ShoSecureAuth: passkeys and 2FA for WHMCS client and admin logins

[ShoHost]

Hi all,

We're ShoHost, a hosting company in Erode, India, and we build a few WHMCS addons in-house. This thread is for ShoSecureAuth, our login protection addon for WHMCS 8.x and 9.x. Questions and feedback are welcome here.

Why we built it

WHMCS already ships with time-based authenticator codes, Duo Security and YubiKey, and for some setups that's enough. The gaps are around it: not every client will install an authenticator app, a password reused from a leaked site still gets past a ban rule, and there's no simple way to treat the admin area and the client area differently. So the addon adds passkeys and more ways to receive a code, with each area configured on its own.

What it adds

• Passkey sign-in for clients and admins, using a fingerprint, face scan, device PIN or a security key. Passkeys only work on your own domain, so they can't be typed into a fake login page.
• One-time codes after the password by email (WHMCS mail or a separate SMTP server just for codes), WhatsApp, an authenticator app, or backup codes.
• Separate switches for the client area and the admin area. You can require passkeys for staff without changing anything for clients, or the other way round.
• Trusted devices remembered for a number of days you choose, and users can revoke them themselves.
• Rate limiting per IP and per account, so an attacker rotating through addresses doesn't get a fresh set of attempts on a targeted account.
• Admin step-up: a registered admin passkey can confirm sensitive actions instead of retyping the password.
• Code limits you can tune. Lifetime, attempt limit and resend cooldown default to 300 seconds, 3 attempts and 30 seconds. An in-progress code login can be dropped if the IP changes mid-flow.
• An enrolled-users screen and activity log, so you can see who has passkeys or 2FA, and reset a user who lost their phone.
• Health checks for the licence, HTTPS, the relying party ID and the login template, plus updates delivered inside the module.

Requirements and notes

• PHP with OpenSSL and cURL, and HTTPS on the live site (passkeys won't work without it).
• The relying party ID is your root domain, so passkeys work across its subdomains.
• Activating the addon patches the login templates, and deactivating it removes those patches.
• WhatsApp codes need our WhatsApp addon or your own MPWA gateway. Email and authenticator codes don't need either.
• It's sold separately and isn't bundled with any hosting plan.

Pricing and trial

ShoSecureAuth is for one domain-bound WHMCS install. The price and the 15-day free trial, which you start from the addon's License tab, are on the product page, and as an in-house product it carries a 7-day refund.

Features, screenshots and a comparison with the built-in 2FA are on the ShoSecureAuth page for WHMCS passkeys and 2FA.

If you try it, we'd like to hear how it fits your setup, especially if you run a mix of client and staff policies.