Keeping your account and your licences secure

Two things are worth protecting here: the account itself, and the licence keys inside it. The second one is specific to a shop that sells software, and it is the part people do not think about.

1. The account

A long, unique password. Length beats cleverness. Anything reused from another site is already public.
Protect the registered email. Whoever controls it can reset this password. It deserves its own strong password and two-factor authentication.
We will never ask for your password. Not in a ticket, not by email, not ever. Anyone who does is not us.
Keep your contact details current, because they are what we use to confirm who you are if you lose access.

2. Your licence keys

A licence key in someone else's hands is worth very little. It binds to one installation — its domain, the directory WHMCS runs from, and your WHMCS licence — and the same key on a second installation is refused. A key that is already in use is not worth stealing.

The exception is a key that has never been used: a licence you just bought, or one you just released to move servers, binds to whoever validates it first. That window is the only moment a stray key matters, which is why the next section exists.

3. The email that matters

You get an email the moment a licence of yours binds to an installation, naming the domain and the path. If one arrives and it was not you, go to Services → your service → Move Installation and release it: the other installation stops working at its next check. Then open a ticket.

That notice is the fastest protection you have. Please do not filter it away.

4. Do not go looking with keys that are not yours

Every licence check is recorded — the key, the installation and the address it came from. An installation that submits keys it was not issued is warned, and then stops being answered at all, and the event is kept against the account.

Under our Terms of Service that is a breach, and a licence terminated for it is not refundable and not open to negotiation. If you have a key and are not sure it is yours, ask before you try it.

5. Practical habits

Paste a licence key into the module's settings, not into a support ticket, a chat or a screenshot.
Before releasing a licence, be ready to install on the new server: releasing stops the current one.
Check your invoice history now and then. It is a short list, so anything unfamiliar stands out.
If you suspect anything at all, change the password first and open a ticket second.