Secure Writeable Directories

We recommend moving all writeable directories to a private location to prevent web-based access. When you move them, you must also update their locations in your installation’s file storage and the templates cache.

We recommend performing this task and other security measures immediately after installing WHMCS. For a full list, see Enhancing Security.
For more information on setting up storage locations, see Storage Settings.

Writeable Directories

WHMCS requires three writeable directories:

  • attachments
  • downloads
  • templates_c

The attachments and downloads directories include the files that you or your customers attach to support tickets and any files that you offer for download. You can either move the attachments and downloads storage directories to a local location or store them remotely on an Amazon S3™-compatible service.

The templates cache (templates_c) improves the performance of templated pages and emails. You can move the templates_c directory to a local location.

If you are running suPHP or PHP suEXEC, run chmod 755 to make the directories writeable. This is the highest permission available for both folders and files when running in that condition.

Moving Directories in cPanel

The method to use to move the directories depends on your hosting control panel and the methods that you prefer.

For help moving files in other control panels, see the control panel’s documentation or contact your hosting provider or system administrator.

To do this:

1. Move each directory.

In the WHMCS installation directory, move the attachments, downloads, and templates_c directories to the desired locations.

To do this in cPanel:

  1. In your cPanel account, go to Files » File Manager.
    The File Manager interface in cPanel.
  2. Go to your WHMCS installation directory.
  3. For each of the three folders:
    1. Right-click on the folder and choose Move.
      Move folder in the File Manager interface.
    2. Enter the new path for the directory. This path must be above the public_html directory.
      Enter a new path in the File Manager interface.
    3. Click Move File(s). As you move each folder, they will appear in the left-side navigation pane.
Make certain that you note the new directory paths. You will need them in later steps.

2. Edit your configuration.php file.

Update the $templates_compiledir setting in your configuration.php file to use the new templates_c directory path:

$templates_compiledir = "/home/username/templates_c/";
For more information about updating the configuration.php file, see The configuration.php File.

To do this in cPanel:

  1. In your cPanel account, go to Files » File Manager.
  2. Go to your WHMCS installation directory.
  3. Right-click on the configuration.php file and choose Edit.
  4. Update the $templates_compiledir setting to use the new path to the templates_c directory.
  5. Click Save Changes.

3. Go to your storage settings in WHMCS.

In the WHMCS Admin Area, go to Configuration () > System Settings > Storage Settings.

Storage Settings

4. Add the new attachments location.

In the Configurations tab, select Local Storage for Add New Configuration and click +.

The Configurations tab in Storage Settings

Enter the new path to the attachments directory and click Save Changes.

Adding a new local storage path in Storage Settings

5. Add the new downloads location.

In the Configurations tab, select Local Storage for Add New Configuration and click +.

Enter the new path to the downloads directory and click Save Changes.

6. Update your storage settings.

In the Settings tab, choose the new directory locations in each menu.

Selecting a new location in Storage Settings

Then, click Switch.

Only click Switch if you have successfully moved the directories. If you created new directories instead, use Migrate instead to copy the files from the old directory to the new directory.
security attachments downloads storage

Last modified: 2025 March 19