Protect WHMCS administrator access with individual accounts, suitable permissions and strong authentication. A custom administrator directory can reduce routine discovery, but the login still needs the same security controls.
IN THIS ARTICLE
01 Review staff access first
- List staff who need administrator access and the tasks each person performs.
- Give each person an individual account with the appropriate role. Disable accounts that no longer have a business purpose.
- Enable and test the supported two-factor authentication method, including a controlled recovery process.
- Review access logs and decide who investigates unexpected sign-ins.
- Where fixed staff addresses or a managed network make it practical, test an additional access restriction without locking out the authorised recovery route.
02 Rename the administrator directory
For a self-hosted installation, back up configuration.php and record the current directory. Set $customadminpath to the new directory name, then rename the existing administrator directory to that exact name. The value is a directory name within the WHMCS root, not an arbitrary absolute path.
Use the characters permitted by WHMCS and keep the new location in your secure operating notes. Test a fresh sign-in before closing the existing administrative session.
03 Review integrations after the change
Some gateway, mail or sign-in integration callbacks can reference the previous administrator path. Inspect their documented callback and redirect settings and update any affected addresses. A successful login does not prove every external integration still works.
During manual updates, upload the distribution's administrator files into the configured custom directory. Leaving them in a new default admin folder can leave the real administrator interface on older files.
04 Example: match the configured admin directory and the actual folder
For a self-hosted test installation, an illustrative custom directory is staff-console-example. Use your own permitted directory name in production. Inside configuration.php, edit the existing setting if it is present, or add it inside the PHP code before any closing PHP tag:
$customadminpath = 'staff-console-example';The renamed administrator folder must then be staff-console-example within the WHMCS installation root. For an installation at https://billing.example.com/, the corresponding sign-in location is https://billing.example.com/staff-console-example/.
Expected result: the configuration and folder use the same name, and a fresh authorised sign-in works. Update affected callbacks and bookmarks, preserve your recovery access, and keep individual accounts and two-factor authentication in place. The directory rename does not replace authentication.
How should I recover access after changing the administrator directory?
If the new URL fails, compare the configuration value with the real directory name and check ownership and permissions. Restore the recorded working value when necessary. If a network restriction blocks staff, use the authorised server recovery method and correct the intended allowlist.
Do not solve a single access problem by sharing the main administrator password or removing two-factor authentication for everyone. Record the cause and test the corrected account with its intended role.