File Change Monitoring for WHMCS

Back up your WHMCS files and database before installing or updating.

• Upload the package into the WHMCS root, keeping the includes/ and modules/ directory structure.
• Activate File Monitor under System Settings > Addon Modules, then allow access for the required administrator roles.
• Open Addons > File Monitor and activate your licence or available trial.
• Configure monitoring and add the background scanning command shown in Settings to your hosting account's cron jobs.

When updating, replace the files without deactivating the addon or removing its tables. Existing settings and approved file fingerprints are preserved. Older MD5/SHA-1 baselines are verified before migration to SHA-256.

File Monitor 2 requires PHP 7.3 or newer and WHMCS 7 or newer. Use a PHP version supported by your WHMCS installation. The package supports PHP 7.3, 7.4 and 8.1–8.4. PHP 7.3/7.4 need ionCube Loader 10.4 or newer; PHP 8.1–8.4 need Loader 15 or newer. cURL, Zip, JSON and mbstring must be available. PHP CLI also needs the extensions and Loader required by your WHMCS installation.

Administrators need access to the addon and the Configure Addon Modules role permission to install automatic updates. Update banners are only shown to administrators who meet both requirements.

If an existing cron already runs modules/addons/file_monitor/cron.php, keep that job: uploading the new package replaces the script it runs. Do not add a duplicate job. Check its PHP command and consider running it every five minutes so large scans can resume promptly; the scan interval is configured separately in File Monitor.

Copy the command from File Monitor > Settings into your hosting account's cron jobs. Running it every five minutes is recommended; the command continues unfinished scans and processes queued reviews.

Time between scans controls the wait after a full scan completes before a new full scan starts. It does not need to match how often the cron command runs. Large scans resume in bounded batches, with overlap protection to avoid duplicate scans. Queue scan starts a scan through the worker and is unavailable while one is already running.

On a new installation, the first successful full scan quietly records existing files as the baseline. Existing files do not generate New File alerts or need individual approval. Suspicious-code findings are separate: they can still appear for review and generate notifications. A scan with inspection errors does not finalise the initial baseline. Updating an existing installation preserves its baseline and pending items.

A warning appears if the cron has not run in 24 hours. If scanning stops, check that the cron command works, uses the correct PHP CLI environment and can read the monitored files. On cPanel the suggested account-default PHP wrapper avoids pinning the command to one ea-php version. Other hosting systems may need a specific PHP CLI path.

Changes shows new, modified and deleted files. Search by path, filter by status or change type, and click column headings to change the order.

View shows the approved and detected fingerprints. Select the changes you recognise and accept them together. Accept all matching changes queues the current filtered set for background verification, which is useful after an authorised WHMCS or addon update. A file that changes again is not approved using an earlier observation.

File Monitor does not edit, remove, quarantine or restore website files. Accepting an ordinary change establishes a baseline for that file; it does not acknowledge suspicious-code findings.

Status meanings:

• Pending: waiting for review.
• Accepted: approved for the exact observed file contents.
• Returned to baseline: the file matches its approved contents again, or an unapproved new file disappeared.
• Superseded: a newer observation replaced this item.

The monitored-file count includes libraries, addons, images and other assets under the WHMCS root. It is not just the number of PHP files.

Suspicious Code highlights potentially dangerous code patterns for investigation. Examples include decoded code execution, request-controlled execution and PHP in image or upload locations. Higher-concern findings appear first; column headings let you change the order. View shows the matched reason and line reference when available.

Detection is Beta. Legitimate libraries can match these patterns, and a finding is not proof that a file has been hacked. Review the code, its source and any recent authorised update before accepting a finding. No pattern-based detector guarantees that every malicious file will be found.

Accepting a finding acknowledges the matched rules for that exact file fingerprint. If the file changes later it is inspected again. Ordinary change approval does not acknowledge suspicious findings.

Protected/ionCube source cannot be inspected internally, but its fingerprint is still monitored. Content inspection is limited by the per-file setting and available PHP memory. Larger files remain fingerprinted even when their contents cannot be inspected. Returned to baseline for a finding means the flagged pattern was no longer observed during a successful inspection.

Eligible changes and suspicious findings are grouped into administrator notification emails with a link to File Monitor.

Choose the maximum reminders per item and the time between reminders. Once the reminder limit is reached, repeat alerts stop. Items remain pending unless automatic acceptance is enabled. Automatic acceptance applies only to eligible ordinary changes; suspicious findings still need review.

Pause notifications on Overview pauses email and SMS alerts for one hour while scanning continues. Resume notifications ends the pause early. This is useful while carrying out an authorised update.

File Monitor uses the site's configured WHMCS email delivery settings. If an alert does not arrive, check the WHMCS email log, email configuration and spam folder.

File Monitor can send grouped alerts through The SMS Addon when it is installed, has an active licence and its queue is available. SMS alerts are optional and disabled by default.

• Open File Monitor > Settings > Notifications.
• Enable Send SMS alerts.
• Choose suspicious findings only, or all changes and findings.
• Select the administrators to notify and save settings.

Configure administrator mobile numbers in The SMS Addon first. Administrators without a configured number cannot be selected; hover over the name for the reason.

Alerts use The SMS Addon's routing and signature and bypass Safe Times. They are grouped and follow File Monitor's reminder controls and notification pause. A queued message is not confirmation of delivery: check The SMS Addon's message log for provider status. Email continues independently.

When The SMS Addon is unavailable, the settings page shows a link to its product page. File Monitor's email notifications and scanning continue to work without it.

Path rules are optional. Enter one path or wildcard per line, relative to the WHMCS root.

• Monitor silently: keep recording ordinary changes without notification reminders. Suspicious findings can still generate alerts.
• Exclude from scanning: do not inspect or fingerprint the matching paths. Only exclude paths you understand and do not need to monitor.

Skip hidden files also skips files such as .htaccess and .user.ini. Skip error_log files affects files named exactly error_log. Symbolic-link targets are not followed and are recorded as inspection errors.

Scan History shows completion status, file counts, ordinary changes, errors and processing time. A partial scan does not infer that unvisited files have been deleted. View a scan for further details.

History retention removes older resolved history. Pending items are retained for review. Back up the database as part of normal WHMCS maintenance. Deactivating File Monitor preserves its data.