WHMCS addon module · evps_abuse_center · v2.0.4 “Full Spectrum”
EVPS Abuse & Feedback Center
Stop running your abuse desk out of a shared inbox. Every complaint, bug report, feature request and piece of customer feedback lands in one queue inside WHMCS, arrives with tamper-evident evidence already attached, and reaches an action only after a policy and a human have both agreed. Nothing is terminated automatically. Ever.
- One desk, four streams. Abuse, feedback, feature requests and bug reports share one case model, one audit trail and one SLA clock.
- Evidence first. Every case carries a write-once, hash-chained evidence vault that can be verified on demand.
- Approval-gated actions. Suspend, null-route, snapshot, block, notify and escalate are recommended by policy and executed only when a human approves.
- Termination is never automated. The suite has no termination code path at all — it opens a high-priority review ticket instead.
- Closes the loop with customers. Public roadmap with voting, a “What’s new” changelog, satisfaction capture and a no-login status page for anonymous reporters.
Add to cart — from $24.95 / month
The problem this removes
Most hosting providers handle abuse the same way: a mailbox called abuse@, a couple of forwarding rules, and an engineer who reads it when there is time. That arrangement fails in five specific ways, and this module was built against all five.
- No evidence when you need it. Six months later, when a registrar, an upstream or a lawyer asks what you knew and when, the inbox thread has been edited, forwarded and partially deleted. There is nothing you can hand over and defend.
- No consistency. Two engineers meet the same phishing report and take two different actions. Nothing records why either was right.
- No brake. The moment a provider automates suspensions off raw complaint volume, one malicious reporter can take a paying customer offline.
- No customer channel. An anonymous reporter has no way to check what happened, so they escalate to your upstream instead of waiting.
- Feedback goes nowhere. Bug reports and feature requests are filed in the same inbox, then lost. Customers stop telling you things.
The Abuse & Feedback Center replaces that with a case pipeline: intake → evidence → confidence score → policy recommendation → human approval → audited action → a customer-visible outcome.
Who it is for
- VPS, dedicated and cloud providers who receive network-abuse complaints and need a defensible record of what they did about each one.
- Shared and reseller hosts handling DMCA notices, phishing takedowns and outbound-spam reports on customer accounts.
- Any WHMCS operator who wants a structured feedback loop — public roadmap, voting, changelog and satisfaction scores — without bolting on a third-party SaaS.
- Teams with a compliance obligation who need retention horizons, legal holds, GDPR erasure and DMCA counter-notice records tracked inside the billing system rather than in a spreadsheet.
It is not a firewall, an IDS or a mail filter. It does not detect abuse; it manages what happens after abuse is reported to you.
Four intake streams, one case model
Every submission becomes a case with a typed reference, a category, a severity, a status and an audit trail. The four streams share the pipeline but not the vocabulary — each has its own category list, its own guided template and its own response policy.
| Stream | Reference prefix | Categories | Typical use |
|---|
| Abuse | AB- | 12 | Outbound spam, phishing, malware, botnet C2, network attack, resource abuse, copyright/DMCA, illegal content, CSAM (restricted handling), fraudulent signup, open relay/proxy, other |
| Feedback | FB- | 8 | General, praise, complaint, user experience, documentation, support experience, pricing, other |
| Feature request | FR- | 7 | Control panel, billing, hosting, network, security, integrations, other |
| Bug report | BG- | 9 | Client area, admin area, provisioning, billing, email, DNS, performance, security vulnerability (restricted), other |
Public intake — no login required
A self-contained public form (report.php) accepts all four streams from anyone, with no WHMCS account and no session. It renders its own minimal, accessible HTML — no theme chrome and no external assets, other than the Cloudflare Turnstile widget when you have configured one. Abuse-only target fields (domain, IP, URL) appear only for the abuse stream, and the form works without JavaScript.
Before anything is written, a submission passes an ordered gauntlet: master switch and public-intake switch, an empty-honeypot check, Turnstile verification when configured, a reporter-reputation block, category and length validation, then the authorization gate’s per-IP rate limits (5 per hour, 20 per day). A submission that fails the honeypot or comes from a blocked reporter receives the ordinary success page and is silently dropped — the module never tells an abuser which control caught them.
No-oracle status lookup
Anonymous reporters get a companion page (status.php) where they enter their case reference and the email they submitted with. On an exact match it returns a tightly sanitised public view and a reporter-visible timeline. On a wrong reference, a wrong email, or a reference that never existed it returns the identical neutral “no matching report” message. The page cannot be used to discover whether a case, a domain or an email address exists, it never shows the target, and lookups are rate limited per IP.
What your team gets
The admin surface is a twelve-tab command centre grouped into Operate, Investigate, Feedback and System. Every tab has an explicit permission key, and every tab renders inside its own error boundary so one failing panel can never blank the module.
Operate
- Dashboard — case load, SLA health (open / due soon / breached), mean time to resolve, time to first response, SLA breach rate, a satisfaction tile, daily volume and category charts, and stream mix. All computed from the module’s own tables over a read-through cache.
- Cases — a split-view triage cockpit: filterable case rail on the left, full detail on the right with no page reload. Keyboard navigation (
j/k + Enter), a . command menu, a ? shortcut sheet, a next-best-action rail driven by the policy engine, inline quick-assign, bulk set-status / set-severity / assign, canned-reply macros, suggested duplicate merges, appeals handling and CSV export.
- Task Queue — a console with pending / running / failed / depth / oldest-waiting KPIs, a depth sparkline, per-row next-run countdowns, retry and cancel, “retry all failed”, and an opt-in ten-second auto-refresh that pauses when the tab is hidden.
- Audit Log — append-only trail of every authorized and denied action, with a filter bar and CSV / JSON export.
Investigate
- Evidence — a global browser over the write-once vault, with per-case chain verification and legal-hold toggles. Read-only: content is always escaped and truncated, and attachments flagged by the upload scan are shown in a separate quarantine review panel that never renders a thumbnail.
- Policies — one editable response policy per stream and category: severity, SLA windows, recommended actions, the confidence and severity thresholds for automation, and an explicit per-policy allow-auto-suspend switch. Import and export as JSON.
Feedback
- Roadmap — items grouped into status columns, promoted directly from a case, re-statused, edited, pushed to an external tracker, with a top-voted leaderboard. Items linked to a security-vulnerability report are forced private and can never appear publicly.
- What’s new — the authoring surface for the customer-visible changelog. Entries are drafted, tagged (added / improved / fixed), optionally linked to the roadmap item they shipped, then published.
System
- Integrations — one card per adapter showing its cached capability status, a write-only credential form and a Test button that re-probes. Stored secrets are never echoed back; a field shows only “configured” or “not set”. Includes the outbound webhook endpoints, their delivery log and per-delivery redelivery.
- Diagnostics — health checks as status cards (PHP version, required extensions, all 32 schema tables, migration status, version sync, flag sanity, secret-vault round-trip, queue depth, stuck and failed tasks, cron activity, adapter summary, log writability), an on-demand self-test, an API call-log telemetry panel, and the module’s only destructive schema path behind a typed double confirmation.
- Settings — the module settings mirror plus the Emergency Controls panel.
- Documentation — a self-contained operator guide inside the admin area.
The decision engine
Between intake and action sit three components that exist to stop your team from acting on a rumour.
Confidence scoring
Every case gets a 0–100 score assembled from named, inspectable factors: a base weight for the source (an admin-filed report starts far above an anonymous web form), reporter reputation, corroboration from distinct reporters, an AbuseIPDB confidence score when that integration is configured, a fraud-suite risk score when a compatible suite is installed, and whether the named target actually resolves to a service you host — naming a target that is not yours reduces the score.
Response policies
One policy per stream and category defines severity, SLA windows and recommended actions. A policy can only act automatically when all of the following hold: the policy is enabled, it has a non-empty automatic-action list, the case confidence clears the policy threshold, the case severity clears the policy threshold, the module-wide Automated Actions setting is on, and the auto-actions kill switch is not engaged. On a fresh install the automatic lists are empty and the module-wide setting is off, so day one is fully manual by construction.
Action orchestrator
Actions move through recommended → approved → queued → running → succeeded or failed, plus declined, cancelled and rolled back. Sixteen action types ship, each declaring whether it is reversible and whether it is destructive:
- Open ticket / reply on the linked ticket
- Notify client / notify reporter
- Suspend service / unsuspend service
- Request termination (opens a review ticket — never terminates)
- Snapshot VM (Proxmox)
- Null-route IP / remove null-route (Proxmox cluster firewall)
- Cloudflare block IP / challenge IP / remove rule
- AbuseIPDB reputation check / report IP
- Escalate to admins
Suspension executes only when the policy still allows it, the thresholds still hold and the kill switches are still clear — all re-checked at execution time, not just at approval time. Destructive actions require an explicit confirmation. Reversible actions record the external reference they created, so one click undoes them.
Termination is never automated, under any configuration. The termination action opens a high-priority ticket for a human to act on inside WHMCS itself. There is no code path in this module that calls a terminate API.
What your customers get
Six client-area pages, rendered inside your active WHMCS theme and reachable from a “Feedback & Reports” sidebar entry.
- Overview — open, in-progress and resolved counts, roadmap votes cast, items needing their reply, recent cases, and a “Notices about your services” panel for anything you have raised against their account.
- Submit a report — a three-step wizard (type, details, review) covering all four streams, with a category picker, a guided description template per category, a character counter and inline validation.
- Case detail — a lifecycle stepper, a plain-English “what happens next” line, the reporter-visible timeline, replies, evidence attachments they uploaded themselves, and a structured appeal form on notices raised against their services.
- Roadmap — public items in Under review / Planned / In progress / Beta / Shipped columns, with one-click voting, sorting and stream filters.
- Roadmap item — detail view with moderated comments and a follow button, so voters hear when the item ships.
- What’s new — the published changelog, tagged and optionally linked back to the roadmap item it delivered.
Client-facing language is deliberately softer than the internal vocabulary: a rejected case reads “Not upheld”, a duplicate reads “Merged”. Confidence scores, internal notes and analyst-uploaded evidence never leave the admin side. The client strings ship in a language pack, and the public form loads it too, so both surfaces are translatable.
Automation and integrations
A durable task queue with ten handler types drains either through the WHMCS cron or through a standalone worker you run every minute. Tasks are claimed with a conditional update, so the two can run side by side and no task executes twice. Handlers cover action execution, evidence collection, notification sending, webhook delivery, capability detection, external-issue push and pull, mailbox polling, the daily digest and the retention sweep. Hourly SLA scans and daily digests, retention sweeps, capability re-detection and health checks are wired to the WHMCS cron hooks out of the box.
Ten adapters are registered in the capability system (the first ten rows below). Each is probed and reports one of available, unavailable, unverified or error, and its actions stay off the menu unless the probe says the adapter is usable. Every probe is deliberately read-only: the module never fires a mutating remote call to test one, so a mutating capability inherits its adapter’s read-probe verdict rather than being proven in its own right. Three capability keys say so explicitly in their detection detail — the Proxmox null-route and its removal, and the AbuseIPDB outbound report. The remaining rows are self-contained transports and helpers rather than registered adapters; they are configured in the same place and are equally inert until you supply their settings.
| Integration | What it does | Credentials |
|---|
| WHMCS support tickets | Opens and replies to tickets through the local API; carries the case reference so ticket traffic links back to the case | Works with no credentials |
| WHMCS module actions | Suspend and unsuspend services through the local API only — never by editing WHMCS tables | Works with no credentials |
| Notifications | Client and admin email through the WHMCS mail pipeline; every attempt is recorded with sent / failed / skipped | Works with no credentials |
| Fraud-suite signal | Read-only risk score fed into confidence scoring, from a co-installed fraud prevention suite’s own tables. No executable actions by design | Works with no credentials — requires a compatible fraud suite to be installed |
| Proxmox VE | VM snapshots; cluster-firewall IP null-route and un-null-route via a managed ipset | Requires your own Proxmox API token |
| Cloudflare | Account-level IP access rules: block, challenge, and remove the rule it created | Requires your own account-scoped API token |
| AbuseIPDB | Reputation lookups that feed evidence and the confidence score; optional outbound IP reporting with client email addresses stripped | Requires your own AbuseIPDB API key |
| GitHub issues | Push a case or roadmap item to an issue and pull status back; PR links surface on the case | Requires your own personal access token |
| GitLab issues | The same for self-hosted or SaaS GitLab | Requires your own access token and instance URL |
| OpenProject | Push and pull work packages via API v3 | Requires your own API token and instance URL |
| Chat-ops (Slack / Teams / Discord) | Mirrors qualifying alerts to an incoming webhook. Opt-in: off until you enable the flag and supply a webhook | Requires your own incoming webhook URL |
| Outbound webhooks | Signs case lifecycle events with a per-endpoint HMAC and delivers them with retries, a delivery log and a dead-letter path | Requires your own endpoint |
| Abuse mailbox intake | Polls an IMAP mailbox and turns unread messages into cases, with X-ARF and classic ARF report parsing, plus a sender gate that skips any message whose Authentication-Results header records an explicit DKIM or SPF failure | Requires your own IMAP mailbox credentials and the PHP imap extension |
| Cloudflare Turnstile | Optional bot challenge on the public intake form | Requires your own Turnstile secret |
| AI triage (advisory) | Suggests a category, severity and summary, and can summarise evidence. Output is validated against the module’s own vocabulary and never acts | Requires your own LiteLLM-compatible gateway URL, model and API key |
Every outbound HTTP call — without exception — goes through one guarded transport with an SSRF guard, no redirect following, HTTPS enforcement for public hosts, a circuit breaker and a scrubbed call log.
Security and privacy
Evidence you can defend
The evidence vault is insert-only. Each case holds its own hash chain: every item stores the hash of its content and a chain hash computed from the previous chain value, keyed with an install secret. Chain verification is a button in the admin area. Content is scrubbed before storage and hard-capped. There is exactly one delete path (the retention sweep) and exactly one update path (the legal-hold flag) — content columns are never rewritten. Evidence on a CSAM-category case is stored under legal hold automatically, and that hold can never be released.
Credentials
Every integration secret is encrypted with AES-256-GCM using a key derived from your WHMCS encryption hash, with a per-value random IV, an authentication tag, and additional authenticated data binding each blob to its own row. A ciphertext copied to a different key fails the tag check instead of silently returning a value. Secrets are never logged, never echoed back into a form, and never placed in an error message.
Authorization
Every endpoint action passes a single ten-step gate before anything happens: master switch, kill switches, actor session validity, CSRF, rate limits, target resolution and ownership, feature enablement, destructive-action confirmation, account status, and input validation. Clients reach a case only as its reporter or as the affected customer of a notice raised against their service — and “not found” and “not yours” return the same answer, so the case store cannot be enumerated. Every denial is written to the audit log with its machine-readable reason. Admin permissions derive from the WHMCS admin role through a role map with a read-only default for unmapped roles.
Abuse of the abuse desk
Rate limits are database-backed and deliberately asymmetric: read buckets fail open so a database hiccup cannot blank a page, while mutation buckets fail closed so an attacker who degrades the database cannot switch off the brake. The public form pairs a honeypot field with a signed submit-timestamp and a minimum fill time, so a robot that posts instantly is dropped silently. Reporter reputation starts neutral, rises on confirmed outcomes and falls on rejections, and only verified identities move the ledger, so nobody can frame a rival reporter. Duplicate reports on the same target fold into one case with a corroboration count instead of flooding the queue.
Emergency controls
Twelve feature flags are exposed in Settings, seven of them kill switches: block all mutations, block actions, block automatic actions, block public intake, block external sync, block notifications and block chat-ops. Flips take effect immediately with no cache to wait on, and the admin panel stays reachable even with the module disabled so you can always get back in. Deactivating the module preserves all data and every table; the only schema-destroying path is a separate maintenance action behind a typed confirmation phrase.
Compliance capabilities ship switched OFF
Three destructive or legally sensitive capabilities are dormant on installation and stay dormant until you deliberately arm them, with the arming itself recorded in the audit log:
- Retention enforcement — until enabled, the retention sweep is a dry run that reports candidates and deletes nothing. When enabled, it still refuses to touch a case that is non-terminal, under legal hold, in the CSAM category, carrying an open appeal, or holding legally-held evidence.
- GDPR subject erasure — a crop-tombstone that overwrites personal free text with a fixed marker while leaving the evidence chain hashes intact, so an auditor can still prove the original sequence was never altered. Legal holds refuse the erasure. Expect one documented consequence: once a case is erased, chain verification reports it broken at the first erased item, because the preserved hash no longer matches the tombstone that replaced the content.
- CSAM / NCMEC reporting — a statutory workflow that opens a preservation record, starts the preservation clock, engages a case-level legal hold and tracks the human-driven state. It assembles a data-only packet for a person to file by hand. It has no transmission code path and never sends anything to NCMEC or any other endpoint.
A DMCA counter-notice record (17 U.S.C. 512(g)) and a GDPR Art.13/14 privacy notice on the public form round out the compliance surface. The counter-notice service records the workflow; it does not forward, restore or transmit anything on your behalf.
Compatibility
| WHMCS | 8.10 and later, including 9.x. Developed against 8.13; verified on 8.13.1 and 9.0.6, with the rest of that range supported but not individually walked. WHMCS 9 changed the addon upgrade callback to pass null; v2.0.4 handles it, so do not run an older build on 9.x. |
|---|
| PHP | 8.2 and 8.3 |
|---|
| PHP extensions | curl, openssl, json required. imap only if you use mailbox intake. |
|---|
| Database | MySQL 5.7+ or MariaDB 10.3+. Installs 32 dedicated tables, all prefixed mod_evps_abusec_. No WHMCS core table is ever written to. |
|---|
| Client themes | Theme-agnostic by construction: the module ships one client template set and WHMCS renders it inside whichever theme is active. The sidebar entry uses the standard WHMCS sidebar contract, plus a native-looking injector for themes that hand-build their own sidebar and ignore that contract — EVPS 1000X is one. No per-theme rendering test ships with this release, so treat EVPS 1000X, Twenty-One, Six and Nexus as supported rather than certified, and walk the six client pages on your own theme after installing. |
|---|
| Order forms | Any of them. The module ships no order-form templates and registers no cart or checkout hooks, so whichever order form you use is untouched. |
|---|
Which ionCube package do I download?
The module is distributed as ionCube-encoded PHP in two lanes. Pick by your ionCube Loader version and your PHP version — not by the encoder number.
| Package | Runs on | Choose it when |
|---|
ic14 — recommended |
ionCube Loader 13.3.1 and 14.4.1, on PHP 8.2 and PHP 8.3 |
Download this one unless you have a specific reason not to. It is the primary build and covers both current PHP versions and both current Loader generations. |
ic13 — legacy |
ionCube Loader 13.3.1 or newer in the 13.x family, PHP 8.2 only |
Only if you are pinned to PHP 8.2 and your host will not run an ic14 file. There is no ic13 build for PHP 8.3 at all, so this package can never run on a PHP 8.3 server. Loaders older than 13.3.1 are untested and not claimed. |
There is no Loader 15 package. An ionCube 15 build would require Loader 15, which nothing we run or support runs today, so that lane is deliberately not published rather than shipped untested. If you are on Loader 15, ask before ordering.
Checking your Loader version correctly. ioncube_loader_version() returns only the major and minor parts — a host running Loader 13.3.1 reports 13.3, and one running 14.4.1 reports 14.4. If you compare that string against a patch-level number you will wrongly conclude a compliant server is too old. For a patch-level check use ioncube_loader_iversion(), which returns an integer encoded as major×10000 + minor×100 + patch — 130301 for 13.3.1 and 140401 for 14.4.1.
Prerequisites and installation
Before you start
- WHMCS 8.10 or later (including 9.x) on PHP 8.2 or 8.3, with a matching ionCube Loader.
- The
curl, openssl and json PHP extensions.
- A working WHMCS cron (the queue, SLA scans and daily sweeps ride on it), or the ability to add one cron entry for the standalone worker.
- A support department id and an alert email address to point escalations at.
- A writable
logs/ directory inside the module, and a writable storage/ directory if you enable evidence attachments.
- If WHMCS sits behind Cloudflare or another proxy, the edge ranges to populate the trusted-proxy setting — otherwise every visitor shares one rate-limit bucket.
Installation
- Upload the module to
modules/addons/evps_abuse_center/.
- Activate it under Configuration → Addon Modules and grant admin role access. Activation runs three idempotent migrations, seeds one conservative response policy per stream and category, seeds the feature flags (master switch on, every kill switch off, all three legal capabilities off) and writes default settings. Re-activating is safe.
- Set the module fields: alert email, default ticket department, retention horizons, and leave Automated Actions off until you trust your policies.
- Choose your queue mode — WHMCS cron (default, nothing else to do) or the standalone worker on a one-minute cron.
- Optionally configure integrations, then press Test on each card. Test runs the same read-only connectivity probe the module uses itself: it confirms the credentials and the endpoint, not that a mutating call will succeed.
- Open Diagnostics and confirm the health cards are green.
Upgrades are additive and idempotent throughout the 2.0.x line: no schema is dropped, no data is rewritten and the destructive capabilities stay in whatever state you left them.
Licensing, support and updates
- Licence model — a commercial licence per WHMCS installation, purchased through this store. One licence covers one WHMCS installation. The licence is issued to the domain, IP and directory you install it on, and can be reissued from your client area if you migrate.
- Price — Subscription $24.95/month or $99.00/year; One-Time $149.00; Lifetime $299.00 (Founding 100). Renewal applies to the Subscription licence only, at the price and cycle you chose; One-Time and Lifetime licences do not renew. Prices in USD, excluding any tax that applies where you are.
- Licence validation — the module validates its licence against this store and caches the result locally, so it does not call out on every request. If our licensing service is unreachable the module keeps working for a grace period and warns an administrator; it does not stop your abuse desk because of an outage at our end. Apart from that check, the module makes outbound requests only to integrations you configure yourself, and every one is recorded in the API call log where you can read it.
- Updates — delivered as new downloads in your client area. Updates are included for as long as a Subscription runs, for 12 months from purchase on a One-Time licence, and for the life of the product on a Lifetime licence. Every release ships with a changelog, a per-file manifest and a SHA-256 checksum so you can verify what you received.
- Support — through a ticket in this client area. Support runs for the same window as updates for your licence type. Published support hours and target response times: [OWNER TO CONFIRM].
- Refunds — 30 days from purchase, where the product has a defect we cannot resolve for you.
- Source access — the shipped package is ionCube-encoded. Templates and language files are supplied unencoded so you can restyle and translate them.
Licence options
One build, all features. There is no feature gate anywhere in the code and no cut-down edition. Every capability described on this page is in the package you receive. The options below differ only in how you pay and how long updates are included — never in what the software can do.
Licence |
Subscription |
One-Time |
Lifetime (Founding 100) |
|---|
| Every feature on this page | Included | Included | Included |
| Valid for | One WHMCS installation | One WHMCS installation | One WHMCS installation |
| Price | $24.95 / month or $99.00 / year | $149.00 once | $299.00 once |
| Runs while the licence is active | Yes | Yes, perpetually | Yes, perpetually |
| Updates included | For as long as the subscription runs | 12 months from purchase | For the life of the product |
| Support included | For as long as the subscription runs | 12 months from purchase | For the life of the product |
| Delivery | Encoded package in your client area | Encoded package in your client area | Encoded package in your client area |
| Refund | 30 days, defect | 30 days, defect | 30 days, defect |
Founding 100 is limited to the first one hundred lifetime licences. Prices are in USD and exclude any tax that applies where you are.
Honest limitations
Things this module does not do, stated plainly so you do not discover them after purchase.
- It does not detect abuse. It manages reports that reach you. Bring your own detection.
- Compliance features ship disabled. Retention enforcement, GDPR erasure and CSAM reporting are off on installation and must be armed deliberately. Until then the retention sweep is a dry run.
- CSAM reporting is manual export only. It never auto-transmits to NCMEC or to any other endpoint. A human files the report; the module tracks the workflow and preserves the evidence.
- DMCA counter-notices are recorded, not forwarded. The module does not send the counter-notice to the complainant and does not restore content. Those remain your actions; it records that you took them.
- Anonymous reporters receive no outbound email in this release. A notification event is recorded on the case and the reference is shown on submission; the public status page is their channel. Customers who are logged-in WHMCS clients do receive email through the normal WHMCS mail pipeline.
- Several integrations need your own credentials or endpoint. Proxmox, Cloudflare, AbuseIPDB, GitHub, GitLab, OpenProject, chat-ops, outbound webhooks, IMAP intake, Turnstile and AI triage are all inert until you supply them. The table above marks each one.
- Three mutating capabilities ship unproven. The Proxmox null-route, its removal, and the AbuseIPDB outbound report each carry a “not probed” note in their detection detail, because the module never fires a mutating remote call to test one — and neither does the Test button, which is a read-only connectivity check. The first real action you run against your own account is the proof.
- The trusted-proxy list has no config-form field in this release. It is read from the addon settings table and must be set with a database row. The empty default is correct and safe for a directly-exposed install, but wrong behind a CDN — see the installation guide.
- Automation is opt-in and stays narrow. Automatic action lists ship empty, suspension additionally requires a per-policy switch, and termination has no automatic path in any configuration.
- AI triage is advisory. It suggests; it never transitions a case, changes a field or executes an action. Without your own gateway the buttons stay inert.
Questions
Can it suspend or terminate a customer automatically?
Suspension can be automated, but only if you deliberately configure it: the policy must list the action, the case must clear both a confidence and a severity threshold, the per-policy allow-auto-suspend switch must be on, the module-wide Automated Actions setting must be on and the kill switch must be clear. All of it is re-checked at execution time. Termination cannot be automated at all — the termination action opens a high-priority ticket and nothing else.
Does it modify WHMCS core tables?
No. It creates 32 of its own tables and reaches WHMCS through the local API only. Deactivating the module preserves all of them.
Will it change my order forms or checkout?
No. The module ships no order-form templates and registers no cart or checkout hooks. It adds client-area pages, a sidebar entry, an admin page and cron work.
Which download do I need?
The ic14 package, in nearly all cases. It runs on ionCube Loader 13.3.1 and 14.4.1 and on both PHP 8.2 and PHP 8.3. Take ic13 only if you are pinned to PHP 8.2 and cannot run an ic14 file — and be aware there is no ic13 build for PHP 8.3. There is no Loader 15 package at all.
My host reports ionCube 14.4 but the requirement says 14.4.1. Am I too old?
Almost certainly not. ioncube_loader_version() returns only major and minor, so a host running 14.4.1 reports 14.4. Check ioncube_loader_iversion() instead: it returns 140401 for Loader 14.4.1 and 130301 for 13.3.1.
Can an anonymous reporter find out whether one of my customers is under investigation?
No. The public status page returns the same neutral answer for a wrong reference, a wrong email and a reference that does not exist, and it never shows a target. In the client area, a case that a customer does not own is reported as not found — identical to a case that never existed. Duplicate detection returns the existing reference only to the original reporter.
What happens if an integration breaks or a remote service goes down?
Nothing user-visible. Adapter probes fail closed and hide the affected features; a failing outbound call trips a circuit breaker; queued tasks retry and then dead-letter with the failure recorded; dashboard widgets degrade to an empty state rather than fataling. No screen in the module blocks on a remote service.
Do I have to expose a public form?
No. Public intake is a switch. Turn it off and the module still runs as an internal desk fed by logged-in customers, by admins and, optionally, by mailbox polling.
Is the customer-facing text translatable?
Yes. Client-area pages and the public intake form both read a module language pack with English defaults, so a missing key falls back to English rather than rendering blank. A handful of dynamic labels and the public status page are English literals in this release.
How do I get out if I change my mind?
Deactivate the module: all data and every table are preserved and re-activation resumes where you left off. Removing the schema is a separate, explicit maintenance action behind a typed confirmation phrase. Cases and the audit log export to CSV and JSON at any time.
Release highlights — 2.0.x
2.0.4 — WHMCS 9 compatibility
- Fixed the addon upgrade callback for WHMCS 9, which invokes it with
null where 8.13 always passed an array. Any 9.x install running an earlier build hit a fatal at exactly the wrong moment. Additive; no schema change.
- Release packaging now stages from the git index and fails the build if a carriage return survives, so shipped bytes are committed bytes.
2.0.3 — concurrency fix
- Case merge could lose a corroboration when two admins merged duplicates into the same case at once, which could hold a case below an escalation threshold it had actually crossed. The read-modify-write now runs inside a locked transaction.
2.0.2 — adversarial release audit
- Closed a cross-tenant access flaw on client submission, a plaintext-secret logging path, a duplicate-detection existence oracle, a cleartext chat webhook signature in the call log, and analyst evidence that was visible to the reporter.
- Repaired four feature flags that had no write path, so the compliance controls became reachable; all flag vocabularies now derive from one registry with a test that keeps them from drifting.
- Fixed duplicate-detection locking, a blocking DNS lookup inside that lock, orphaned child rows in the retention sweep, a legal-hold gap in the evidence sweep, and a health check that verified 21 of 32 tables while claiming to check them all.
- Added the admin authoring tab for the customer-visible changelog, which previously could never hold content.
2.0.1 — hardening and i18n
- Secret blobs are now bound to their own storage key with authenticated data and a version marker, so a copied ciphertext fails rather than decrypting.
- The public intake form became translatable through the module language pack.
2.0.0 — “Full Spectrum”
- Compliance and data lifecycle, all shipped off: CSAM preservation workflow, GDPR crop-tombstone erasure reconciled with the evidence chain, extended retention sweep, DMCA counter-notice records, HMAC-keyed evidence chain.
- Public intake hardening: content-fingerprint duplicate folding, CIDR-aware rate-limit identity that fixes the shared-edge-IP problem behind a CDN, signed-timestamp honeypot with a minimum fill time, disposable-domain advisory hold, anti-framing reputation ledger, and a privacy notice.
- Feedback loop and transparency: roadmap item detail with moderated comments and follows, close-the-loop notifications for voters, the changelog page, satisfaction capture, and the no-oracle public status lookup.
- Admin workflow: reporter-trust card, canned-reply macros, operational analytics, workload board, suggested duplicate merges and per-admin notification preferences.
- Integrations and observability: chat-ops adapter, signed outbound webhooks with dead-lettering, health-check alerting, an API call-log panel and a disaster-recovery runbook.
Get the Abuse & Feedback Center
Version 2.0.4 “Full Spectrum” for WHMCS 8.10 and later, including 9.x, on PHP 8.2 or 8.3. Download the ic14 package unless your host tells you otherwise.
Add to cart — from $24.95 / month
Ask a pre-sales question
One licence per WHMCS installation. Subscription $24.95/month or $99.00/year, One-Time $149.00, Lifetime $299.00. Updates and support run with your licence type as described above. 30-day defect refund. Prices in USD, excluding applicable tax.