WHMCS hosting automation: from paid order to suspension, step by step

WHMCS hosting automation means letting your billing system do every repetitive job for you: a customer orders and pays, WHMCS tells the control panel to create the account and website and sends a welcome email; an invoice goes overdue and the account is suspended, then unsuspended when it is paid; a service left unpaid long enough is terminated. You need three things: a WHMCS install with a working cron, a control panel with a WHMCS module, and a payment gateway. Set it up correctly once, and you stop creating accounts by hand at midnight.

This guide covers the overall architecture, cost, installing WHMCS, connecting it to a control panel (with ZoPanel as a concrete example), configuring suspension and termination safely, testing the full lifecycle, and the mistakes that make automation more dangerous than helpful.

What can WHMCS automate?

WHMCS is the most widely used client, billing and service management system in the hosting industry. With a server module (the connector to your control panel), each WHMCS event triggers an action on the server:

WHMCS event	What happens on the control panel
Order paid	Hosting account and first website created
Invoice overdue N days	Account suspended, sites show a notice page
Overdue invoice paid	Account unsuspended
Overdue M days	Account terminated
Upgrade or downgrade	Package changed, new limits applied
Password reset	Panel password changed
Button in the client area	Single sign-on into the control panel
Daily cron	Disk and bandwidth usage updated

WHMCS also handles everything that is not server-side: quotes, recurring invoices, renewal reminders, support tickets, and domain registration through registrar modules.

What does WHMCS cost in 2026?

At the time of writing (October 2026), WHMCS's pricing page lists two families:

• Self-hosted: Plus for up to 250 active clients (USD 34.95/month), Professional for up to 500 (USD 54.95/month), Business from 1,000 (USD 84.95/month for the 1,000 tier).
• WHMCS Cloud, run by WHMCS: Starter up to 25 clients, Growth up to 100, Expansion up to 300, with per-client overage.

Pricing is by active clients, so it grows with your business. WHMCS belongs to WebPros, the same group as cPanel and Plesk. Prices change often; check the WHMCS site directly. On a tighter budget, alternatives include Blesta and HostBill (paid) or Paymenter (open source).

The architecture to aim for

Customer ──> WHMCS (own billing server) ──HTTPS + API token──> Control panel on hosting server
                  │
                  └── payment gateway, email, 5-minute cron

Three principles:

1. Run WHMCS on its own server, not on a customer hosting server. A hacked customer site must not be able to reach your payment data and your panel tokens.
2. One server entry per hosting server in WHMCS, grouped into server groups so WHMCS can pick a server when it provisions.
3. Least-privilege tokens. WHMCS needs to create, suspend, change and terminate accounts; it does not need files, a terminal or server settings.

Step 1: Install WHMCS and its cron

WHMCS is a PHP application encoded with ionCube, so the server needs the ionCube Loader matching its PHP version, plus MySQL or MariaDB. Check the system requirements page for the WHMCS version you install, as supported PHP versions change between releases.

The step people forget is the cron. According to WHMCS's Automation Settings documentation, it must run at least every 5 minutes, or invoicing, suspension and reminder emails all stop. A crontab entry for the user that runs WHMCS:

*/5 * * * * php -q /var/www/whmcs/crons/cron.php

Use your real crons path (WHMCS lets you move that folder outside the web root). After installing, follow WHMCS's post-install security steps and turn on two-factor authentication for every admin.

Step 2: Prepare the control panel

This part uses ZoPanel as the example; other panels follow similar steps. ZoPanel's WHMCS integration needs a Pro license, because API tokens are part of Pro.

1. Give the panel a domain and SSL under Settings → General → Panel domain & SSL, for example panel.example.com. WHMCS calls the API over HTTPS, so the panel needs a valid certificate.
2. Create packages under Packages: disk, sites, databases, mailboxes, CPU, RAM. Naming them after the products you sell makes them easy to match.
3. Create the API token: My account → API tokens → Create token, set Permissions to Provisioning only (WHMCS, CMS), put the WHMCS server's IP in Allowed from IPs, confirm with your password and 2FA code, and copy the zpat_… token. It is shown only once.

A provisioning token can only call the provisioning API: packages, accounts, single sign-on and usage. It cannot reach files, the terminal or server settings, so even if the billing server leaks, the damage is contained.

Step 3: Install the module and add the server in WHMCS

1. Copy modules/servers/zopanel from zopanel-whmcs-module.zip into your WHMCS install at modules/servers/zopanel. The module supports WHMCS 8.x and 9.x on PHP 8.1 or newer.
2. Go to System Settings → Servers → Add New Server:

Field	Value
Module	ZoPanel
Hostname	panel.example.com
Port	8888, with Secure checked
Access Hash	the zpat_… token
Username	leave empty

3. Click Test Connection.
4. Create a product under System Settings → Products/Services. In Module Settings, pick the ZoPanel package (loaded from the server), the PHP version for the first site, and enable Create website.
5. Choose Automatically setup the product as soon as the first payment is received.

Full instructions, including Blesta, HostBill and Paymenter, are in WHMCS and billing modules.

Step 4: Configure suspension and termination safely

In WHMCS, open System Settings → Automation Settings, under Automatic Module Functions:

• Enable Suspension and Suspend Days: days after the due date before suspension. Many providers use 3 to 7.
• Enable Unsuspension: unsuspend automatically on payment. Turn it on.
• Enable Termination and Termination Days: days after the due date before termination. Make it long (say 30 days), and turn it on only after you have tested the whole lifecycle.

Note that WHMCS counts from the service's Next Due Date, not the invoice due date.

The second safety net belongs in the control panel. In ZoPanel, a terminated account (including one terminated by WHMCS) is not destroyed at once: its data is kept for the period set in Settings → General → Keep deleted accounts (days), 7 days by default and up to 90. A customer who pays a day after termination can still be restored.

Why "safe retries" matter

The network hiccups. WHMCS sends "create account", the panel creates it, but the answer does not make it back in time. WHMCS treats it as a failure and retries. With a naive API, the retry fails with "username already exists", or worse, creates a second account.

ZoPanel's module sends an Idempotency-Key header with every account creation, built from the service ID and username. If WHMCS repeats the call within 24 hours, the panel returns the first answer instead of doing it again. Ask any panel vendor this question; the technical details for ours are in the provisioning API docs.

Step 5: Test the full lifecycle before you sell

Create a test client in WHMCS and go through every step, checking the panel after each one:

1. Place an order and mark the invoice paid. Do the account and site appear? Does the welcome email have the right username, password and panel URL?
2. Click Login to ZoPanel in the client area. Does single sign-on work?
3. Point the test domain at the server. Is SSL issued automatically?
4. Move the Next Due Date into the past and run the cron. Is the account suspended, and do the sites show the suspension page?
5. Pay the invoice. Is the account unsuspended?
6. Upgrade the package. Do the new limits apply?
7. Terminate the service. Is the data still held for the grace period?
8. Check System Logs → Module Log: every API call is recorded, with passwords and tokens masked.

Resellers with their own WHMCS

If you sell reseller hosting, your resellers want automation too. In ZoPanel, a reseller creates a provisioning token from their own account and connects their own WHMCS (or Blesta, HostBill, Paymenter). That token only sees the reseller's packages and customers and cannot exceed the reseller plan you sold them. See Resellers and our reseller hosting guide.

Common WHMCS hosting automation mistakes

• The cron is not running. Nothing errors; invoices simply are not generated and overdue accounts are not suspended. Check the WHMCS automation status page weekly.
• Terminating too early. A short Termination Days turns a customer who forgot to renew into a customer who lost everything.
• A full-access token. Giving billing a full admin token hands the keys to the whole server to another web application.
• No IP restriction on the token. A leaked token works from anywhere.
• Never testing a timeout. Deliberately slow the connection during testing and see whether the panel creates duplicates.
• Invalid usernames. Every panel has username rules. ZoPanel accepts 3 to 16 lowercase letters and digits starting with a letter; the module adapts what WHMCS proposes, for example shop-demo.com becomes shopdemocom, and saves it back on the service.

Conclusion

WHMCS hosting automation saves time every day, but its real value is that it behaves correctly while you sleep: accounts created when customers pay, suspended when they do not, and nobody terminated by mistake. Spend an afternoon testing the full lifecycle on a test server before you open orders.

ZoPanel ships modules for WHMCS, Blesta, HostBill and Paymenter with the Pro plan, priced per server with unlimited sites. See pricing, or start on the Free plan to try the panel before you connect billing.

Frequently asked questions

Is WHMCS free?

No. WHMCS is licensed monthly by active client count, as self-hosted or Cloud. If you need a free option, Paymenter is open-source billing software with modules for many control panels, ZoPanel included.

Do I need a separate server for WHMCS?

You should have one. WHMCS holds customer data, invoices and the tokens that manage your hosting servers. Putting it on the same server as customer sites means one hacked site could threaten your whole billing system.

How many days overdue before WHMCS suspends an account?

You decide, under Suspend Days in Automation Settings. Many providers suspend after 3 to 7 days and terminate after about 30, with a data grace period on the control panel in case the customer pays late.

Can ZoPanel's Free plan connect to WHMCS?

No. The WHMCS integration uses API tokens, which are part of Pro. The Free plan is still enough to install the panel and try websites, email and DNS before you upgrade to connect billing.

What billing systems are there besides WHMCS?

Blesta, HostBill and Paymenter are the common alternatives. ZoPanel has modules for all four, built on the same documented provisioning API, so you can also connect your own storefront.