WHMCS Security: Best Practices

[alinford]

With the recent security exploit, and subsequent patch from WHMCS, I am trying to figure out some best practices for WHMCS security.

 

I did some searching around on the forum, but did not find much, which surprised me, as I would think that there would be a sticky "Security" thread.

 

With regard to security, the documentation has this, http://docs.whmcs.com/Further_Security_Steps

 

What other security precautions should we be taking that are not included in the documentation?

 

Any security myths that have have people taking "security" precautions that are irrelevant to security?

[robb3369]

You have to look at security as a multi-level approach... Be sure your OS and applications are full patched, pick a good, reactive software fireall like CSF, and get a good application level firewall like Mod Security with something like the ASL/GotRoot ruleset.