WHMCS 9.0.5 and 8.13.4: Billing Portal Security Update Checklist

admin

3 hours ago

WHMCS 9.0.5 and 8.13.4 maintenance update checklist for hosting billing portals

WHMCS 9.0.5 and WHMCS 8.13.4 are maintenance releases for the 9.0 and 8.13 release series. WHMCS says these updates include maintenance and security updates, and the 9.0 and 8.13 changelogs both list multiple undisclosed security fixes.

If WHMCS handles billing, client logins, invoices, support tickets, domains, SSL, hosting provisioning, or module automation for your business, treat this as a controlled production maintenance update. A WHMCS portal is not just a website. It is often the front door for customers, payments, support, and service automation.

Who Should Update

WHMCS 9.0 installations should update to WHMCS 9.0.5.
WHMCS 8.13 installations should update to WHMCS 8.13.4.
Older self-hosted WHMCS branches should be reviewed against WHMCS release support and upgrade requirements.
WHMCS Cloud users should confirm the hosted update status, because WHMCS documents cloud updates separately from self-hosted updates.

What WHMCS Says

WHMCS states that 9.0.5 and 8.13.4 include important maintenance and security updates for reliability, stability, and protection. WHMCS also says it is limiting the technical detail shared about the security-related changes in these releases.

The changelogs for both supported tracks include security fixes in maintenance and module areas. The public action path is straightforward: update to the correct release for your branch, preserve a full backup first, and verify the business workflows that depend on WHMCS.

Before You Update

Back up the WHMCS files and the WHMCS database as a matched set.
Verify the backup can be restored before changing production.
Record the current WHMCS version, PHP version, ionCube Loader status, cron path, admin URL, template name, and active modules.
List custom hooks, addon modules, payment gateways, registrar modules, provisioning modules, notification providers, and third-party integrations.
Check custom client-area and admin-area template overrides.
Schedule the change outside invoice generation, renewal, support, or payment peak periods.

Update Options

For self-hosted WHMCS, the normal update path is the Automatic Updater in the WHMCS admin area under Utilities > Update WHMCS. WHMCS also provides full release packages and incremental patch sets on its download page. Use incremental patch sets only when your current version matches the compatible version listed by WHMCS.

Safe Maintenance Path

Put the change on the calendar and notify internal support, billing, and hosting operations staff.
Back up WHMCS files and database.
Test the update on staging first if the portal has custom modules, templates, payment flows, registrar automation, or provisioning hooks.
Run the Automatic Updater or apply the official package for the exact branch you run.
Keep the database and file restore plan together. Do not roll back only files after a database-changing update.
Document the old version, new version, update time, operator, and verification results.

Post-Update Verification

Admin login works and the WHMCS version reports 9.0.5 or 8.13.4.
Client login, password reset, and account profile pages work.
Cart, checkout, order form, invoice view, tax, credit balance, and payment gateway paths work in live-safe or sandbox mode.
Support ticket open, reply, email piping, and department routing work.
Domain lookup, registrar sync, renewals, and DNS/contact workflows work for the modules you use.
Provisioning modules can create, suspend, unsuspend, and terminate test services in a controlled account.
WHMCS cron runs cleanly and expected automation tasks continue.
Activity logs, module logs, gateway logs, and system health checks do not show new repeated errors.
Staff permissions, reports, API integrations, and webhooks still match your intended access model.

Hosting Provider Notes

For cPanel, Plesk, DirectAdmin, aaPanel, or custom hosting stacks, verify the WHMCS module layer after the update. The billing portal may look healthy while provisioning, package sync, disk-usage reporting, domain automation, or support workflows are broken in the background.

Providers using WHMCS with cPanel/WHM should also verify API tokens, package names, feature lists, reseller privileges, mailbox or disk/inode reporting tools, and any custom support automation that reads hosting-account state.

Rollback Plan

If the update fails, restore the WHMCS files and database together from the same recovery point. If only a module fails, disable or roll back that module using the vendor-supported path, preserve logs, and avoid making broad production changes from a half-updated billing portal.

FixItPhill Recommendation

Install WHMCS 9.0.5 or 8.13.4 on the correct release track as soon as your backup and test plan are ready. Because WHMCS intentionally limits public security detail for these fixes, the safer admin stance is to patch and verify rather than wait for more technical detail.