1. Confirm HTTPS works on the final WHMCS address and set the correct system URL.
2. Remove the installation directory after the supported installation process completes.
3. Protect configuration.php and keep a secure backup outside the public website.
4. Move writable storage and the cron directory to appropriate private locations using the supported configuration changes.
5. Confirm direct web requests cannot retrieve files from protected library and storage locations.
6. Review System Health and resolve the relevant environment or permissions warnings.

Give staff individual accounts, appropriate roles and two-factor authentication. Review inactive accounts and avoid a shared administrator login. Where staff use known fixed network addresses, assess an additional network restriction with a recovery route for authorised access.

A renamed administrator directory can reduce routine automated discovery, but it does not replace authentication or access control. Keep any callback URLs and integration settings consistent with the configured path.

Check that WHMCS can write the storage it needs while unrelated users cannot read private files. File permissions depend on process ownership and the server's PHP handler; do not apply broad writable permissions as a universal solution.

Use a harmless attachment and a test download to confirm that authorised access works after moving storage. Check an unauthenticated request as well. Record the result without placing customer documents into the test.

Schedule software and integration reviews, maintain usable backups and identify who receives security or cron alerts. Keep a list of sensitive provider credentials and their owner so they can be rotated when staff or suppliers change.

After the initial checks, test checkout, support, outgoing mail and automation again. A protective configuration that breaks a payment callback or email importer needs a precise correction, not wholesale removal of the protection. Keep the approved configuration and recovery steps with the installation's handover notes.

• Move WHMCS writable directories outside the public web root
• Protect the WHMCS administrator sign-in area
• Roll out two-factor authentication for WHMCS users and staff
• Back up and restore the WHMCS database and application files

• WHMCS: enhancing security
• WHMCS system health checks