Change User Passwordfor WHMCS · Documentation
v2.4.1
Home › Overview

Change User Password for WHMCS

A safe, audited way for administrators to reset a user's password without knowing the old one — from the client profile or the Manage Users list, with an optional email to the user.

WHMCS 8 and later no longer let an administrator change a user's password from the profile page. Change User Password restores that workflow inside the admin area, with a secure password generator, an email notification, role-based access and a complete activity log of every change.

Profile Tab

A working password field and generator on the client profile page, shown only to admins with access.

Manage Users

A native Change Password action in each user's dropdown opens a modal with generate and optional email.

Password Generator

Configurable length and character types, cryptographically secure, with copy and insert.

Audit & Dashboard

KPI cards, a reset trend chart and an activity log with IP and browser, plus retention pruning.

POST-only, CSRF protected — every admin endpoint requires POST plus a CSRF token and returns the WHMCS HTTP Method Not Allowed page on a direct GET, matching core behaviour. See Security & Support.

What it does

A Change Password action appears in the Manage Users dropdown and on the client profile tab. It opens a native WHMCS modal where the admin types or generates a new password, optionally emails it to the user, and saves. Every action is written to the activity log.

What’s new

  • v2.4.1 — modal endpoints are POST-only with CSRF validation; a direct GET returns the WHMCS HTTP Method Not Allowed page, mirroring core routes.
  • v2.4.0 — WHMCS Access Control list replaces the module’s own role field, new dashboard KPI cards with a reset trend chart, and root-relative endpoints for WHMCS 9 pretty URLs.
  • v2.3.0 — configurable password characters, a cryptographically secure generator and a CSRF fix for saves.

See the full Changelog.

Requirements

  • WHMCS 8.x or 9.x — the module is IonCube encoded, so your server needs the matching IonCube Loader for your PHP version.
  • A valid license key — entered in the module settings after activation. The key is emailed after purchase and is also available in the client area under Account → My Products → manage product.
  • PHP as required by your WHMCS version.
  • A running WHMCS daily cron, used for activity-log pruning.
License required — after activating the module, click Configure and enter the License key you received by email (or from the client area: Account → My Products → manage product). The module will not run until a valid key is saved.

Start here