All Activity

This is wacky, WHMCS thought we should not be able to edit our own invoices? Do they think they own our invoices? This is almost as weird as when they wouldn't let us change an account password. So what do you do, delete the invoice and create a manual one that won't sync to the product? What's the process if you need to change an unpaid invoice?

WHMCS decided that immutable invoices should be the default, with no chance of shutting that off for those that don't want or need it. This is allegedly being addressed in the latest version; the one where they will be forcing a marketplace account on everyone with no opt out. Enjoy. To change an invoice now, I believe you need to cancel the current one and recreate it, causing much confusion to the client. Again, enjoy? 😉

Can someone please tell me how I can change an unpaid invoice? The price has changed and I need to adjust it. WHMCS is giving me this error when I try This is an Unpaid Invoice. You cannot modify an Invoice that is Unpaid. Which doesn't make any sense, of course I will need to change unpaid invoices.

Version 8.2.0 Added: Opt-in/Opt-out Custom Fields Added: Variavle {InvoiceNumber} for SMS Template Added: Functionality for OTP skip for specific country Added: Some extra security layer into sending sms OTP to users Code optimization and reduced duplication for send sms -Rate limiting per IP address. -Rate limiting per mobile number. -Rate limiting per browser session. -A configurable cooldown period between OTP requests -Maximum OTP request limits per hour/day - CAPTCHA v3 verification before sending OTP requests Updated: Infobip API Gateway Updated: GrameenPhone CMP Gateway Api Updated: Remove Support for WHMCS V8.7.x to 8.9.x Updated: Remove Support for PHP 8.1 Updated: Fully supported WHMCS 9.0.9 & 9.1.x Fixed: Support for ionCube Loader v15

Passkey Authentication Module v1.1.1 Released We’ve released version 1.1.1 of our Passkey Authentication Module with several security improvements and tighter controls over passkey management. What’s new in v1.1.1? Improved overall module security. Passkey registration during signup is now disabled. Customers can add a passkey only after signing in to their account using the same browser. Passkey management is restricted to the signed-in account. Passkey login is now restricted to active customers with verified email addresses. These updates add an extra layer of protection and help ensure passkeys are managed securely within each customer account. More details: https://whmcsglobalservices.com/whmcs-modules/passkey-authentication/

That's great, thanks Rob

There have been a number of those in WHM that have automatically enabled the new thing and the screen is just telling you it's done. "Save settings" is the only choice, and you have to go digging to hide/remove it.

Hey Steve, Good news, the validation is already in the code I posted. This line is what does it: if (!filter_var($domain, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) || strpos($domain, '.') === false) { It only lets through letters, numbers, dots and dashes in a real domain format. Anything else (spaces, code, symbols, junk) gets stopped with "Please enter a valid domain name" before it ever gets to the WHOIS or DNS lookup. So you don't need to add anything for that part. For bots, two easy things: 1. Make it logged-in clients only. In dnscheck.php, right under this line: $ca->initPage(); add: $ca->requireLogin(); Now anyone not logged in gets sent to the login page. That's what I did on mine and it stops pretty much all the bot traffic. 2. Simple rate limit (10 lookups every 10 minutes per client). Find the block that starts with if ($domain !== '') { and replace that whole block, down to its closing }, with this: if ($domain !== '') { $_SESSION['dnscheck'] = array_filter($_SESSION['dnscheck'] ?? [], function ($t) { return $t > time() - 600; }); if (count($_SESSION['dnscheck']) >= 10) { $error = 'Too many lookups. Please wait a few minutes and try again.'; } elseif (!filter_var($domain, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) || strpos($domain, '.') === false) { $error = 'Please enter a valid domain name.'; } else { $_SESSION['dnscheck'][] = time(); $result = localAPI('DomainWhois', ['domain' => $domain]); if (($result['result'] ?? '') === 'success') { $status = $result['status']; $whois = html_entity_decode(strip_tags(urldecode($result['whois'] ?? '')), ENT_QUOTES); } $records = @dns_get_record($domain, DNS_A | DNS_AAAA | DNS_CNAME | DNS_MX | DNS_NS | DNS_TXT) ?: []; } } Save it and you're done. If you want more or less than 10, just change the 10. The 600 is the time window in seconds. @carlpeeter32 thanks, good points. On the WHOIS question, most of the common TLDs come back fine. Some country TLDs and a few registrars hide most of it for privacy, so you just get status and dates on those. Since it goes through WHMCS's own WHOIS servers it's as good as your domain checker is. Rob

Hi Steve, good news: you don’t need to write code for the first part. Rob’s dnscheck.php already checks the domain on the server side (the filter_var(...) line), so random text or odd characters get rejected before any lookup runs. If you want it a bit stricter, you can add this line right after $domain = ...: if (strlen($domain) > 253) { $domain = ''; } For the bots/rate-limit part, the easiest options without programming, from simplest to most flexible: Make the page login-only. In dnscheck.php, add $ca->requireLogin(); right after $ca = new ClientArea();. Then only logged-in clients can use it, and bots can’t hit it. (If you want it public for visitors, skip this.) Cloudflare, if your site is on it. Free plan: Security → WAF → Rate limiting rules (or a Turnstile challenge) on the URL path /dnscheck.php, e.g. a limit of about 10 requests per minute per IP. No code needed. Server-level rate limit. If your host uses ModSecurity or CSF/LFD, ask your host to rate-limit that one URL. I haven’t tested these exact lines on your setup, so try it on a staging copy (or at least back up dnscheck.php first) before putting it live. Hope that helps.

Something like the WHM new feature settings. Allow us to enable it or continue and enable it later.

I'm with GenShift and Damo on this one. The MarketConnect upsell itself isn't the problem — automatic account creation during an upgrade without a clear confirmation screen is. Plenty of us run locked-down or compliance-sensitive installs where a new account getting spun up quietly is exactly what we don't want. Make it opt-in with a proper explanation screen and the $50 credit becomes a nice touch instead of a red flag.

My bet is that it will be in the EULA you have to accept before being able to complete the install. Marketplace is owned by WHMCS Ltd so it's not actually a third party.

Maybe with TicketOpen and SendAdminEmail

Asked support, and as predicted this is customization and not something they can help with. Would have been great if they mentioned the notification template is not editable as it lives behind the encoded files, which would have saved a lot of frustration, but hey! I'm guessing "New Support Ticket Opened." may have been a prior WHMCS version. Looking back in the email template sql files (v7x, v6x, v5x and so on), that was that title, but it was in support (not admin), and had client type info vars in it. So, for me, the workaround was to discontinue using the notifier (email) for support, which was sending to an account that had a special ring tone on my mobile so I know something's up. Instead set up the admin account to get notified for each support department (various triggers) via the admin account settings (appears this template is also hard coded somewhere), and changed the notifier to only send me items other than tickets. Last step, email filter to take messages to the admin addy and a subject that has "[Ticket ID" at the start and forward that to the special email addy with special ring tone. Best of both worlds, but still testing over time to make sure this doesn't bugger anything else up. Appreciate the responses, and hope this is of some use for someone. Phew.

Steve, the first part is already done in Rob's code. This line checks that what was typed is a real domain name before any lookup runs, and shows "Please enter a valid domain name" if it isn't: if (!filter_var($domain, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) || strpos($domain, '.') === false) { For the rate limit, you only need to change one part of dnscheck.php. Find this block: } else { $result = localAPI('DomainWhois', ['domain' => $domain]); if (($result['result'] ?? '') === 'success') { $status = $result['status']; $whois = html_entity_decode(strip_tags(urldecode($result['whois'] ?? '')), ENT_QUOTES); } $records = @dns_get_record($domain, DNS_A | DNS_AAAA | DNS_CNAME | DNS_MX | DNS_NS | DNS_TXT) ?: []; } and replace it with this: } else { // At most 10 lookups per visitor IP in 10 minutes $key = 'dnscheck_' . md5($_SERVER['REMOTE_ADDR']); $store = \WHMCS\TransientData::getInstance(); $count = (int) $store->retrieve($key); if ($count >= 10) { $error = 'Too many lookups. Please wait a few minutes and try again.'; } else { $store->store($key, $count + 1, 600); $result = localAPI('DomainWhois', ['domain' => $domain]); if (($result['result'] ?? '') === 'success') { $status = $result['status']; $whois = html_entity_decode(strip_tags(urldecode($result['whois'] ?? '')), ENT_QUOTES); } $records = @dns_get_record($domain, DNS_A | DNS_AAAA | DNS_CNAME | DNS_MX | DNS_NS | DNS_TXT) ?: []; } } It uses WHMCS's own temporary storage, so there is no new table or setting to create. Change 10 and 600 (seconds) to suit your site. One thing to check: if your site is behind Cloudflare, every visitor reaches you from a Cloudflare address, so they would all share one limit. In that case use $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['REMOTE_ADDR'] in place of $_SERVER['REMOTE_ADDR'].

Sorry, my mistake on the name. In the list the template is called Support Ticket Created (Email Templates > Admin Messages). "New Support Ticket Opened" is only its subject line. Its default body already starts with: Client: {$client_name}{if $client_id} #{$client_id}{/if} So once you receive that email, you see the name without editing anything. It is sent only to admins who have the ticket's department ticked under Support Ticket Notifications on their admin user. That may be why you have never seen it, and why you only get the Notifications-rule message, which can't carry the name. If the template has been deleted on your install, or you would rather keep using your own email, a small hook does it. Save this as includes/hooks/ticket_open_admin_email.php: <?php use WHMCS\Database\Capsule; add_hook('TicketOpen', 1, function ($vars) { $c = Capsule::table('tblclients')->find($vars['userid']); $who = $c ? trim("$c->firstname $c->lastname") . " <$c->email>" : 'Guest'; localAPI('SendAdminEmail', [ 'customsubject' => "New ticket from $who: {$vars['subject']}", 'custommessage' => "<p>From: " . htmlspecialchars($who) . "</p><p>Ticket #{$vars['ticketid']}</p>" . nl2br(htmlspecialchars($vars['message'])), 'type' => 'support', 'deptid' => $vars['deptid'], ]); }); Because most of your tickets come in by email piping, test it with one piped message from a client address first. If piped tickets don't trigger it on your version, the TicketPiping hook point is the next thing to try.

Thanks, but already did so. The issue is it's not grabbing any details of the sender/opener. Most of mine are done via email that's piped in, and the only time it will give an email is if the sender is a guest. Never gives a name. As soon as it recognizes someone as being in the system, it gives me a ticket link and a userid, both of which are useless, as I know where tickets are found, and haven't memorized userids/names to the point where I'd recognize them. No vars available that make a difference, either.

Go to Configuration > Notifications and create a Notification Rule for New Ticket. Make sure you got Notification Message template in Email Templates > Notification Messages

Does WHMCS 8.13.1 support additive disk and bandwidth configurable options for overage billing, or do configurable options named Disk Space and Bandwidth replace the product's soft limits?

> Since it's a public page, I'd add a captcha or rate limit so bots don't hammer it. > One thing I would add from my own experience is to validate and sanitise the domain input on the server side before passing it to any WHOIS or DNS lookup, since it is a public form and people will try all sorts of input in it. How do I do this, please (I am not a programmer)?

That doesn't exist under admin emails or in fact anywhere in the email templates.