The client area

What your customers see on a Managed Web Hosting service in the WHMCS client area, which plan flags and settings control each part, and when it hands them over to cPanel itself.

1. Brand-neutral by design

Customers see a Managed Web Hosting dashboard: the product is never called cPanel there. When an action fails, the customer gets a short, generic message (“Could not add the domain. Please check the name and try again.”) and the real error from the server goes to ImpulseCore’s audit log as a clientarea.action_failed entry — under ImpulseCpanel → Diagnostics → Activity while it’s recent, and in ImpulseCore’s audit log for the module (linked from Diagnostics → Help) after that. The control panel the sign-in opens is cPanel’s own interface.

2. The dashboard

The Overview tab shows the primary domain, the plan, the region and the account status, with:

• Open control panel, site status, and statistics — disk space and traffic this month, plus the account’s add-on domain, subdomain, database and email-account counts.
• Tool tiles grouped as Websites & Files, Databases, Developer, Email, Security and DNS. Most open a tab; File manager, Database manager, WordPress and Webmail sign the customer in to that screen of the control panel. Tiles for features the plan doesn’t include are left out.

Usage figures are the ones WHMCS holds for the service, which the module’s usage_sync task refreshes every hour (see Scheduled tasks for how it covers a large fleet).

3. The tabs

Tab	What customers can do	Shown when
Websites	List the account’s domains (primary, add-on domains, subdomains and aliases); add an add-on domain or a subdomain of the primary domain; remove any domain but the primary; set the PHP version per domain (plan flag PHP version); add and delete redirects (301 or 302) on the primary domain; turn hotlink protection on or off	Always
Email	Create mailboxes (with a quota) and delete them; forwarders; autoresponders; mailing lists; see the SPF and DKIM status and repair it	Plan flag Email
Databases	Create, rename and delete MySQL/MariaDB databases; create users (optionally with all privileges on a database), change their passwords and delete them; allow remote hosts; open phpMyAdmin	Plan flag Databases
FTP	List, create (with a directory and quota) and delete FTP accounts — deleting one also deletes its directory	Plan flag FTP
Files	Browse the account’s files from public_html, and view and edit them; open the full file manager	Plan flag File manager, and Settings → Native Features → In-app file manager is on
SSL/TLS	See installed certificates; Re-check / issue runs an AutoSSL check for the account’s domains (AutoSSL itself is managed in WHM); install or delete a custom certificate; generate a signing request (CSR)	Plan flag SSL
DNS	List the primary domain’s A, AAAA, CNAME, MX and TXT records; add and delete them	Plan flag DNS editor
Scheduled	List, add and delete cron jobs	Plan flag Scheduled tasks (cron)
Apps	Sign in to WordPress Toolkit (plan flag WordPress Toolkit); the app installer and a list of installed applications (plan flag App installer, while Settings → Native Features → Broad app catalog is on); sign in to Git version control (plan flag Git deploy)	Any of the three is available
Backups	Generate full backup (written to the account’s home directory) and see recent backups; download and restore them in the control panel	Plan flag Backups
Security, Maintenance	ImpulseCore’s tabs for the service	ImpulseCore provides them

Every plan flag also needs a valid license. Customers can add only what their WHM package allows — the server enforces its limits. Deleting a domain, mailbox, database or FTP account asks the customer to type its name first.

Native Features are off until you turn them on

Settings → Native Features has two global switches, both off by default: In-app file manager (Files tab) and Broad app catalog in the Apps tab. They use WHM and cPanel calls that differ between cPanel versions, so try each on one of your servers before turning it on. Each works on top of the plan’s flag (File manager, App installer): a plan without the flag doesn’t get the feature with the switch on. While a switch is off, customers on a plan with File manager still get the file-manager sign-in, and the app installer isn’t offered. The installed-applications list also needs Softaculous on the server, and with Verify certificate a valid certificate on the cPanel port (2083).

4. Opening the control panel

Open control panel — on the dashboard, and WHMCS’s own button on the service page — signs the customer in to cPanel. The dashboard’s File manager, Database manager (phpMyAdmin), WordPress (WordPress Toolkit) and Webmail tiles sign them straight in to that screen, each site on the Websites tab has a File manager button, and the Apps and Backups tabs have buttons for WordPress, the app installer, Git version control and backups.

• The customer confirms their password first. Before the panel opens, the customer enters the password they sign in to your client area with; it isn’t asked again for 5 minutes. Five wrong passwords within 15 minutes lock the sign-in for 15 minutes. An admin signed in as the client isn’t asked.
• Each sign-in is fresh and single-use. It’s created with WHM’s create_user_session at the moment of the click, followed over HTTPS only, and never stored or logged; the audit log records that the customer signed in, not the link.
• The plan still applies. A sign-in to a screen the plan doesn’t include opens the control panel’s home instead.
• Deep links follow cPanel’s Jupiter theme. On an account using another theme, a tile may not land on the right screen.

In WHMCS admin, the service’s single sign-on button signs you in to the customer’s account (audited under your admin). The service’s Module Commands offer Retry Provision and Link Existing Account, and its module fields show the account, its server, its status, its Hosting plan, the Last error when a module action on an existing account failed or a link needs review, and a link to that server’s WHM, where you sign in with your own WHM login.

5. Who can change what

• The service’s owner, a WHMCS user with the View & Modify Product Passwords permission, or an admin signed in as the client can use every tab, make changes and open the control panel.
• Other users who can see the service get the Overview (status and usage only) and ImpulseCore’s Security and Maintenance tabs, with a note that changes need the owner or that permission. Nothing else is fetched for them.

Every change is a form post checked against WHMCS’s security token; a change the user isn’t allowed to make is refused and recorded in the audit log.

6. Suspended and closed services

A suspended service shows a Hosting suspended notice: no tabs, no tools and no control-panel sign-in until it’s reactivated. The notice tells the customer their websites, mail and files are kept, and shows no deletion date — but a service still suspended when its 7-day grace ends is removed, like a terminated one. Once ImpulseCore has removed it, the page shows ImpulseCore’s Service terminated notice (the service has been permanently removed), even while WHMCS still shows it as suspended.

A terminated service shows ImpulseCore’s notice: Service scheduled for removal, with the deletion date, during its grace window, then Service terminated once it’s removed. The module’s own Hosting scheduled for removal and Hosting closed notices appear only where ImpulseCore has none for the service. Any request made in these states is refused. See Security & Maintenance for what happens to the account.