Stop fraud before it provisions. Automatically verify every customer's real-world identity — across 220+ countries — before a single service or domain goes live.
eKYC Guard turns identity verification into an automatic gate inside WHMCS. No customer gets a server, VPS, cloud service or domain until they pass KYC — so fraud, chargebacks and abuse are blocked at the source. Seven verification providers, built-in AML/sanctions screening, full lifecycle automation, and GDPR-ready compliance — all without leaving your WHMCS admin.
One stolen card. One fake signup. That's all it takes to trigger a chargeback, a phishing site on your IP range, a spam complaint, or a compliance headache. By the time you notice, the service is already provisioned and your team is already firefighting.
Manual review doesn't scale. Asking for documents over email is slow, insecure, and impossible to audit. And "just refund it" still costs you fees, time, and trust.
eKYC Guard makes identity verification a precondition for provisioning. The moment an order is placed, eKYC Guard holds activation until the customer proves who they are. Verified customers are provisioned automatically. Everyone else is stopped before they cost you a cent.
It runs entirely inside WHMCS. No external dashboard to babysit, and no developer required to operate it.
If you sell hosting, VPS, cloud, domains, or SaaS to the public, identity verification isn't a nice-to-have anymore — it's table stakes. eKYC Guard makes it one click to turn on.
Enable any of these, or let customers choose. Switch providers anytime without losing a single record.
sodium extension, for document encryption at restInstalls in minutes: upload, activate, paste your provider keys, done. No core file edits.
Does it slow down my real customers?
No. Legitimate customers verify in about two minutes and are provisioned automatically. You can also scope KYC to only the products that need it.
What if a verification provider goes down?
eKYC Guard is fail-safe — it never freezes your provisioning pipeline over a temporary outage. You stay in control.
Can I use more than one provider?
Yes. Enable as many as you like and let customers choose, or enforce a single flow. Manual document review is always available as a fallback.
Is it GDPR-friendly?
Yes — explicit consent capture, encryption at rest, configurable data retention with auto-purge, and a complete audit log of access and decisions.
Do I need a developer to run it?
No. Everything is managed from the WHMCS admin area.
eKYC Guard — verify with confidence, provision with peace of mind.
Be the first to review eKYC Guard — Identity Verification & Fraud Prevention for WHMCS.
The best place to start if you need help with a specific product is to contact the developer. All WHMCS Marketplace developers have both a website and support URL listed.
Changelog All notable changes to eKYC Guard are documented here.
[1.4.0] — 2026-07-23 Added Didit KYB Support: Added dynamic routing for Know Your Business verifications. If a WHMCS client has a populated companyname and a KYB Workflow ID is configured, they will be seamlessly routed to the Didit KYB flow instead of the standard KYC flow. [1.3.0] — 2026-07-21 Added GDPR Data Purge: Erase all KYC records and encrypted documents for a client when their WHMCS account is deleted (ClientDelete hook). Verification Notification Rate Limiting: Added 1-hour cooldown to sendVerificationEmail with graceful error handling in Admin to prevent spam/abuse. Floating Toast Banner: The client-area warning banner has been overhauled into a sleek, non-intrusive floating toast notification in the bottom-left corner with CSS animations. Support & Operations Guide: Added Support_Guide.md for administrators detailing edge cases and webhook debugging. Packaging Script: Added package.sh build script for clean zip compilation. [1.2.3] — 2026-06-07 Fixed Fatal "Cannot declare class Arahoster\Licensing\License" when a sibling arahoster product (e.g. DNS Manager) is installed on the same WHMCS. The vendored universal license client is now included only when not already declared (class_exists guard), and the license façade re-applies its own product config before each call so two arahoster modules never clash or read each other's license state. [1.2.2] — 2026-06-06 Changed Everything off by default. On a fresh install every feature toggle now defaults OFF — block provisioning, reminders, auto-suspend, auto-provision, show-info, manual upload, consent, document encryption, Didit — and client-area gating defaults to off. Admins opt in to exactly what they want. (Existing installs keep their saved settings.) [1.2.1] — 2026-06-06 Changed Plan entitlements are now enforced. AML screening requires the licensed plan to entitle aml_screening (Gate::shouldRun), not just the settings toggle — plan tiers are real, not decorative. Provisioning gate consolidated through EkycGuard\Gate (single license + verification authority); the verified-resolver wiring is now live in production. Added make dist-protected — value-preserving source obfuscation (strips comments, hex-escapes string literals; no symbol renamed, with a php -l fallback so it can't emit broken PHP). A protected build without the Encoder. make dist-encoded / make package-encoded now auto-detect any installed ionCube Encoder (the strip-proof option). Fixed protect.php resets its lint-output buffer per file. [1.2.0] — 2026-06-06 Changed Licensing migrated to the Arahoster universal client. The module now validates against the single Arahoster endpoint (me.arahoster.com) via the vendored universal client (lib/AraLicense.php) behind the existing EkycGuard\License façade, instead of the WHMCS Licensing Addon flow. The per-request hot-path stays a pure signed-cache read (15-day trust + 5-day offline grace); the client is booted once per request from hooks.php. Plan-based entitlements. Licenses now carry a plan and a feature list; EkycGuard\Gate is the single enforcement authority — Gate::holdProvisioning() gates provisioning on verification, Gate::shouldRun($capability) gates each paid step by plan, and Gate::adminNotice() renders the renewal nag. Admin license panel now shows plan, expiry and entitled features. The previous self-host OWNER_DOMAINS shortcut is retired — arahoster's own installs are licensed by the endpoint like any other. Notes The universal client is vendored into the module from the arahoster-licensing backend repo (see customer-modules/ekyc-guard/INTEGRATION.md there). The licensing backend itself is never shipped to buyers. [1.1.2] — 2026-06-06 Security Defense-in-depth XSS hardening: client-area templates now HTML-escape provider- and user-influenced values (reject_reason, full_name, country, reviewed timestamp, flash messages). WHMCS does not auto-escape addon templates, so a malicious/compromised provider response can no longer inject markup into a customer's verification page. Admin output was already escaped via View::e(). [1.1.1] — 2026-06-06 Added Self-hosted licensing for arahoster-owned domains: installs whose WHMCS System URL host is arahoster.com (or any subdomain, e.g. me.arahoster.com) are now licensed locally without contacting the remote Licensing Addon. This lets arahoster's own WHMCS run with enforcement enabled even before/without the licensing server being wired up. Customer installs are unaffected and still phone home as normal. Owned domains are listed in License::OWNER_DOMAINS. [1.1.0] — 2026-06-05 A large capability + hardening release (full improvement roadmap; see docs/IMPROVEMENTS.md).
Added Providers: Stripe Identity, Sumsub, Onfido, Persona and Shufti Pro (alongside Didit, DigiLocker and manual) — all behind the same abstraction. AML / sanctions + PEP screening (OpenSanctions match API): a hit routes the customer to manual review instead of auto-approving; results shown in admin. Per-product / product-group enforcement scope (all / include / exclude). Periodic re-KYC: verifications expire after reverify_months and re-gate. Auto-provisioning on verify: Pending services/orders held by the gate are created/accepted automatically once the customer passes. Consent capture (GDPR lawful basis) before verification, recorded per record. Data-retention auto-purge of stored documents after retention_days. Document encryption at rest (libsodium) + configurable out-of-webroot path. Document-access audit logging (who viewed which document). Internationalisation: client area fully localised; English, Spanish, French and Arabic (RTL) shipped, with graceful fallback. Editable WHMCS email templates (invite/reminder/approved/rejected). Custom hooks EkycGuardVerified / EkycGuardRejected / EkycGuardManualReview / EkycGuardStatusChanged for other modules. Admin: bulk approve/reject/email, provider "Test connection" buttons, AML + consent surfaced on the review screen. Client UX: mobile camera capture on uploads, auto-refresh while pending. Tooling: composer.json, PHPStan (level 3 + WHMCS stubs), PHP_CodeSniffer (PSR-12), GitHub Actions CI (PHP 7.4–8.3), SQLite integration test suite, make test/ci/phpstan/phpcs/package-encoded. Changed Licensing is now non-blocking on hot paths: provisioning hooks read a cached license decision (refreshed by cron/admin), so a slow licensing server can never stall Create. Webhooks gained replay protection (timestamp freshness) and a no-downgrade guard (a replayed event can't un-verify a customer). Start is now a POST (with consent + CSRF) rather than a state-changing GET. Fixed AML screener posted to the wrong target (a result array instead of the base URL) — caught by PHPStan, now fixed. [1.0.0] — 2026-06-05 Initial release.
Identity verification Provisioning gate (PreModuleCreate) and domain registration/transfer gate with all / whitelist / blacklist TLD rules. Providers: Didit (global, HMAC-signed webhook + polling fallback), DigiLocker (India, OAuth 2.0 + PKCE), and manual document upload with admin review. Client area: status page, provider chooser, document upload, nav badge and a cross-theme "verify now" banner. Admin area: dashboard with stats/filters, per-customer review screen (approve / reject / upload-on-behalf), activity log, and integration endpoints. Automation: verification-invite email, first/second reminders, and grace-period auto-suspend → terminate → account-disable (auto-reversed on a successful verification). Security: HMAC webhook verification, OAuth state/PKCE, CSRF tokens, private document storage streamed only to authenticated admins, upload MIME/size checks.
New verification providers: - Stripe Identity, Sumsub, Onfido, Persona and Shufti Pro (in addition to Didit, DigiLocker and manual review).
New capabilities: - AML / sanctions / PEP screening - a potential match is sent to manual review instead of being auto-approved. - Require KYC only for specific products or product groups. - Periodic re-verification (re-KYC) after a chosen number of months. - Automatic provisioning of pending services and orders once a customer is verified. - GDPR consent capture before verification starts. - Document encryption at rest, plus automatic document retention/cleanup. - Document-access audit logging. - Multi-language client area: English, Spanish, French and Arabic. - Editable WHMCS email templates (invitation, reminders, approved, rejected). - Mobile camera capture when uploading documents.
Admin improvements: - Bulk approve / reject / email actions on the dashboard. - "Test connection" buttons for each verification provider. - AML result and consent shown on the customer review screen.
Security: - Stronger webhook validation and replay protection.
==============================================================================
Easily generate and change passwords for your clients without the need to send an email
Give your customers the power to unblock themselves from the CSF Firewall! Lessen your staff support ticket load
