WHMCS Cloudflare Security Suite – Marketplace Overview

Elevator Pitch

Deploy Cloudflare Turnstile across every WHMCS touchpoint and back it with a layered fraud-engine. This addon injects invisible bot-defense, risk scoring, automated actions, and log visibility—all without hacking template files. Protect logins, checkout flows, support channels, and domain tools while giving staff one dashboard to review threats, rules, and trusted lists.

100% Fake Order Protection.

Key Features

1. Cloudflare Turnstile Everywhere

• One toggle per WHMCS form (registration, login, ticket submit, contact, order, add funds, domain search, custom forms, etc.).
• Supports managed or invisible Turnstile modes plus light/dark/auto theme.
• Works behind Cloudflare proxy/CDNs and reverse proxies; no captcha keys exposed client-side.
• Blocks bot browsers (headless Chrome, Selenium, Puppeteer) and auto-submit scripts before they hit checkout.
• Turnstile container renders directly before the submit button and auto-disables it until a valid token is issued.

2. Advanced Fraud Prevention

• Intelligent risk scoring based on IP reputation (VPN/proxy/Tor), billing/IP country mismatch, disposable email detection, repeated failed orders, shared IP accounts, user agent anomalies, order velocity, cart speed, and payment gateway failures.
• Velocity tracking monitors rapid-fire orders, unpaid invoices, brute-force login attempts, and cart spam (bulk domain lookups, mass add-to-cart).
• Bot detection rules auto-flag instant checkouts, large domain batches, and suspicious device fingerprints.

3. Rules Engine & List Controls

• Admin-defined rules with min/max order amounts, trusted countries/TLDs, blocklists for IP/ASN/Country/email domains, and custom JSON conditions.
• Disposable email filter with 5k+ known providers (Mailinator, TempMail, GuerrillaMail, etc.).
• Payment gateway intelligence: hold, auto-approve, or reject based on gateway scoring/failures.
• Integrated whitelist/blacklist management for IPs, emails, domains, user agents, proxies, and countries; includes a “Trusted Countries” quick-add interface.

4. Automatic Actions

• Auto-block high-risk orders: cancel, mark fraud, close account, blacklist IP/subnet, stop future orders, notify admins.
• Auto-review medium-risk orders with email alerts, status updates (“Pending Review”), and dashboard warnings.
• Auto-approve low-risk orders for instant provisioning with no human intervention.

5. Admin Dashboard & Logs

• Fraud analytics widgets show blocked/reviewed/approved counts, Turnstile failures, blacklist/whitelist entries, and last refresh timestamp.
• Recent risk logs with event type, IP, score, risk badge, and one-click delete.
• Velocity alert table for fingerprints/metrics breaching thresholds.
• Rule management tab with prettified JSON, inline editing (monospace editor), and tabbed navigation that preserves your context.
• Full logging of form submissions, Turnstile pass/fail events, fraud actions, and order recommendations.

6. Security Enhancements for WHMCS

• Anti-bruteforce: throttles repeated logins, API login attempts, failed 2FA attacks.
• Anti-spam: protects tickets, contact, presales/quote forms, and custom forms via Turnstile + behavioral rules.
• CSRF-protected admin actions, deletion controls per log entry, and cron cleanup of stale velocity fingerprints.

Quick Start

1. Upload modules/addons/cloudflaresecurity and activate the addon in WHMCS Admin → Setup → Addon Modules.
2. Provide your Cloudflare Turnstile Site & Secret keys, choose widget mode/theme, and enable the forms you want protected (default: all on).
3. Review/adjust default fraud thresholds (risk score levels, velocity caps, disposable email behavior).
4. Visit Addons → Cloudflare Security Suite to monitor metrics, edit rules, and manage whitelist/blacklist entries.

Compatibility & Requirements

• WHMCS 8.x+ (tested on Six and Twenty-One themes).
• PHP 7.4+ with cURL extension.
• Cloudflare Turnstile account (free) to obtain site & secret keys.
• Works alongside Cloudflare proxy/CDN, reverse proxies, load balancers, and standalone servers.

Why Choose This Addon?

• No template hacking: Turnstile is injected dynamically into WHMCS core forms via hooks.
• Automation first: risk scoring + rules drive automatic block/review/approve flows with logging.
• Admin-friendly: tabbed UI, inline rule editing, and list management make tuning easy.
• Future-proof: form selectors target both legacy cart URLs and the modern index.php?rp= routes.
• Security focused: native CSRF handling, disabling submits until Turnstile fires, and comprehensive logging keep auditors happy.

Protect every customer touchpoint, stop fraud before provisioning, and give your team the insights they need—all powered by Cloudflare’s latest Turnstile technology. Ready to harden WHMCS? Install the Cloudflare Security Suite today.

Contact & Support

1. Email: sales@hostkloud.com
2. Whatsapp: → “+8801672348154”
3. Docs: README.md inside the module for install steps & FAQs
4. Emergency assistance: Ping us via the WHMCS marketplace message center