EEssam Posted December 19, 2007 Share Posted December 19, 2007 Hello, The title says it. I'm wondering if whether WHMCS is enough secure to be used in a shared hosting environment or not? You know servers root passwords, clients cPanel passwords, will be supplied and saved, are these sensitive data well encrypted, etc? Or it's much better to get a VPS/dedicated for it. Please advise. Thanks. 0 Quote Link to comment Share on other sites More sharing options...
0 wizzy420 Posted December 19, 2007 Share Posted December 19, 2007 Not to mention credit card numbers ... 0 Quote Link to comment Share on other sites More sharing options...
0 internetbrother Posted December 19, 2007 Share Posted December 19, 2007 well I was always wondering this! 0 Quote Link to comment Share on other sites More sharing options...
0 uberhost Posted December 19, 2007 Share Posted December 19, 2007 Or it's much better to get a VPS/dedicated for it. If WHMCS wasn't secure enough for a "shared environment" I certainly wouldn't be running it on dedicated servers. Think a moment, even if you secluded it to a VPS/dedi box, it would still be making automated calls to shared servers. 0 Quote Link to comment Share on other sites More sharing options...
0 MACscr Posted December 19, 2007 Share Posted December 19, 2007 I would recommend getting a VPS for it. Its not wrong to host your site on the same server as your users, but I dont recommend it. 0 Quote Link to comment Share on other sites More sharing options...
0 bear Posted December 19, 2007 Share Posted December 19, 2007 If WHMCS wasn't secure enough for a "shared environment" I certainly wouldn't be running it on dedicated servers. Think a moment, even if you secluded it to a VPS/dedi box, it would still be making automated calls to shared servers. I think it's more of a concern that other users on the box may try and access it because they have an account on the same server, or a user account gets hacked because of some outdated forum script or something. You can avoid a lot of potential issues by segregating the script from users accounts on a VPS or Dedicated all by itself...though a dedicated to run this would be a bit much. 0 Quote Link to comment Share on other sites More sharing options...
0 wizzy420 Posted December 19, 2007 Share Posted December 19, 2007 I would recommend at the least a dedicated VPS. 0 Quote Link to comment Share on other sites More sharing options...
0 griffe Posted December 19, 2007 Share Posted December 19, 2007 No one answered the most important questions...... Does WHMCS encrypt Credit Card numbers? Password? Etc? 0 Quote Link to comment Share on other sites More sharing options...
0 WHMCS CEO Matt Posted December 19, 2007 WHMCS CEO Share Posted December 19, 2007 No one answered the most important questions...... Does WHMCS encrypt Credit Card numbers? Password? Etc? Of course it does. The question is not "is WHMCS secure enough", the question is "is your server secure enough". In most cases the answer is no and by running it on a shared hosting environment it could be possible for another user on the server to access your files like bear has mentioned. Therefore a dedicated environment could be preferred. However, thousands of web hosts use WHMCS in a shared hosting environment without a problem. Matt 0 Quote Link to comment Share on other sites More sharing options...
0 UH-Simon Posted December 19, 2007 Share Posted December 19, 2007 I think Matt summed it up. It's not so much down to is the script secure enough, rather is the server/environment secure enough. I didnt even realise WHMCS stored card details or is this just dependent on the gateway you use? 0 Quote Link to comment Share on other sites More sharing options...
0 EEssam Posted December 20, 2007 Author Share Posted December 20, 2007 Thanks for your inputs. Much appreciated. 0 Quote Link to comment Share on other sites More sharing options...
0 chickendippers Posted December 20, 2007 Share Posted December 20, 2007 I didnt even realise WHMCS stored card details or is this just dependent on the gateway you use? It is dependent on the gateway. It doesn't store CC numbers for gateways like Worldpay and Paypal. 0 Quote Link to comment Share on other sites More sharing options...
0 wizzy420 Posted December 20, 2007 Share Posted December 20, 2007 Of course, even though CC is encrypted, you get back to the security of the server. The encryptions keys are stored in a file, on the server ... what would happen if someone got a hold of that file with the keys in it? 0 Quote Link to comment Share on other sites More sharing options...
0 brianoz Posted December 23, 2007 Share Posted December 23, 2007 Of course, the CC information would then be compromised. But you do run suphp or phpsuexec if you run your management on a shared server, right? Without it, your CC information could be vulnerable. 0 Quote Link to comment Share on other sites More sharing options...
0 georgew Posted April 21, 2008 Share Posted April 21, 2008 It is dependent on the gateway. It doesn't store CC numbers for gateways like Worldpay and Paypal. I'm new to WHMCS... but this is a post-sale question... I would like to use a payment gateway that does not require me to store credit card numbers at all. No matter how secure the web server is, or how well you guard credit cartd numbers, if you are storing them at all, you have a potential target. We used to do all credit card transactions on a isolated machine, without Internet access, etc... One day someone stole the entire machine. We notified our merchant bank, and they assured us it would be handled decretely, and our clients would not know we did this to them. They told us they would contact all of our client's issuing banks, and have new cards issued to them. But what really happened was different, and it was totally not descrete. We ended up spending hours on the phone calming down angry customers that were told we let their credit card numbers out. In actuality, the credit card numbers were not stolen, the reason the thieves took the computer was because it was the only one not bolted into a rack... It was easier to steal. Most likely they never found the credit card numbers on the machine... Our merchant never saw any attempts to use the software on the system. However rather than telling the clients it was a precaution, and that the numbers may not be compromised, the merchant banks told the clients a made up story about how we let hackers steal the credit card numbers. The point is I would rather not store cc numbers at all. So the questions are: 1. Is worldpay the only merchant supported (other than paypal) that does not require us to store cc numbers? 2. Does worldpay (or any other merchants other than paypal) handle recurring automatic charges for us? If so, how does it work? Thanks! George 0 Quote Link to comment Share on other sites More sharing options...
0 WHMCS CEO Matt Posted April 21, 2008 WHMCS CEO Share Posted April 21, 2008 Is worldpay the only merchant supported (other than paypal) that does not require us to store cc numbers? Nope, it's any third party gateway module. Looking at the homepage list right now, that includes PayPal, 2CheckOut, ChronoPay, ProtX (VSPForm), Google CheckOut, CyberBit, NoChex, AlertPay, etc... There's quite a range to choose from. Matt 0 Quote Link to comment Share on other sites More sharing options...
0 georgew Posted April 21, 2008 Share Posted April 21, 2008 So how do recurring cc payments work? Does the merchant store info on our customers, and we access that info when the customer has a subscription payment due or buys something new? Are they all like paypal? I understand the paypal model, but the problem there is the customer must have a paypal account. Paypal requires a membership. that model is fine for the customers that have a paypal account. But what about non-membership based processors? The reason I am asking so many questions is this... We have a paypal relationship, so that part is covered. However I am also needing to take credit cards directly. So I am looking for a payment gateway to do that processing, without having to handle the cards myself, and still being able to process recurring subscriptions using some sort of automatic mechanism. You may have already answered this question, but I'm not sure since I don't really understand how a non-membership processor might work, or if you were listing only the membership based processors that were like paypal. Sorry if I am being dense, perhaps I just need to go read the documentation. George 0 Quote Link to comment Share on other sites More sharing options...
0 Zorro67 Posted April 22, 2008 Share Posted April 22, 2008 Hi George, we direct users to the paypal gateway, but in AU, there page is divided into 2 options, pay by credit card, or pay by paypal account. i don't ever want a customer to give me his credit card details. have attached a screen shot for your review. hope this is the answer you are looking for 0 Quote Link to comment Share on other sites More sharing options...
0 serverfreak Posted April 22, 2008 Share Posted April 22, 2008 Worldpay has FUTUREPAY which support recurring payment. Your system will not store any CC info. All info are take care by Worldpay. Each successful transaction will call back by worldpay to WHMCs. We are using worldpay now. So far so good. So how do recurring cc payments work? Does the merchant store info on our customers, and we access that info when the customer has a subscription payment due or buys something new? Are they all like paypal? I understand the paypal model, but the problem there is the customer must have a paypal account. Paypal requires a membership. that model is fine for the customers that have a paypal account. But what about non-membership based processors? The reason I am asking so many questions is this... We have a paypal relationship, so that part is covered. However I am also needing to take credit cards directly. So I am looking for a payment gateway to do that processing, without having to handle the cards myself, and still being able to process recurring subscriptions using some sort of automatic mechanism. You may have already answered this question, but I'm not sure since I don't really understand how a non-membership processor might work, or if you were listing only the membership based processors that were like paypal. Sorry if I am being dense, perhaps I just need to go read the documentation. George 0 Quote Link to comment Share on other sites More sharing options...
0 Peak-Host Posted April 30, 2008 Share Posted April 30, 2008 I currently use it on shared hosting, but I don't let it set up the accounts automatically. But I do think it’s secure enough. 0 Quote Link to comment Share on other sites More sharing options...
Question
EEssam
Hello,
The title says it. I'm wondering if whether WHMCS is enough secure to be used in a shared hosting environment or not?
You know servers root passwords, clients cPanel passwords, will be supplied and saved, are these sensitive data well encrypted, etc?
Or it's much better to get a VPS/dedicated for it.
Please advise. Thanks.
Link to comment
Share on other sites
19 answers to this question
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.