WHBMP

Security tools

Oct 15, 2026

Google Authenticator 2FA

Install Google Authenticator 2FA. Clients and staff can then protect their account with a time-based code from Google Authenticator, Authy or any TOTP app. In their account they scan a QR code, enter the first code to confirm and keep their recovery details safe. On every sign-in WHBMP asks for the code after the password. The same second step also covers the mobile app. You can require it for clients, so they must set it up before they continue.

CAPTCHA

Install one of Google reCAPTCHA (v2/v3), hCaptcha or Cloudflare Turnstile.

  1. Create a site in the provider's dashboard and copy the Site Key and Secret Key.
  2. Open Settings > General Settings > Security, choose the CAPTCHA provider and paste the keys.

It then protects checkout, support tickets, and the client sign-in and password reset pages. Step-by-step setup for Turnstile: Cloudflare Turnstile. Saving the keys is not enough: the provider must show Active. The admin sign-in is never protected by a CAPTCHA, so a wrong key can never lock you out.

Fraud screening

Install IPQualityScore (proxy, VPN and abuse detection) or MaxMind minFraud (order-level scoring).

  1. Open Settings > Fraud Protection.
  2. Enter the provider's credentials (IPQualityScore: API key; MaxMind: Account ID and License Key).
  3. Enable it and set the threshold.

New orders are scored. A risky order is held for staff, with the score and reason shown on the order, so you can accept or cancel it. See Managing orders.

Client IP Unblock

Client IP Unblock lets a client remove their own IP address from the block list of CSF, Imunify360 or cPHulk on the server of their active service, without opening a ticket. On the server's record (Settings > Servers) enter the SSH access and tick which firewall tools clients may unblock themselves from. Clients then see an unblock panel on their service page, and every result shown is exactly what the real command returned.

More protection

See Security for passwords, login bans, email-code sign-in and the admin path.

Powered by WHBMP