Email Login 2FA for WHMCS

Add an email verification step to WHMCS client-area logins. After WHMCS accepts a user's password, the module sends a single-use six-digit verification code to the exact WHMCS user who is signing in.

This is especially useful for client accounts with multiple associated users because each verification code is delivered to the correct user's own email address.

Key Features

• Six-digit, single-use email verification codes
• Verification after successful WHMCS password validation
• Code delivery to the exact WHMCS client user signing in
• Configurable code lifetime from 2 to 30 minutes
• Protection against repeated failed OTP attempts
• Default 10-minute block after five consecutive failed attempts
• Failed-attempt protection continues across new codes, sessions and IP addresses
• Configurable resend cooldown
• Optional “Trust this browser” feature
• Trusted-browser checkbox is disabled by default
• Fixed trusted-browser lifetime from 1 to 90 days
• Client self-service browser review and revocation
• Administrator browser and user-policy management
• Optional browser revocation after password or email changes
• Per-user security event history
• WHMCS-branded HTML and plain-text verification emails
• WHMCS mail-provider support with optional Direct SMTP
• Login time, validated IP address and browser/OS details in emails
• Optional MaxMind country information
• Configurable security-log retention
• Plaintext OTPs and persistent trusted-token validators are not stored

Trusted Browser Protection

A browser is remembered only when the user explicitly selects “Trust this browser.” A correct verification code completes the login even when this option is not selected, but no trusted-browser record or cookie is created.

Clients and authorized administrators can review and revoke trusted browsers at any time.

Price and Licensing

The price is USD 20 per year for one production WHMCS installation.

An active annual license includes product downloads, updates and technical support. Moving the installation to another domain, server IP address or addon directory requires a license reissue.

Requirements

• WHMCS 9.0.5
• PHP 8.2 or PHP 8.3
• ionCube Loader 15.0.0 or later
• PHP cURL and mbstring extensions
• HTTPS enabled on all client authentication pages
• MariaDB or MySQL with InnoDB
• A working WHMCS mail provider or authenticated SMTP relay
• Outbound HTTPS access to the PEEK Hosting licensing endpoint
• Optional MaxMind credentials when country lookup is enabled

Important Scope Information

This version protects WHMCS client users only. It does not protect WHMCS administrator logins.

Email verification proves access to the user's email mailbox. It is not phishing-resistant and cannot protect an account if the associated mailbox is also compromised.

Installation and Support

Complete installation, upgrade, configuration and rollback instructions are included in the README.md file supplied with the module.

Technical support is provided directly by PEEK Hosting.