Leaderboard

Hi all, Thanks very much for your feedback on the invoice immutability and credit/debit notes implementation in v9.0. We heard you loud and clear, and I'm pleased to say that in v9.1 we have implemented an admin-configurable Invoice Immutability setting. You can enforce invoice immutability, relax it while keeping billing notes, or turn it off entirely. For more information check out our release highlights, try it out yourselves, and share your feedback in the v9.1 Beta Discussion Board

Yes, I agree they should be an option

This new "feature" is terrible and is a fundamental change. This feature does not conform to most businesses and should be an option if there are other regulatory purposes in other countries. It severely limits the flexibility of the system and limits its function. I highly recommend a switch to disable this new "feature".

Glad to see more customers speaking up about this… it’s a simple, fixable issue. All they need to do is keep allowing the switch: Add ($allow_adminarea_invoice_mutation = true;) in your WHMCS configuration.php . WHMCS choosing a one-size-fits-all strict model is what’s really causing the pain… let us decide if we need to deal with regional compliance and added accounting complexity, not force it on everyone.

A system should be designed to be functional for its paying customers, rather than being dictated by external regulations that may or may not be applicable to all users. Implementing such a feature without a proper disable option is impractical and appears to be an oversight. The current suggested workarounds are ineffective for the majority of standard web design and hosting businesses. Remember, most projects start off with two 50% (published) invoices (deposit and final) from the quote when converted and the final invoice typically gets tweaked for various reasons. This change would prevent that quick 10 second update to it. WHMCS should focus on developing efficient software that delivers value to its users, allowing us to manage legal compliance independently, rather than introducing features that hinder usability.

While I understand that bugs are part of any Release Candidate cycle, it's concerning that we are still discussing basic optimization issues like proper OPcache support. And let's not even get started on the fact that we still don't have 100% native Nginx support. This becomes particularly ironic with the introduction of the new WHMCS Cloud Solution. With cloud hosting, the resource costs are on their side, so you'd think they'd be rushing to support Nginx to reduce their own infrastructure expenses. It's like being sold a high-performance engine but being told you have to power it with hamster wheels. Maybe once their bills start rolling in, Nginx support will suddenly become a priority. This all points to the bigger issue: the development velocity. Core development feels like it's just about "keeping the lights on" (PHP/ionCube updates) rather than actual innovation. This stagnation has allowed third-party developers like ModulesGarden to build entire businesses by selling us functionality that should have been in the core a decade ago. When you look at the "Total Cost of Ownership" license fees + necessary third-party modules, the value proposition is slipping. Newer platforms like Upmind are entering the market with an API-first architecture and modern features built-in from day one. If WHMCS continues to outsource innovation to the community while raising prices for maintenance updates, that competitive threat is going to become an exodus very quickly. We need core features that match the modern hosting landscape, not just compatibility patches.

Can't say I agree there. This will likely bite you at some point, badly.

@WHMCS John If you want this to be the new default Stripe module, a migration path from the current default Stripe module will be necessary.

Yeah this is a nightmare

This is what one WHMCS Staff tell me You have the option to make the change to your WHMCS configuration.php file and add the line $allow_adminarea_invoice_mutation = true;, but it is your decision whether to do so. When this line is present in your configuration.php file, the system will permit most of the changes to invoices that existed before WHMCS version 9.0, notably: Line items can be changed for invoices in any status (when in the "Manage" mode and with the correct admin user permissions set). All attributes are available in the Options tab regardless of the invoice status (when in the "Manage" mode and with the correct admin user permissions set). Payments can be applied in the Add Payment tab regardless of the invoice status (with correct admin user permissions set). Please note that using this configuration line ($allow_adminarea_invoice_mutation = true;) in your WHMCS configuration.php The file is highly discouraged, as it may permit changes that are not compliant with regional/country business regulations and complicate accounting. To bring awareness of this, a Warning health check will appear in the System Health Check summary when the value is present in your WHMCS configuration.php file. Additionally, all “full administrators” will see an Admin Warning banner (which can be dismissed up to every fortnight). You may want to add it temporarily if you do need to make the changes listed above, which were changed in WHMCS version 9.0 to improve invoice management and ensure tax compliance by keeping invoice records consistent. If you do not see any warnings or have issues with editing invoices or changing their status when this line is added, please let us know. Starting with WHMCS version 9.0, non-Draft invoices are immutable. This means you cannot edit transactions (now listed under the Ledger section on the invoice), add or remove items, or modify descriptions on an invoice once it’s no longer in the "Draft" status. This change is intended to improve invoice management and ensure tax compliance by keeping invoice records consistent. For more information on invoice management in WHMCS version 9.0, please refer to the following documentation: https://docs.whmcs.com/9-0/billing-and-invoicing/invoice-management/

I never imagined that a simple update could introduce so many problems — and even worse, apparently without proper testing. It is absolutely ridiculous for a financial management system to have its own financial logic broken. In the last 24 hours, I finally received a response on the open support ticket, along with a so-called “patch” (attached). In practice, this patch only fixes the reports by hiding the incorrect ledger entries. However, in several other areas of the system, the incorrect postings are still happening. For example, the “Transactions” tab inside the client profile continues to show wrong values and misleading entries. So, in short, this patch does not actually fix the root problem — it only masks it in specific reports. For now, apply it if you want to slightly reduce the visible impact, but be aware that the financial logic is still broken in multiple parts of the system. At this point, we are seriously considering rolling back to a previous version — or even migrating away from WHMCS entirely. Year after year, the pricing increases exponentially, while the quality of support continues to decline and critical issues like this keep happening. The current level of instability and support simply does not justify the price they are charging anymore. whmcs_v9.0.0-supporthotfix.1_750a0b77ff.321_WHMCS-24949.zip

Okay, maybe I was too quick about credit notes. It seems a lot of the features are "coming soon™️". This is not a Release Candidate lol. This is not even alpha. This is internal development. Nothing can convince me that this release didn't just happen because WHMCS promised us a release in December.

Automatic MarketConnect Account Registration: If your install isn't linked to a Marketplace account, 9.1 now attempts to create one during upgrade, with a starter credit applied. WHMCS has now reached a this point. I'm sure the community cannot wait for this highly requested feature. 🤣 it's clear that WHMCS is now at the stage of milking the software and community as much as possible.

My concern is less the feature itself and more how it is done. Creating a Marketplace account automatically during an upgrade, with a credit applied, means a third-party account is being created on behalf of the license owner without them clicking anything. For many of us, upgrades run on production systems, sometimes with several people involved, and some providers have rules on what information can be shared with outside services. A few questions that I think the WHMCS team should answer clearly: - Is there an opt-out or a confirmation step before the account is created? - What exact data (email, domain, license details) is sent to create it? - Is the account tied to a person or to the license, and what happens to it if we do not want it? If this is opt-in with a clear screen and a plain explanation, it is a convenience. If it happens silently, it is just another reason for people to distrust upgrades, especially with unattended updates coming in 9.1.

So you're disregarding the candid feedback, why bother seek it? Will there be a way to close this automatically created account and disconnect from the service? The credit is useless for any business that does not want to use anything from MarketConnect. Also, $50 is token at best. You're correct about busy admins but present this as an option during the update install. We all focus during an update. Options like, Yes, No, Remind me later, are sensible and provide admins the choice.

I've recently had to investigate one of those slightly annoying WHMCS problems: the cron job appears to be running correctly, but some executions never actually finish. This can be surprisingly easy to miss. Having cron.php started every 5 minutes only tells us that cron is starting it every 5 minutes. It doesn't tell us whether the previous execution actually completed. If an automation task hangs — because of an external API, a registrar/module, a network problem, a database issue, custom code, etc. — you may eventually end up with several overlapping cron.php processes without immediately noticing what is going on. I put together a debugging approach that gives visibility into three different levels: whether the PHP cron process actually starts and terminates; whether the WHMCS automation cycle enters and exits normally; which individual WHMCS automation task starts but never returns (or simply takes an unusually long time). The basic idea is to use the PreCronJob / AfterCronJob and PreAutomationTask / PostAutomationTask hooks, combined with a simple external shell wrapper and a check for overlapping processes. Instead of just knowing: "The WHMCS cron seems to get stuck sometimes." you can hopefully get to something much more useful, such as: cron.php started DomainSync started another cron.php process started another cron.php process started DomainSync never returned At that point, at least you know where to start looking. I've written up the complete procedure, including the hooks, shell script, logging examples and some additional notes here: https://eurossl.eu/knowledgebase/whmcs-cron-job-stuck-debugging/ I'm posting this because I'd still like to contribute useful technical information back to the WHMCS community. However, after fighting over the years with the community's occasionally ("creative" code editor, formatting issues, disappearing posts and similar adventures), I've decided to keep the full article and code somewhere I can actually maintain them. 🙂 Hopefully this will save someone a few hours of debugging.

Trying to download ImportAssist from Marketplace (https://marketplace.whmcs.com/product/46-importassist ) Using Chrome: the download process just gets stuck, without any error message Using Edge: I got the error "ImportAssist_v1.5.3.69 (2).zip can't be downloaded securely" Using Opera or Tor: the download is completed successfully

Seems it's an error I'd say. I randomly checked a few others in the marketplace, and that's the only one doing that. Frustrating it's the WHMCS addon, but things like this can creep in, especially on an addon that's been around a long while.

That's a small red flag. Anything that is using http today indicates a lack of care, error or just ignorance.

Honestly the worst thing I could have done. Modules are supported. Invoices can't be edited. Worst move ever.

I just had Claude.ai help me create a module and hook to allow me to click a button to revert the invoice back to Draft and it also allows me to click a button to zero out a late fee. I am all set.

Hello @sahostking Thank you for your message. We are aware of this issue in WHMCS 8.13.4, which is currently being tracked under case WHMCS-26568 with our development team. A hotfix has been attached to this message to address this issue for you and anyone else. Please upload and extract the contents of the attached file into your WHMCS installation directory, allowing it to overwrite the existing files. I hope this helps! WHMCS-26568-hotfix.zip

Hi everyone, I would like to share a free community addon I created for WHMCS 9.x: CW Invoice Mutability for WHMCS 9.x Repository: https://github.com/RicRey1988/cw-invoice-mutability-whmcs-9.x WHMCS 9 introduced invoice immutability for non-Draft invoices. I understand the reason behind this change from an accounting and audit-trail perspective, but I also noticed that some administrators still need a controlled way to manage invoice editing in specific internal cases, especially before an invoice is paid or before it is synchronized with an external tax/e-invoicing system. This addon provides an admin interface to manage the current WHMCS invoice mutability compatibility option without manually editing configuration.php. Main features: Enable or disable invoice mutability from the WHMCS Admin Area. Automatically add or remove the current WHMCS compatibility flag: $allow_adminarea_invoice_mutation = true; Create a backup of configuration.php before modifying it. Optionally hide the WHMCS Admin Area warning banner about invoice immutability being disabled. Advanced/emergency mode to convert eligible Unpaid invoices back to Draft. Audit log table with invoice snapshot, invoice items, transactions, admin ID, IP address, reason, and timestamp. Safety checks to block Draft conversion when the invoice has transactions, payment date, or possible external/tax authorization references. PayPal donation link included for anyone who wants to support the project. The advanced Draft mode is intentionally restricted. It is not intended for already-paid, fiscalized, externally authorized, or tax-reported invoices. In those cases, the correct workflow should normally be credit notes, cancellation, voiding, or re-issuance according to local accounting rules. Installation: The folder must be named exactly: cw_invoice_mutability Final WHMCS path: /modules/addons/cw_invoice_mutability/ Required structure: modules/ └── addons/ └── cw_invoice_mutability/ ├── cw_invoice_mutability.php ├── hooks.php ├── README.md └── lib/ └── CwInvoiceMutabilityTools.php You can clone it directly with: cd /path/to/whmcs/modules/addons git clone https://github.com/RicRey1988/cw-invoice-mutability-whmcs-9.x.git cw_invoice_mutability Then activate it from: Configuration > System Settings > Addon Modules After activation, go to: Addons > CW Invoice Mutability This addon is free and community-oriented. It is not affiliated with WHMCS. If it helps you, donations are welcome: https://paypal.me/hostingsupremo Feedback, improvements, and pull requests are welcome.

I’m trying to install ModulesStack from https://modulesstack.com/installation/ I followed the steps, but I’m not sure if I’m doing it correctly. The installer runs, but the modules don’t appear in my admin panel. Has anyone successfully installed it? What am I missing?

I’ve added: $allow_adminarea_invoice_mutation = true; Honestly, this change is a nightmare for our daily workflow. We need to edit invoices every day, and with this new restriction, what used to be a simple operation has become an everyday problem. In my opinion, this was a very bad decision from a usability point of view, especially for companies that manage billing operations daily and need flexibility when handling invoices.

Unbelievable that all of our questions lately are being ignored. What's the point of this community?

Not everyone wants SAAS solutions, or keeping data with a third party due to concerns about client data. I'm one of those businesses.

Request WHMCS to make it a confugurable option instead of removing it?

The one question I have is "why"? Clearly there's a need and demand for it, why is it not even considered being made optional, with warnings about not doing it or what have you. Why is it simply removed, with no options and so on.

Whats stupid is as a developer this is as simple as adding a checkbox to the config to allow us to choose ourselves. I've never in my life understood why software companies lock you in, instead of giving you the option. You keep increasing prices year after year and you want us to stay with you, but if you keep doing this crap most of your base is not gonna find value in your ever increasing prices.

Welcome to the common sense reasons why were frustrated about WHMCS enforcement of preventing us from editing our OWN invoices we created in the first place. Credit / debit is useless in real world standard practice. If they want to provide a switch to disable editing published invoices or changing status fine, but dont force it on the customer base. That's dumb.

Are there still issues after the 9.0.3 release?

add this line to your configuration.php it will go back to normal behavior $allow_adminarea_invoice_mutation = true;

Thank you for the terrible WHMCS support. This is now the tenth client who has made a bulk payment and the late fee is simply not added to the invoice, and none of the outstanding invoices are automatically marked as paid. I’m not even going to mention the credit and debit issues anymore, because it seems the WHMCS developers themselves don’t even know what they’re doing. Does anyone have a suggestion for another system similar to this garbage?

I think you guys may be dramatically underestimating what AI is capable of, but I suppose we shall see. As for the post being suitable or not, Webpros has done everything in their power to alienate their client base - this type of post is the inevitable consequence of that.

"Luck" isn't really a component here. If you haven't played around with agentic coding I can see why this would seem like a stretch for you, but it's quite trivial to get a fairly simple billing system up and running quite rapidly. And like I said this is with current-level tools, in a year or two, replicating the entirety of WHMCS would likely be very doable.

Yeah, except for adding AI to domain search, this release doesn't really provide on any of the other promises. Credit notes doesn't work either. When you cancel an invoice, WHMCS just adds a transaction to the invoice. If the invoice has a total of $100, WHMCS just adds a transaction of $100 and cancels the invoice. There's no credit note or anything.

How WHMCS have set this as a RC instead of a Beta is insane. It's a huge upgrade in terms of it's impact on themes/modules. No beta, no reply from WHMCS, no forums specific to v9.

Your process sounds good apart from WHMCS. I would never recommend trying to import tables to new files. You need to update your existing install as normal. You can update from your version but you may have more luck doing a manual update. Backup everything, upload the new v8.13 files, adjust your hosting/server settings to meet the requirements (e.g you may need to update PHP) then run the installation script.

@BENELUX, Today's the day!! https://blog.whmcs.com/133775/whmcs-90-release-candidate-out-now

This week or next! It sure would be nice to double the size of the engineering team temporarily for one release every few years!

I think WHMCS are in and have been for a while the stage of milking the software for us much short term gain as possible at the cost of the long term community and direction. I think the reality is the small hosting industry as a whole is in major decline and WHMCS are seeing the same decline so they are now just milking it dry. A bit depressing but with the rise of Wix, AI generated websites/hosting, Shopify etc the decline is going to continue.

WhatsSuite - WhatsApp Automation & Business Suite for WHMCS Introducing WhatsSuite, a complete WhatsApp automation and communication suite built specifically for WHMCS. WhatsSuite connects your WHMCS installation with WhatsApp and automates customer communication for invoices, payments, orders, hosting services, domains, support tickets, account activity, reminders, campaigns, and more, all from one centralized dashboard. Whether you run a web hosting company, VPS or cloud provider, domain registrar, agency, or another WHMCS-powered business, WhatsSuite helps you communicate with customers faster while reducing repetitive manual work. WhatsApp Integrations Connect WhatsSuite using multiple WhatsApp providers: Meta WhatsApp Cloud API - Official WhatsApp Business Platform integration Evolution API - Easy WhatsApp connection with QR-based setup Multiple WhatsApp number support Connection status monitoring Webhook management Provider health monitoring Connection testing tools Choose the integration that best fits your business and manage your WhatsApp communication directly from WHMCS. Automated WHMCS Notifications Automatically send WhatsApp messages when important events happen inside WHMCS. Billing & Invoices Invoice Created Invoice Paid Invoice Due Reminders Invoice Overdue Reminders Payment Confirmations Payment-related notifications Orders New Order Order Status Updates Order Payment Notifications Order-related alerts Products & Services Service Activated Service Suspended Service Unsuspended Service Terminated Cancellation Requests Service Status Updates Domains Domain Registration Domain Renewal Domain Transfer Updates Domain Expiration Reminders Configurable renewal reminders before expiration Support Tickets New Ticket Notifications Admin Reply Notifications Client Reply Notifications Ticket Status Updates Support communication alerts Client & Account New Client Registration Account Notifications Password & Security Alerts WhatsApp Number Verification Communication Preference Updates Advanced Template Manager Create and manage professional WhatsApp message templates directly from the WHMCS Admin Area without editing module files. Use dynamic WHMCS variables to automatically personalize every message. Example: Hi {client.firstname}, Your invoice #{invoice.id} for {invoice.total} is due on {invoice.due_date}. You can view and pay your invoice here: {invoice.url} Templates can be configured for different events, providers, and customer languages. Dynamic WHMCS Variables Use information directly from WHMCS, including: Client name and contact information Invoice ID, total, balance, status, and due date Order information Product and service details Domain name and expiration date Ticket information Company information Payment and billing information Custom message data Create your templates once and let WhatsSuite automatically personalize them for every customer. Smart Automations & Reminders Go beyond basic event notifications with scheduled WhatsApp automations. Invoice Reminders Configure automatic messages such as: 7 days before due date 3 days before due date On the due date 1 day overdue 3 days overdue 7 days overdue Domain Expiration Reminders Automatically remind customers: 60 days before expiration 30 days before expiration 15 days before expiration 7 days before expiration 3 days before expiration 1 day before expiration Configure your own timing and decide exactly when customers should receive notifications. Message Queue & Automatic Retry WhatsSuite includes a dedicated message queue designed for reliable automated communication. Messages can be tracked as: Queued Scheduled Processing Sent Delivered Read Failed Retried Cancelled Failed messages can automatically retry according to your configured rules. The queue also helps prevent large notification batches from affecting normal WHMCS operations. WhatsApp Campaigns Send targeted WhatsApp campaigns using your existing WHMCS customer database. Filter recipients using information such as: Client Status Client Group Country Language Currency Product Product Group Service Status Billing Cycle Domain Status Domain Extension Invoice Status Outstanding Balance WhatsApp Verification Communication Preferences Preview your target audience before sending and process campaigns through the WhatsSuite message queue. Contacts Management Manage WhatsApp contacts using your existing WHMCS customer database. View: Customer WhatsApp Number Country Language Verification Status Communication Preferences Last Message Message History Search and filter customers and quickly access their WHMCS profiles. WhatsApp Number Verification WhatsSuite can maintain customer WhatsApp information including: Original phone number Normalized international number Verification status Verification history Communication preferences Phone numbers can be normalized for international WhatsApp communication. Communication Preferences Give customers control over the WhatsApp communications they receive. Preferences can include: Billing Alerts Service Updates Domain Reminders Support Replies Security Alerts Marketing Messages Transactional and marketing communications can be managed separately. Manual WhatsApp Messaging Administrators can also send WhatsApp messages manually from WHMCS. Quick message actions can be used for: Custom Messages Invoice Reminders Payment Confirmations Service Notifications Domain Reminders Support Follow-ups Messages are recorded in the WhatsSuite message history. Media & Invoice Support Depending on the connected WhatsApp provider, WhatsSuite can support: Text Messages Images Documents PDF Invoices Media Attachments WhatsApp Template Messages Message Tracking Monitor your WhatsApp communication from one place. Track: Sent Messages Delivered Messages Read Messages Failed Messages Queued Messages Provider Message IDs Delivery Time Read Time Errors Retry Attempts Delivery and read information depends on the capabilities provided by the selected WhatsApp integration. Analytics Dashboard The WhatsSuite dashboard provides useful insights into your WhatsApp communication. Monitor: Messages Today Messages This Month Delivered Messages Read Messages Failed Messages Queued Messages Delivery Rate Read Rate Message Activity Messages by Event Messages by Provider Campaign Performance Automation Performance Everything is managed through a clean and modern interface directly inside WHMCS. Administrator WhatsApp Alerts WhatsSuite isn't limited to customer notifications. Administrators can also receive WhatsApp alerts for important WHMCS events such as: New Orders New Payments Important Support Tickets Provisioning Failures Service Automation Failures Registrar Errors WhatsApp Provider Problems Queue Failures Critical System Events Stay informed about important activity even when you're away from your WHMCS Admin Area. System Health & Diagnostics Built-in diagnostic tools help monitor your WhatsSuite installation. Check: WhatsApp Connection Provider Status Webhook Status Message Queue WHMCS Cron Database Template Synchronization Failed Messages Module Compatibility Quickly identify configuration or connection problems from one place. Multi-Language Ready WhatsSuite is designed for international WHMCS businesses. The interface and template architecture supports multiple languages, including: English Arabic Spanish French German Portuguese Italian Dutch Turkish Arabic RTL is supported. Create different WhatsApp templates for different customer languages and automatically deliver the appropriate message. Designed Specifically for WHMCS WhatsSuite is built around WHMCS workflows rather than being a generic WhatsApp sender. It integrates communication with: Clients Orders Invoices Products & Services Domains Support Tickets Billing Automation Administrators Manage everything directly from your WHMCS Admin Area. Easy Setup Getting started is simple: Upload and activate WhatsSuite Open the WhatsSuite setup wizard Choose your WhatsApp provider Connect your WhatsApp account Configure your message templates Enable your preferred automations Start sending No WHMCS core file modifications are required. Perfect For WhatsSuite is ideal for: Web Hosting Companies VPS & Dedicated Server Providers Cloud Hosting Providers Domain Registrars & Resellers Web Design Agencies Managed Service Providers SaaS Businesses Any business using WHMCS License & Pricing $49 One-Time One WHMCS Installation One-Time License Fee Easy Installation Multi-Language Support Arabic RTL Support No WHMCS Core Modifications Purchase WhatsSuite WhatsSuite - WhatsApp Automation & Business Suite for WHMCS Purchase WhatsSuite for $49 One-Time One WHMCS addon. One dashboard. Complete WhatsApp automation.

@NiceNIC Team Welcome to the WHMCS community. We look forward to some interesting conversations and valuable insights from your registrar-side perspective. Wishing you a great time in the community!

@bluesteam Don't remove those records now, I'll have a look to see what will happen if we remove these records. But do you have a table tblcredit, does it have some credit data as well?

We've migrated from CentralNic to OpenProvider, and it's been mostly without issues. We've had to contact OP support a few times but have almost always gotten a quick reply. Their WHMCS module is fine. It needs work here and there but they're open to suggestions - and their entire module is open source so anyone can make PRs. I've submitted a few and got them approved. Their API can be slow from time to time, but this was also an issue with CentralNic. Unfortunately, OpenProvider's API has a few more stability issues than CentralNic's. Switching to OpenProvider won't necessarily release you entirely from the hands of CentralNic, though. OpenProvider use CentralNic for a lot of TLDs - but OpenProvider's pricing generally better, even for those TLDs.

This is fully achievable. You can either redesign WHMCS to match your website, or go fully API-driven and handle everything directly on your main site without exposing WHMCS. We’ve implemented similar solutions before that are still in production today, including domain registration, support centers, and custom domain search integrations. The main issue is likely the developers you’re hiring. Lower-end developers usually lack the experience required for this level of integration. What you are asking is NOT a simple “WHMCS tweak” It is: → a custom frontend application → with WHMCS acting as a backend API Most developers fail because: - They only know WHMCS templating - They don’t understand UX flow - They don’t build proper API orchestration A proper implementation would typically cost: $5.000 – $20,000+ for full api-driven (true seamless experience)

Yes, I'm hoping they're making an option

Seems 16 years after the issue was originally raised for any EU customer, which till now could fix that manually, the problem still remains, 1 month before digital invoicing comes into practice. I've reinforced the problem with support who appears to be an excellent developer but to have noclue on the EU fiscal legislation. And this WILL bring some user to get fines, because WHMCS will start pushing illegal invoices directly into the tax agency archives. Below is a copy of the ticket with references and legislation quotes: Let’s focus on the core problem: the invoice. The report is a minor issue — we can easily pull the subtotal instead of the total. The real issue is that the final invoice (HTML/PDF) WHMCS generates is incorrect. Scenario recap The client has an uninvoiced credit of 10€. An invoice for 10€ is generated. The invoice is marked as paid using the credit. WHMCS produces a “final” invoice showing a total of 0€. That’s not just wrong; it’s illegal in Spain and much of Europe. WHMCS has been told about this for 16years, yet it persists. Prior discussions (evidence that it’s an old, known problem) Case1 – “Credit management according to European fiscal law” – posted on 22 Aug 2024: https://whmcs.community/topic/339796-credit-management-according-to-european-fiscal-law-a-project/. The user clearly explains why zerototal invoices violate EU law and how to fix it, but there was no followup from WHMCS. Case2 – “Account prefunding credits” – 7 Feb 2008: https://whmcs.community/topic/34693-account-pre-funding-credits/. Users complained that credit zeroes out invoices and makes them look like free services. Case3 – “Paid invoices showing zero balance” – 2009: https://whmcs.community/topic/89177-paid-invoices-showing-zero-balance/. Users report that invoices show zero once paid. Case4 – “Credit into the invoice – paid but appears in 0” – 24 Sep 2007: https://whmcs.community/topic/22777-credit-into-the-invoice-paid-but-appears-in-0/. WHMCS staff responded that the invoice was “paid by credit,” implying it can show zero. This thread highlights the confusion and legal concerns caused by WHMCS treating creditfunded invoices as zerovalue invoices. Case5 – “Tax on credits” – 2008: https://whmcs.community/topic/37369-tax-on-credits/. Users from the EU explain that failing to invoice credits and showing services as free is illegal. VAT must be charged on the credit invoice; subsequent invoices paid from credit should show the amount and 0€ due, but WHMCS doesn’t do this. Case6 – Feature request “Invoices for 0.00 are illegal for many WHMCS users” – 2010: https://requests.whmcs.com/idea/invoices-for-0-00-are-illegal-for-many-whmcs-users. Users explicitly ask WHMCS to stop generating 0.00 invoices. If the service total really is 0, there should be no invoice. Why it is illegal Under EU and Spanish law: Every sale or service requires an invoice showing the taxable base, VAT, and total. Even if the VAT is zero, the “Total factura” must equal the base. Advance payments must be invoiced. The Spanish tax authority (Agencia Tributaria) states: “los empresarios y profesionales… deben expedir factura en los supuestos de pagos anticipados”. A credit on account is an advance payment, so there must be a proper invoice for it, with VAT. Zerovalue invoices are allowed only when there is a 100 % discount or return. Paying with credit isn’t a discount; it’s the settlement of a debt using funds already invoiced. Therefore, a zerototal invoice misrepresents the transaction and can be treated as a null invoice by the tax authorities. Digital invoicing (e.g., Spain’s SII) will reject zerovalue invoices unless they meet those strict exceptions. Sending invoices with a total of 0€ to the Spanish tax agency will mark the income as zero — effectively tax evasion. Why WHMCS must fix this If WHMCS continues to issue invoices showing 0€ when the real service cost is >0€, every EU client using WHMCS 9.0 for digital invoicing is going to push illegal invoices into government systems. This is not a minor bug; it’s a compliance failure. WHMCS is exposing its customers to fines and even criminal liability for issuing fraudulent invoices. I’ve been running companies in Italy and Spain since 2005, so this isn’t an academic complaint. You need to bring in a European tax expert and fix the invoicing logic immediately. Issue a proper invoice when credit is added, showing the taxable base, VAT and total. On the service invoice, show the service price and VAT, and then indicate that it’s paid via credit. The invoice can show a remaining balance of 0€, but it must not zero out the value of the service. Sending digital invoices with zero totals is a direct invitation to tax authorities to classify the transaction as void and accuse your clients of tax evasion. That’s unacceptable. WHMCS needs to address this now. Here are the primary legal and regulatory sources referenced above: AgenciaTributaria – Obligación de facturar (Spain) – Official guidance from the Spanish tax agency stating that businesses must issue invoices for all supplies of goods or services and must also issue invoices for advance payments sede.agenciatributaria.gob.es . https://sede.agenciatributaria.gob.es/Sede/iva/facturacion-registro/facturacion-iva/obligacion-facturar.html AgenciaTributaria – Libro registro de facturas expedidas (IVA) y de ventas e ingresos (IRPF) – FAQs clarifying that even operations exempt from VAT must be recorded, and the invoice’s “Total factura” must match the base amount sede.agenciatributaria.gob.es . https://sede.agenciatributaria.gob.es/Sede/iva/facturacion-registro/preguntas-frecuentes/libro-registro-facturas-expedidas-iva-irpf.html Ley 37/1992 del Impuesto sobre el Valor Añadido (Spanish VAT Law) – The consolidated text of the law, including Article 80 (reductions of the tax base) and related provisions on discounts and corrections. https://www.boe.es/buscar/act.phpid=BOE-A-1992-28740 SAP SII tip – Invoices with zero amounts in Spain – A professional summary referencing Article 164.Uno.3.º, Article 78.Tres.2º and Article 80 of Spain’s VAT law, explaining that zeroamount invoices are only valid for 100% discounts or returns community.sap.com . https://community.sap.com/t5/enterprise-resource-planning-blog-posts-by-sap/sii-tip-for-spain-6-invoices-with-zero-amounts-in-sii-due-to-full-discounts/ba-p/14228706 Dear WHMCS developers, hire somebody who knows what he talks about to take care of this, not a php developer. I love the software but this requires fixing. thanks

For businesses that heavily utilise WHMCS's API, you may be sending API requests from many different IP addresses or IP ranges, all of which need to be whitelisted at System Settings > General Settings > Security (tab) > API IP Access Restriction in the Admin Area. Each individual IP address must be added to the allow list (it is not possible to list IP ranges in CIDR notation at this time). The process of adding a range of IP addresses can be sped up by using a PHP script to add them in bulk. Before we begin, WHMCS support does not recommended directly interacting with the database where it can be avoided. We would therefore only recommend following this guide if you have an existing understanding of both PHP and database administration, and have taken a full database backup. WHMCS will not be held responsible for any data loss that might occur if you do not heed this advice. How are API Allowed IPs stored? The list of IPs allowed to interact with the API are stored as a serialized array in tblconfiguration.value where tblconfiguration.setting = "APIAllowedIPs". A serialized array, in this particular context, is a way for us to store an array as a string in the database. Handling existing data in WHMCS's database To make things easy, let's create a function that takes in the current serialized array, which you can retrieve from the database, a new IP and a note, and then returns the new serialized array. Here it is, with everything explained in inline comments: function addNewIP($currentValue, $ip, $note) { // Take the $currentValue, and unserialize it so we can interact with it directly. $data = unserialize($currentValue); // Define our new entry, based on the $ip and $note provided in the function call. $newEntry = array( 'ip' => $ip, 'note' => $note ); // Add the new entry to the existing array. $data[] = $newEntry; // Re-serialize the array. $newValue = serialize($data); // Return to the serialized version of the new array. return $newValue; } Iterating through IP ranges We now need to iterate through all IP address in a given range and add them to our array. Let's create another function to do this: function addNewIPRange($currentValue, $startIP, $endIP, $note) { // Convert the start and end IP addresses to long integers so we can iterate through them $startIP = ip2long($startIP); $endIP = ip2long($endIP); // Initialize $newValue $newValue = $currentValue; // Iterate through the IP range for ($ip = $startIP; $ip <= $endIP; $ip++) { // Convert the current IP back to string format $newIP = long2ip($ip); // Call the addNewIP function for each IP in the range $newValue = addNewIP($newValue, $newIP, $note); } // Return the modified value return $newValue; } Note that we'll still need to provide the current value from the database, and this will be updated each time an IP in the range is added. Testing it out First of all, we need to retrieve the current serialized array from the database. This can be done programmatically using Capsule, but in this case we'll just retrieve it manually: SELECT value FROM tblconfiguration WHERE setting = 'APIAllowedIPs' Then we can call addNewIPRange to add an IP range, or just addNewIP if we only want to add a single address. Of course, when you're using this you wouldn't need to add all of the extra echo lines or comments - these are just included to help demonstrate how this is working. // Store current APIAllowedIPs value in variable $currentValue = 'a:5:{i:0;a:2:{s:2:"ip";s:0:"";s:4:"note";s:0:"";}i:1;a:2:{s:2:"ip";s:12:"10.3.137.243";s:4:"note";s:0:"";}i:2;a:2:{s:2:"ip";s:7:"8.8.8.8";s:4:"note";s:7:"Testing";}i:3;a:2:{s:2:"ip";s:7:"1.1.1.1";s:4:"note";s:7:"Testing";}i:4;a:2:{s:2:"ip";s:11:"12.13.14.15";s:4:"note";s:7:"Testing";}}'; // Let's see our $currentValue in a more readable format so that we can compare it to our new version echo "<h1>Starting value</h1>"; echo "<pre>"; print_r(unserialize($currentValue)); "</pre>"; echo "<br/><hr/>"; // To add a new IP range, call addNewIPRange, and pass in the $currentValue, IP range and a note: $testRange = addNewIPRange($currentValue, '10.20.30.40', '10.20.30.60', 'Test IP Range'); echo "<h1>With our added IP range</h1>"; echo "<h2>Serialised version:</h2>"; echo $testRange; echo "<h2>Unserialised version:</h2>"; echo '<pre>'; print_r(unserialize($testRange)); '</pre>'; echo "<br/><hr/>"; // To add a single IP, call addNewIP, and pass in our new value, address and a note: $testSingle = addNewIP($testRange, '192.168.1.1', 'Single IP'); echo "<h1>And with one more address</h1>"; echo "<h2>Serialised version:</h2>"; echo $testSingle; echo "<h2>Unserialised version:</h2>"; echo '<pre>'; print_r(unserialize($testSingle)); '</pre>'; echo "<br/><hr/>"; You can then add the new data to the database manually, or using Capsule. Doing the latter is beyond the scope of this article. The final script Let's finish by tidying up the scirpt a bit, and showing an example. Let's say we wanted to whitelist the following: 192.168.45.23 - management VPN 192.168.45.24 - development VPN Range from 10.20.0.126 to 10.20.10.159 - backend servers Here's what your script would look like: <?php function addNewIP($currentValue, $ip, $note) { $data = unserialize($currentValue); $newEntry = array( 'ip' => $ip, 'note' => $note ); $data[] = $newEntry; $newValue = serialize($data); return $newValue; } function addNewIPRange($currentValue, $startIP, $endIP, $note) { $startIP = ip2long($startIP); $endIP = ip2long($endIP); $newValue = $currentValue; for ($ip = $startIP; $ip <= $endIP; $ip++) { $newIP = long2ip($ip); $newValue = addNewIP($newValue, $newIP, $note); } return $newValue; } $currentValue = 'a:5:{i:0;a:2:{s:2:"ip";s:0:"";s:4:"note";s:0:"";}i:1;a:2:{s:2:"ip";s:12:"10.3.137.243";s:4:"note";s:0:"";}i:2;a:2:{s:2:"ip";s:7:"8.8.8.8";s:4:"note";s:7:"Testing";}i:3;a:2:{s:2:"ip";s:7:"1.1.1.1";s:4:"note";s:7:"Testing";}i:4;a:2:{s:2:"ip";s:11:"12.13.14.15";s:4:"note";s:7:"Testing";}}'; $manVpnIP = addNewIP($currentValue, "192.168.45.23", "Management VPN"); $devVpnIP = addNewIP($manVpnIP, "192.168.45.24", "Development VPN"); $backendServers = addNewIPRange($devVpnIP, "10.20.0.126", "10.20.0.159", "Backend Server"); echo $backendServers; The output of this script would be the new serialized array, and you can set this directly in the database! Again - please make sure to take a backup before manually interacting with WHMCS's database. UPDATE tblconfiguration SET value = '<add your serialized array here>' WHERE setting = 'APIAllowedIPs'; Important: You must use single quotes and not double quotes, else the command's format will not be valid (since double quotes are used in the serialized array itself). Once you have run this, login to the WHMCS admin area and navigate to System Settings > General Settings > Security (tab). You should now see a list of all your IPs listed in the API IP Access Restriction setting. Further considerations After adding so many IP addresses, you may find that you are no longer able to add any more addresses via the Admin Area. This will be because your PHP max_input_vars is being exhausted. It is not a bug with WHMCS, nor is it something that we can mitigate - this is how PHP is configured by default. https://www.php.net/manual/en/info.configuration.php#ini.max-input-vars To rectify this, please increase the max_input_vars value in your PHP configuration. Should you need assistance with doing this, please contact your hosting provider or system administrator. It is also possible that you might reach the maximum size for the value column in tblconfiguration. In the event of this occurring, you can change the type of the column to MEDIUMTEXT. Please keep in mind that this is not officially supported, and you should definitely take a database backup before proceeding. Customising/extending this script Feel free to customise this script to you heart's content, whether you want to change how it behaves or extend its functionality. However, please keep in mind that our Technical Support team won't be able to help you troubleshoot any problems that you may encounter should you make any changes. Use at your own risk. Suggestions for other "Tips & Tricks' articles If you'd like to see an example of how we can customise WHMCS in other ways, please do give us your suggestions!