Anyone using WHMCS for non hosting business?

[JFS]

Hello everyone,

I'm considering using WHMCS for my business' online billing and self service account management and was wondering if anyone else was doing that too. We sell software as a subscription service, hardware to accompany it, and also consulting, training, and installation. Basically we have several different subscription services, with options having different billing rates based on user counts and hardware counts, along with one time invoices...

All comments appreciated!

Best,
John

[Kian]

Hello,

2 hours ago, JFS said:

We sell software as a subscription service [...] and also consulting, training, and installation

Basically that's me. WHMCS is okay but be careful with Licensing Addon if you plan to use it. It took me years to fix all flaws it has.

I also know a fair amount of companies that are using WHMCS for things not related to hosting like for example consulting, support, a couple of SaaS, license selling, dropshipping, marketing and a radio station.

[JFS]

1 hour ago, Kian said:

Hello,

Basically that's me. WHMCS is okay but be careful with Licensing Addon if you plan to use it. It took me years to fix all flaws it has.

I also know a fair amount of companies that are using WHMCS for things not related to hosting like for example consulting, support, a couple of SaaS, license selling, dropshipping, marketing and a radio station.

Cool. It does come highly recommended but I'd like to know the warts ahead of time. Can you give more detail regarding the licensing add-on? I do need it for one of our software titles...

[Kian]

Licensing Addon is great and it's not even complicated to implement in your scripts if your PHP skills are good. The problem I'm referring to is something you'll start to notice when it's already too late ☹️ Simply put license check is based on a combination of domain name, IP and path. Let's say that you sold your script to this guy:

• Domain: example.com
• IP: 127.0.0.1
• Path: /home/examplecom/public_html/modules/addons/whatever

Every time your script is used, the license check is performed against your server. As you can imagine this is terrible since your server could be flooded with an enormous amount of unnecessary license checks. There's no point in checking if the license is valid on every page load that's why we use Local Key (I quote) «that stops the license checking code having to call your server on every page load». Basically you locally store an encrypted string that contains a sort of expiration date. This way licence check can be performed every X number of days.

The problem is that even if you have successfully implemented the local key, there are situations where you could still receive a lot of unnecessary checks for multiple reasons. For example some servers are configured to run cron jobs not with "local" PHP (the one that runs example.com) but with server one where "example.com" doesn't exist. Here is what happens:

1. Client: Hi, I'm example.com. Am I allowed to run your script?
2. Your server: Sure but save this string so that you don't need to ask this again for 10 days: "hbdcdEXAMPLE.COMsajdg2020-04-16bsahad" (let's pretend that this is an encrypted string 🤣)
3. Client: Okay! See you next time (2020-04-16)
4. 5 minutes later WHMCS runs cron job that should run (I quote) «Every 5 minutes, or as frequently as your web hosting provider allows». As we said earlier, this server is configured to run crons not with "local" PHP so instead of EXAMPLE.COM you're going to have server IP, hostname and stuff like that and here is what happens
5. Client: Is «hbdcdEXAMPLE.COMsajdg2020-04-16bsahad» equal to «hbdcdVIRTUAL-MACHINE-122.AMAZON-AWS.COMsajdg2020-04-16bsahad»? Nope! So I have to send a new license check
6. Client: Hi, I'm virtual-machine-122.amazon-aws.com. Am I allowed to run your script?
7. Your server: well, I don' know who you are but I don't restrict the use of my software to domain/IP so that's fine. Take this string so that you don't need annoy me again for 10 days «hbdcdVIRTUAL-MACHINE-122.AMAZON-AWS.COMsajdg2020-04-16bsahad»
8. Next page load that runs with local PHP
9. Client: is «hbdcdVIRTUAL-MACHINE-122.AMAZON-AWS.COMsajdg2020-04-16bsahad» equal to «hbdcdEXAMPLE.COMsajdg2020-04-16bsahad»? Nope!
10. Client: Hi, I'm example.com. Am I allowed to run your script?
11. Your server: wtf... never-ending loop?

This was just an example but there are many more ways to trigger this kind of loop (curl() / webservice, particular server configuration, CDN etc.). Now imagine you have 1000 customers and 5% cause this issue. You're going to have 50x3 = 150 unnecessary POST requests every 5 minutes for the rest of your life 😍

Edited April 6, 2020 by Kian

[wsa]

That true 

[JFS]

9 hours ago, Kian said:

@Kian, Yikes! 🤯 That would have been a bitch to figure out once we're neck deep. I appreciate the heads up. Thanks a million.