Protect the account
Secure both the client-area login and its recovery mailbox. Use a unique password and the available two-factor method, and protect the backup code.
The client area holds invoices, services and tickets. Store a unique password in a manager, secure the recovery inbox and sign in through a trusted route. Never share a one-time or backup code with someone claiming to be support.
Enable two-factor authentication
- Sign in to the client area and open the account or security menu. WHMCS places client 2FA under the Hello, Name menu when the feature is enabled.
- Choose the offered authenticator method, scan its setup code in your authenticator app and enter a current code to confirm.
- Save any backup code in a separate, secure place. Test a new sign-in before ending your existing session. Do not store the backup code in the same unprotected device as the authenticator.
Illustrative check: after adding an authenticator, store the recovery code securely, then test a fresh browser sign-in with a current code while the old session stays open. End the old session only after the test succeeds.
If you lose access
Use a saved backup code through the normal sign-in recovery flow. If both the device and backup code are unavailable, contact Novasean through an established support route and expect identity checks before account recovery. Do not create a duplicate account to bypass the problem. Report a suspected compromise immediately and change the email account password as well if that inbox may be affected.
If the recovery mailbox is also compromised, secure that mailbox through its provider before trusting a portal password reset.
Who can change access
The account holder controls their password, authenticator and authorised users. Novasean can assist with the client-area recovery process after identity verification. Portal menu labels may change with WHMCS configuration; if the 2FA option is absent, ask support whether it is enabled for your account rather than following an unrelated administrator guide.
Review access around the portal
Check that the account contact email is one you control and that its mailbox also has strong authentication. Review any additional authorised users and remove access no longer needed, subject to the account's permission controls. Use a distinct password for WHMCS rather than reusing a DirectAdmin or VPS password. A compromise of the contact mailbox may enable password resets even when the portal password is strong.
If an unexpected invoice or reset email arrives, navigate independently to the portal. Compare the invoice there, and inspect the account's recent activity if that view is available. Report a suspicious message to support without clicking its payment link or forwarding a one-time code. Novasean staff should never need your authenticator code or backup code.
Recovery questions
Where should I keep backup codes? In an encrypted password manager or other controlled location separate from the authenticator device.
Should I disable 2FA while changing phones? Prefer transferring the authenticator through its supported process and verify the new device before retiring the old one.
Can support simply tell me my password? Passwords should not be retrievable in plaintext; use the authenticated reset or identity-verified recovery route.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.