Hosting Suite access rules add module-specific restrictions to the permissions already granted by WHMCS. They do not replace WHMCS authentication or grant access to another customer's services.
IN THIS ARTICLE
01 Prepare a permission model
- List the work each staff role or customer user should perform, such as viewing account information, managing a website or changing billing policy.
- Configure the required WHMCS addon role access and client-user product permissions first.
- Open Access rules in the module.
- Select the intended subject, which may be an administrator, role, client or user, and define the applicable product or service scope.
- Choose Deny this action or Allow only this action according to the intended restriction.
- Save and use Check effective access or Preview this subject before testing through that identity.
Which access rule takes precedence?
A deny rule wins over an applicable allow rule. An allow-only rule narrows the permitted action set; it is not a general grant to every other function. Review overlapping subject and scope rules when an action is unexpectedly blocked.
The Full Administrator role bypasses the suite's additional access rules. Testing only with that role can hide a mistake that affects ordinary staff. Use a representative restricted identity for verification.
02 Keep shared settings separate
Permission to manage one product or service does not imply permission to change global provider keys, pricing assumptions or other shared configuration. Global settings affect more customers than a scoped service action and need the appropriate administrative access.
Shared settings use revision checks to avoid silently overwriting another administrator's changes. If a save reports that the configuration changed, reload it and compare the new state before resubmitting.
03 Test real customer access
Sign in with a test user who belongs to the intended client and has the relevant product-management or single sign-on permission. Open the active service and verify both allowed and denied actions. A visible button alone is not sufficient evidence that a write is permitted.
Normal hosting management requires an active eligible service. An administrator's ability to list a suspended service does not mean its customer can continue managing the suspended account.
04 Recover from an unexpected denial
Check WHMCS membership and permissions first, then the platform, product tools, service state and module access rules. Use the effective-access preview to identify the relevant restriction. Correct the narrow rule instead of granting broad administrator rights simply to make one operation work.