Change User Password For WHMCS

WHMCS 8 removed the ability for administrators to change a user's password from the admin area. Change User Password puts it back, safely and with every action recorded.

Change a password straight from the client profile or from the Manage Users dropdown, generate a strong password with one click, and optionally email it to the user so they can log in right away.

Why you need it

• Users ask support to reset their password, and WHMCS no longer lets you do it.
• Staff can reset passwords without ever needing the old one.
• Every change is logged with who did it, when and from where.

Highlights

• Two places to change a password: the client profile tab and the Manage Users dropdown, using the native WHMCS modal.
• Built-in password generator: configurable length (8–64) and character types, using a cryptographically secure random source.
• Optional email to the user: sent with a ready-made Change User Password template.
• Dashboard and activity log: KPI cards, a reset trend chart, and a full audit trail with IP and browser.
• Role-based access: uses the built-in WHMCS Access Control list, enforced server side.
• Secure by design: POST-only, CSRF-protected endpoints, and no passwords in the logs.
• Works on WHMCS 8.x and 9.x. Admin area only, no client-area changes.

What's New

This release makes the module's modal endpoints POST-only with CSRF validation. Opening an endpoint URL directly in the browser now returns the standard WHMCS HTTP Method Not Allowed page, just like WHMCS core routes. CSRF checks also go through one shared, fail-closed helper, so the modal shows a clean error instead of a raw response.

Access control now uses the built-in WHMCS Access Control list, and existing role lists are migrated automatically. The dashboard has been redesigned with total, monthly and daily reset counters, a quick action bar, a 7 / 30 / 90 day or all-time filter, and a new Reset Trend chart. Endpoints are now root-relative so they work from WHMCS 9 pretty admin URLs, and security was hardened across all endpoints and files.

You can now choose which character types the password generator uses (letters, numbers and symbols), and passwords are generated with a cryptographically secure random source. This release also fixes the Generate button and the CSRF token on the save form, so new passwords save correctly.

Features

Change a password

• Change a password from the client profile tab
• Change a password from the client profile → Users tab
• Change a password from Clients → Manage Users
• One click to change a password in a native WHMCS modal
• Send an email notification to the user with the new password
• Works with WHMCS 9 pretty URLs

Password generator

• Configurable password length (8–64)
• Configurable character types: letters, numbers, symbols
• At least one character of every selected type
• Cryptographically secure random generation
• Copy and Insert buttons

Admin and audit

• Dashboard with total, monthly and daily reset counters
• Reset Trend chart with 7 / 30 / 90 day and all-time filters
• Activity log with actor, IP and browser user-agent
• Settings history that names every changed value
• Configurable log retention with automatic cleanup

Security and access

• Role-based access control using the WHMCS Access Control list
• POST-only, CSRF-protected endpoints
• No passwords stored in the activity log or the email log
• No changes to WHMCS core files

Email

• Ready-made Change User Password email template