Password Safe Documentation

Back up your WHMCS files and database before installing or upgrading.

• Upload the download into your WHMCS root, preserving the directory structure. This includes passwordexpired.php, modules/addons/passwordsafe and includes/whmcsnowcore.php.
• Activate Password Safe under System Settings > Addon Modules and allow access to the required administrator roles.
• Open Addons > Password Safe and activate your licence or available trial.
• Configure client-user and administrator policies separately, then enable the policies you need.

For an upgrade, replace the existing files without deleting the addon or its database tables. Existing settings and usable password history are preserved. Version 2 supports WHMCS 8 login users, including users associated with more than one client account. Use a PHP version supported by your WHMCS installation and the compatible ionCube Loader.

Client-user and administrator policies have separate enable switches, maximum password ages and history periods. Maximum password age is measured in days. Password history prevents reuse during the chosen number of days; set history to 0 to disable it.

Complexity options are:

• Disabled: no additional complexity requirement.
• Basic: at least 4 characters, including a letter and a number.
• Moderate: at least 6 characters, including uppercase and lowercase letters, and a number or symbol.
• Advanced: at least 8 characters, including uppercase and lowercase letters, a number and a symbol.

These are the addon's requirements; use a suitable policy for your organisation. WHMCS may apply its own requirements as well. Newly tracked users receive a starting age when first recorded; installing the addon does not establish the unknown date of an earlier password change.

When a password expires, the user is asked to update it before continuing. The form requires the current password, a new password and confirmation. Recent passwords cannot be reused while retained in history. Users may need to sign in again after a successful change.

The client page uses your WHMCS client-area template and the heading Update your password, without Password Safe branding. The client template is modules/addons/passwordsafe/templates/password.tpl.

Change after password reset optionally requires a further change after a client-user password reset. Normal WHMCS logout and password-recovery routes remain available. Native WHMCS password changes are checked after saving; a password that does not meet the addon policy can require correction on the next protected page.

WHMCS's normal daily automation removes password history older than the configured retention period. No separate Password Safe cron is needed. The addon stores password hashes, not plaintext passwords.

If a policy needs adjusting, an authorised administrator can open the addon settings and change or disable that policy. Administrator access to the policy settings remains available during expiry. Deactivating the addon preserves its settings and history.

If the client form is missing after installation, check that passwordexpired.php was uploaded to the WHMCS root and that the module's templates and assets were uploaded with their original directory structure.