alerts, fallback redirect URL and pruning retention are all configurable from the module's own Configuration page. Features Passwordless login Login page button — a "Magic Login Link" button is injected automatically into the client-area login page (or provide your own custom button HTML). Clicking it opens a modal where the visitor enters their email address. Single-use, expiring tokens — every magic link works exactly once and expires after the configured number of hours (default 24; 0 = never expires). Native SSO sign-in — clicking the link logs the user in through WHMCS' CreateSsoToken API and redirects to a configurable destination (default /clientarea.php). Account-enumeration safe — the request form always shows the same generic success response whether or not the email exists. Security engine Strict IP matching — require the login to come from the same IP address that requested the link. Browser/device fingerprint binding — the requester's User-Agent is stored as a SHA-256 hash and must match at login. Consecutive login limit — cap how many times a single token can be used in sequence; the counter resets when the user logs in with their normal password. Rate limiting & cooldown — per-IP and per-email request throttling with a configurable decay window (enabled/disabled, max requests, decay minutes). Automatic token invalidation — all active tokens are expired when the client or user changes their password. Login security alert email — after every magic-link login the user receives a notification with the account, date & time, IP address and browser/device used (toggleable). Sensitive email suppression — the EmailPreLog hook stops the magic-link email (which contains the login URL) from being stored in WHMCS' email logs. Admin tools Send / generate from the admin area — a "Send Magic Link" action link on the Client Summary page and in the Users & Permissions dropdown of the client users table: send the email instantly. Dashboard analytics — token counts by status, lifetime logins with month-over-month trend, security event counts, throttled attempts, top users, recent activity feed and a system health panel (table presence + pruning retention). Audit table actions — invalidate an active token or permanently delete an audit record straight from the Dashboard, with SweetAlert confirmation and AJAX table reload. Activity Logs screen — server-side DataTable with global search, severity and event-type filters, severity badges, actor labels (User / Admin / System) and a per-row AJAX delete. Email integration Two ready-made email templates created on activation: Magic Link Request and Magic Link Security Alert. Custom merge fields registered in WHMCS' email template editor: {$login_link}, {$login_url}, {$expire_time} (request) and {$login_ip}, {$login_time}, {$user_agent} (security alert). Housekeeping Daily cron pruning — old used/expired/invalidated/failed tokens and old activity log rows are removed automatically after the configured retention days.

Absolutely after backlash. Enough so that 8.x remained.  'Recommended' does not mean best suited.  We did the 9 upgrade and it's been an admin nightmare for billing. We disabled it early with the config setting but it's been a mess.    We will be doing full disable once GA. 

I get hat, but WHMCS only added that after significant backlash - and all it does is provide previous functionality, and a warning.   Using WHMCS with the invoice immutability option set as recommended makes it impossible to work with.

It should be an admin option based on this  https://docs.whmcs.com/releases/9-1/9-1-release-notes/ https://docs.whmcs.com/9-1/system/general-settings/general-settings-invoices/#invoice-immutability

Yeah - that’s what it says. Run it on your install - let us know.

Seems legit?  From the site (emphasis mine): If it never reads the DB credentials, how exactly does it access it to store anything in it? Pass.

The product page is up now, with the setup steps, screenshots, which blocks clients can and cannot clear, and an FAQ: https://redwaterhost.com/whmcs-modules/firewall-unblocker The Marketplace listing linked above is still waiting for approval, so that link won't open until WHMCS publishes it. Until then the module is free from our store: https://my.redwaterhost.com/store/whmcs-modules/firewall-unblocker  

Ok, so today was the first time I tried WHMCS 9.x - I avoided upgrading due to the reported issues. In my dev install of WHMCS 9.1 The first thing I did was try to edit an unpaid invoice - and found there was zero ability to delete a product, change a price - nothing. Unless im missing somthing, its unworkable in the current form without disabling the feature entirely. Providing a disable feature in the admin area and calling it 9.1 isnt going to cut it?

We’re building an MCP Server for WHMCS - looking for feedback We’re currently working on an MCP Server that connects WHMCS with MCP-compatible AI tools. The idea is to make it possible to work with things like clients, services, invoices, domains and WHMCS data through an MCP interface. We’re still deciding what should be included in the first release. For those running WHMCS: What would you actually want to be able to do through MCP? Looking for practical use cases and feedback from people who use WHMCS day to day.

Yes, please open a ticket for Trail Plan here https://members.whmcsglobalservices.com/submitticket.php?step=2&deptid=5