Verify both identity and account authority before changing hosting access. A person may be a legitimate user of one client account while lacking permission to manage another account or perform a particular action.
IN THIS ARTICLE
01 Check the requester and the action
- Identify the exact customer account, service and requested change. Examples include replacing an account email address, resetting hosting credentials or adding an authorised user.
- Use the established authenticated support channel where available. Check the user's current relationship to the account and the permissions relevant to the action.
- Distinguish notification contacts from users authorised to administer services or billing. Receiving an invoice copy does not necessarily grant authority to change hosting access.
- If the requester cannot authenticate, use the organisation's documented account-recovery procedure. Do not treat a familiar name, caller ID or forwarded invoice as sufficient proof by itself.
- Confirm the destination for any reset or invitation through the approved process. Avoid replacing an existing trusted contact solely with a new address supplied in an unauthenticated request.
- Perform the authorised change using the supported account workflow. Record who approved it, the affected account and the result without storing passwords or recovery codes in the ticket.
- Review whether old access, active invitations or related credentials also need removal within the approved scope.
02 Use platform permissions accurately
WHMCS separates users from client accounts, and one user can have access to more than one account. Check the selected account and its permissions before making a change. HostBill client contacts also have configurable privileges and notification settings; those settings serve different purposes.
For staff, use individual administrator accounts and role permissions so the action has an attributable operator. Escalate an ownership dispute through the defined process instead of resolving it through an informal password reset.
Common questions
Can a developer request the customer's main account password?
Use a separate authorised user or service credential with the necessary scope. Support should not disclose an existing customer's password or bypass the account owner's permission process.
What if a former employee still receives account email?
Verify the current authorised owner and update contacts and access through the approved recovery or administration workflow. Receiving mail alone does not settle account ownership.