Due to an unfathomable amount of incompetence on the side of WHMCS and their insistence on increasing their prices despite outstanding bugs and little to no value addition, we have decided to change providers for the billing and support system. This reduces costs and gives us a system which actually works and is far more receptive to our requirements.
We have already migrated all customer accounts to the new system, which will go live on the 1st of January 2026. You’ll receive bills as normal via email, but the billing and support page has moved to https://service.zetamex.com
You can use your email address and password to login to your account as normal. For security reasons we elected not to move the payment registrations, so you will have to link your credit card again. We do not store any payment information on our end, it is all handled by our gateway providers only giving us means to call securely stored credentials on their end. PayPal has returned to a manual checkout, giving you control over when you wish to pay invoices.
We apologize for any inconvenience this may cause, but rest assured this new system is going to provide a better experience going forward.
To go into a bit more detail, because it is so utterly infuriating what we had to deal with:
API:
A bug report open for over a year at this point. One of the biggest issues and a testament to the incompetence WHMCS exhibits as of late. For our ingress system we have used the WHMCS API to authenticate customers as otherwise anyone could just upload and fill up the system with random files. To do this we attempted to use the user auth method, but hit a problem. Customers that selected a more secure password with special chars like %&! were unable to use the system. The reason for this was an auth failure. The cause of this failure is two-fold. For starters WHMCS elected to send the data as direct URL request, meaning each parameter of the request and its value were sent as one long URL e.g. api.com/auth?username=user&password=pass You can already tell how adding specific characters into a password might cause issues with that approach. Fortunately the API itself is also accessible through other means, meaning we can send the information from the ingress system to WHMCS in ways that preserves the correct data. Unfortunately the second part of this bug then makes it totally impossible to authenticate the user. This is because internally the password is sanitized, presumably because WHMCS is afraid it might be used for database injection, so all special chars are stripped from the plaintext password. Subsequent code attempting to authenticate the user thus fails as the password no longer matches what’s on record.
While we can work around the insanity of sending passwords in plaintext without the necessary URL encoding to prevent the request from failing, internal code is not something we have access to as WHMCS encodes their entire codebase. Opening a ticket with them to get this problem resolved and perhaps change the API to be a little more secure did not yield any result. As of writing the problem still exists in their code and we have not been given any information on when it might be fixed. WHMCS also refuse to inform of us of any changes to the status of this issue or the timeline when it might be fixed. In a B2B environment this level of incompetence is unacceptable to us. After over a year of no significant movement it has become clear the security and quality of their software seems not their utmost priority.
PayPal:
Some may have had the misfortune of dealing with this issue, we apologize for that. At some point WHMCS went into bed with PayPal and worked out a deal with them to introduce a new payment flow into WHMCS. With this new system PayPal gains the ability to set a debit permission, which WHMCS can use to deduct funds from a PayPal account. For those that wish to not bother with manual payments each month this might seem like a great option, but for those that wish to control their funds more closely this presents a problem. The new system PayPal rolled out has the ability to set this debit permission or just not set it. It is optional. WHMCS on the other hand, under the reasoning that merchants apparently requested this feature, decided to force this debit permission. Completely ignoring the fact this could have been an option for merchants to select, they simply forced it for everyone. This presents the customer with the requirement to “link” their PayPal account instead of just paying the invoice they received. Subsequent invoices are automatically paid without their specific consent. This is not something everyone wants when using PayPal so to strip this option is unacceptable to us. Especially given that it is an option and not the requirement WHMCS made it into.
Opening a ticket with them regarding this and being told that it is something merchants requested, totally ignoring the optional nature of it. Making changes to our PayPal account as WHMCS works with them to integrate this new system and then pretending it is not something merchants have issues with is just not acceptable. Various forum posts, which some are locked to presumably dissuade others from adding their dissent to, and an open feature request to bring back the option for the customer to select single checkout or subscription have gone ignored. Never mind the fact that should a PayPal lose the ability to accept this debit permission, due to disputes or other account standing issues, their module fails to properly check if the flag is even set on the PayPal account to begin with.
Coupons:
Granted this is something the new system struggles with as well, but with it there is at least the ability to potentially fix this as the code isn’t entirely encoded. WHMCS allows for creation of coupons or promo codes, which we attempted to use for various sales. Unfortunately some of them did not work as intended. While WHMCS has no issue setting the same promo code for multiple different promotions, it internally does not check which actual promotion they might apply to. Setting the same code for different billing cycles, monthly or quarterly for example, would then fail to apply properly as it does not match both the promo code itself and the selected billing cycle. Resulting in a completely silent failure to apply the discount.
Bringing this to their attention again the response was a mix of this being intended behavior and that proper application of discounts via promo code was on us to figure out. Essentially stating that they would not bother adding a small line of code to check if a given promo code might apply to multiple billing cycles.
Ticket responses:
To reduce the time spent on responding to inquiries that come up more than once most support systems have the ability to set predefined responses. Since these can be applied to any ticket they have the option to define placeholders for things like names or related services. WHMCS provides two options for placeholders of names. [NAME] and [FIRSTNAME] with the former supposedly containing the first and last name of the customer. This works well when a customer, using their billing account, sends in a ticket. Sending a ticket directly through the contact page without logging in to the billing account however produces a different result. Instead of replacing the placeholder with both first and lastname only the lastname is entered. A bit of an issue when you wish to be polite and frankly a bewildering thing to miss. It begs the question if WHMCS conducts any testing of their software.
Worse still, when providing this bug report to them we were told they can reproduce the issue on their end, but much like with the API issue would give us no timeline for a fix or update us when the fix has rolled out. Instead we were told to simply watch the changelog and then we’d know when it would be fixed. Well WHMCS have not released a new changelog or version of their software in 3+ months despite their supposed commitment to release a new version roughly every quarter. A problem as simple as this, and at the same time as critical for operations, doesn’t warrant a hotfix release. It doesn’t even warrant public disclosure so others using WHMCS might know to manually insert names to this placeholder. If no one is aware of the bug, does it really exist? Is not an acceptable behavior.
Being presented with newsletters about WHMCS latest integration with a shady business or supposed new options for tricking customers into buying more things they may not need. The entire forcing of subscriptions feeling predatory and underhanded in its rollout. It completely soured the business relationship and has cemented the view that WHMCS is not out to provide usable software unless it somehow impacts their bottom line. Increasing their prices at the start of 2026 while bugs remain is just the icing on the cake.
Our new partner for billing and support, Blesta, has been a lot more receptive to inquiry in regards to the functions of their software and the far more open nature of their software itself gives up a far better setup to tailor it to our needs and much more quickly fix bugs. Their release cycle and direct connection with their customers is also far more of what we expect in a B2B environment. As we move to Blesta some teething issues are likely to come up as it is a new piece of software, with its own design choices, but we hope the reduction in costs and far better support will make it a better fit for us and you, our customer.


