MFA Reminder for WHMCS Print

MFA Reminder prompts WHMCS users to enable multi-factor authentication. It provides a client-dashboard alert, optional scheduled emails and an administrator view of MFA adoption. It does not enforce MFA or prevent a user from signing in without it.

This guide describes version 1.6.

Installation

1. Download your module package and back up your WHMCS files and database.
2. Upload mfa_reminder to /modules/addons/.
3. Open System Settings > Addon Modules, or Setup > Addon Modules in older layouts, and activate MFA Reminder.
4. Enter the license key and grant access to the required administrator roles.
5. Configure the reminder settings and test with a non-production client account.

Use a PHP version supported by both WHMCS and your module package. MFA must already be available in WHMCS for customers to enable it.

Configuration

• Enable Reminder: Controls the client-dashboard alert.
• Reminder Type: Choose danger, warning or info.
• Security Page URL: Link used by the dashboard reminder. The configuration default is /user/security. Check the complete URL if WHMCS is installed in a subdirectory.
• Enable Cron Email Reminders: Enables scheduled reminders. This is separate from the dashboard setting and is off by default.
• Cron Reminder Frequency (Days): Minimum interval used by scheduled reminders. The default is 30 days.

Dashboard reminders and MFA detection

The alert checks the logged-in user, including a linked user on a shared client account. It appears on the main client dashboard when that user does not have one of the MFA methods recognized by this release.

Version 1.6 recognizes totp, duo and yubikey. Do not treat backup codes or an arbitrary third-party method as proof that the module will count the user as protected. Test other MFA integrations before using the adoption figures for reporting.

Administrator view

Open Addons > MFA Reminder. The summary separates user and administrator counts. The user table shows linked client accounts, login dates, reminder history and individual send actions.

Use the toolbar to search, refresh, send selected reminders or clear the selection. Bulk selections survive pagination and filtering, so check the total selected before sending. Users without a linked client account cannot receive a reminder through this module and are marked accordingly.

Individual and bulk sends use form submissions. Refreshing the results page does not repeat the send.

Important email-recipient limitation

Selecting a user does not send directly to that login user's email address. Version 1.6 sends through WHMCS's client-account email routing. On a shared account, the actual recipient may differ from the selected user.

Selecting several users linked to the same client account can send several emails to that account. Review linked accounts before bulk sending. The per-user dashboard check and the email delivery destination are separate behaviours.

Email template

Activation creates the MFA Reminder template if it does not already exist. Edit it under Setup > Email Templates > General.

The supplied template uses standard fields such as {$client_first_name}, {$whmcs_url} and {$company_name}. Its security link is built from the WHMCS URL and user/security. If you change the dashboard Security Page URL, review the email template separately; the module does not supply a {$security_url} merge field.

Scheduled reminders

The existing WHMCS daily cron runs the reminder check. No separate cron job is needed. It checks users without a recognized MFA method and their reminder history, then attempts delivery when the configured interval has elapsed. Users without a linked client account are skipped.

Licensing, database and mail-send failures appear in the WHMCS Activity Log with the MFA Reminder (Cron) prefix. Normal skips and successful sends do not create routine module activity-log entries.

Upgrading to 1.6

1. Back up the database and installed module files.
2. Replace the module files with the 1.6 package that matches your PHP environment.
3. Do not deactivate and reactivate the addon as an upgrade step.
4. Check settings, the existing email template, reminder history and a test dashboard after uploading.

Version 1.6 requires no manual database migration and retains the existing settings, template and history. Activation creates mod_mfa_reminder_log; deactivation deletes this reminder-history table.

Troubleshooting

• If the alert is missing, check module activation, Enable Reminder, the main dashboard route and the logged-in user's MFA method.
• If emails are missing, check cron enablement, the reminder interval, the linked client account, WHMCS mail delivery and the Activity Log.
• If the wrong person receives an email, review WHMCS client-account routing and the shared-account limitation above.
• If licensing fails, verify that the host in WHMCS's configured System URL matches the licensed installation.

For support, provide your module, WHMCS and PHP versions, the active theme, reproduction steps and relevant redacted errors.