eKYC Guard for WHMCS — Changelog (Release Notes)

14 min read 3 views

This page lists every eKYC Guard release, newest first. New versions install with one click from Addons → eKYC Guard → Settings → Updates: the current version is backed up first, and your settings, verifications and uploaded documents stay exactly as they are.

Version 1.10.7 — 20 October 2026

Changed

  • WHMCS 9.1 support: eKYC Guard is checked against WHMCS 9.1 and works on WHMCS 8.9 – 9.1.x with PHP 8.1 – 8.4. It never edits invoices, so the new Invoice Immutability setting and credit/debit notes do not affect it. Note that WHMCS 9.1 itself needs PHP 8.2 or newer and ionCube Loader 15.

Version 1.10.6 — 19 October 2026

Fixed

  • An administrator's approval is final: approving a verification that was held for a possible sanctions/PEP match sent it straight back to manual review, so the customer stayed blocked. Now the customer is verified and unblocked. The match stays on the record and in the log. New verifications are still screened, and a match still goes to review.
  • Requirements: the product descriptions now list the correct requirements: PHP 8.1 or later with cURL, fileinfo and sodium, and the free ionCube Loader.

Version 1.10.5 — 17 October 2026

Added

  • Feedback & Ideas: send us a feature request, a bug report or feedback from Addons → eKYC Guard → Feedback & Ideas, and follow its status, our answer and the version it is released in. A badge on the tab shows new answers.
  • Your choice what is sent: technical info (versions, licence plan, admin language) is attached only while "Attach technical info" is ticked, and "What is sent" shows it. No data about your clients is ever sent.
  • Nothing gets lost: if our server cannot be reached, the message is saved and sent automatically later.

Version 1.10.4 — 14 October 2026

Your settings are kept. New, safer defaults apply to new installs; on an existing install the dashboard recommends them and you choose.

Security

  • Name check: the verified name is compared with the account by default (manual review when it does not match). New option: while the name check is off, automatic approvals wait for manual review (on for new installs).
  • When the licence cannot be verified: new option to keep protection on (held orders and sensitive-action checks stay active) or turn it off. New installs keep it on, and administrators get one e-mail when the licence stops being valid.
  • Licence check: the licence is checked against the server's signed answer every time, with an offline period of 7 days. If your server clock is more than an hour behind, the licence page says so; correct the clock (NTP) and re-check.
  • Signed updates: updates are installed only when the package carries a valid Arahoster release signature.
  • Data retention: runs every day, also when the licence is not active. New installs delete documents after 90 days. New: "Erase KYC data" for one client (Full Administrators) and an option to delete all KYC data on deactivation (off by default).
  • "Continue on your phone": the link stays out of web server logs, works in one phone browser only, is replaced by a newer link, ends on logout and is valid for at most 60 minutes.
  • Document storage: documents are no longer stored inside the web root unless you confirm that web access to that folder is blocked. A new button encrypts older unencrypted documents.
  • Privacy: photo metadata (such as GPS location) is removed from uploaded images when the server has GD or Imagick, and DigiLocker personal details are no longer written to the module log.
  • Smaller hardening: "Send verification email" and "Test connection" use a form, and the document encryption key can no longer be created twice.

Version 1.10.3 — 14 October 2026

Security

  • Admin decisions stand: only an administrator can overturn an administrator's rejection or a re-verification expiry.
  • Who can verify and configure: only the account owner (or an admin using Login as Client) can verify, and only a Full Administrator can change the settings.
  • Encrypted secrets: provider keys, secrets and document keys are stored encrypted.
  • General hardening: admin decisions are accepted from their forms only, public pages are protected against floods, customers no longer see technical errors, and outbound requests go to public HTTPS addresses only.

Version 1.10.2 — 13 October 2026

Changed

  • ionCube-encoded package: same features as 1.10.1. Requires the free ionCube Loader (PHP 8.1 – 8.5).

Version 1.10.1 — 12 October 2026

Changed

  • Readability: larger text on the admin pages and wider drop-down lists.

Version 1.10.0 — 12 October 2026

Changed

  • New admin look: a header with the licence state and shortcuts, a tab bar with counters and content in cards, shared with the other Arahoster modules.
  • Dashboard: key figures, a "Needs attention" list with an Open button for each item, and recent activity.
  • Settings: clear label / field / help rows, switches instead of checkboxes and a save bar that stays in view.
  • Updates: Settings → Updates shows Update, Server checks, Backups and Last update, and a yellow bar on every page offers "Update now" when a newer release is available.
  • Arabic: right-to-left admin pages for administrators whose WHMCS language is Arabic. Works on phone-sized screens too.
  • Nothing else changes: every setting, action, permission and hook works exactly as before.

Version 1.9.1 — 12 October 2026

Changed

  • Updates in Settings: updates moved to Settings → Updates, and the "Update to" label next to the module version opens that tab.

Version 1.9.0 — 12 October 2026

Added

  • One-click updates: "Update now" installs a new release directly (Full Administrators only). The package is verified, the current version is backed up first and restored automatically if anything fails, and backups can be restored from the same tab. Uploaded documents are never touched, and updates no longer need FTP. Requires WHMCS 8.9 – 9.0.x and PHP 8.1+.

Version 1.8.2 — 10 October 2026

Security

  • Signed licence answers: the module only accepts licence answers signed for this request. Needs the PHP sodium extension (standard in PHP; on cPanel EasyApache, the php-sodium package).

Fixed

  • Other Arahoster modules: another Arahoster module on the same WHMCS can no longer interfere with eKYC Guard's licence check.

Version 1.8.1 — 10 October 2026

Fixed

  • Licence server outages: a busy or unavailable licence server no longer switches the module off; it keeps working during the grace period.
  • Renewals take effect quickly: the daily licence check always asks the server, so renewals and suspensions apply within a day.

Version 1.8.0 — 10 October 2026

Every new feature is off until you switch it on, and each has its own options.

Added

  • Smart triggers: require KYC only when an order meets your conditions: first order, order total, fraud score or a new client.
  • Fraud checks (Settings → Fraud checks), each with its own action (flag, manual review or reject): the same person on another account, the verified name against profile, contact and payer names, and company checks (Norway Brønnøysund, EU VIES, UK Companies House).
  • Verification for sensitive actions (Settings → Sensitive actions): EPP code, domain unlock, domain contacts, account e-mail, service password and service buttons, one switch each.
  • Instant alerts to Telegram, Slack, Discord or a signed webhook, chosen per event, with a test button.
  • Ready-made rejection reasons next to the Reject button.
  • "Continue on your phone": a QR code with a one-time link so the customer can take the photos on their phone without logging in there.
  • Statistics page: acceptance rate, time to decision, drop-offs and provider cost for 7, 30, 90 or 365 days.
  • Manual upload can ask for the document number and date of birth.

Fixed

  • Licence notice: the "Purchase or renew" link opens the eKYC Guard page in the Arahoster store.

Version 1.7.0 — 10 October 2026

Added

  • Country rules (Settings → Enforcement & scope): customers from the countries you list can skip KYC, or only customers from those countries need it. Decided by IP location and billing country together (default) or by either one. A VPN, proxy, Tor or unknown location always needs KYC, and the verification view shows the decision.

Changed

  • Languages: the client area and customer e-mails are available in English, Arabic and Norwegian. French and Spanish were removed; pages set to them now follow the client's language.
  • IP lookups: a failed lookup is retried after 10 minutes, so a provider outage does not slow your site down.

Fixed

  • Cron: a customer is never suspended only because their IP location could not be looked up at that moment (reminders still go out).

Version 1.6.1 — 10 October 2026

Your settings and any e-mail templates you edited are kept.

Added

  • Translated customer e-mails: invite, reminder, verified and rejected e-mails in Arabic (right-to-left), French and Spanish, sent in the client's language.

Changed

  • Licence panel: features are listed in plain words, showing which ones run through your verification provider.

Fixed

  • Faster admin pages: they no longer contact the licence server on every load.
  • Update notice: the licence panel shows "Update to x.y.z" when an update exists.
  • Servers without sodium: the upgrade no longer switches encryption on where it is not supported (which blocked uploads).

Security

  • Licence cache: the local licence cache is signed, and a revoked licence stays revoked during a later licence server outage.

Version 1.6.0 — 10 October 2026

Added

  • One settings page (Addons → eKYC Guard → Settings) with tabs, copy-ready webhook URLs, connection tests, masked secrets and validation.
  • "Preview impact": shows exactly which customers and services automation would touch before you switch it on. Terminate and disable need a typed confirmation.
  • Admin override: admins can override the gate (Create / Accept Order / Register); every override is logged and the option can be switched off.
  • Long-standing customers: placing a new order no longer suspends their older services (option to restore the old behaviour).

Fixed

  • Domains: registrations and transfers are really held now and are sent to the registrar after verification (paid orders) or listed for an admin.
  • Auto-provisioning: only paid orders held by the gate are provisioned, Fraud orders are never touched, and welcome e-mails are sent.
  • Providers: Persona, Sumsub and Didit company (KYB) verifications are handled correctly, and missed webhooks are recovered by polling the provider.
  • Restrict mode covers the real cart and checkout pages and new customers, and the ticket badge shows again in the admin ticket view.
  • Records: customers cannot overwrite a verified or in-review record, and uploads and verification starts are rate-limited.

Security

  • Documents: encrypted by default and stored outside the web root; Aadhaar data follows your retention period.

Version 1.5.8 — 10 October 2026

Security update, upgrade strongly recommended.

Security

  • Uploads: only JPEG, PNG, WEBP, HEIC and PDF are accepted as ID documents, checked by their real content, and documents are opened for admins in a locked-down way.
  • Document access: opening KYC documents requires an admin role with access to the eKYC Guard addon.
  • DigiLocker: returns are bound to the customer's own session, single-use and time-limited.
  • Logs and webhooks: secrets are masked in logs, stale or repeated webhooks are ignored, and webhooks for providers you switched off are refused.

Fixed

  • Auto-terminate: only terminates services eKYC Guard itself suspended, after a new "Terminate after (days)" delay (default 14), never services suspended for non-payment.
  • After verification: only eKYC Guard's own suspensions are lifted and only accounts it disabled are re-activated.
  • Reminders: use each customer's latest record, skip customers awaiting manual review, cover abandoned sessions and are never duplicated. Switching automation on gives everyone a fresh grace period.
  • Risk-Based KYC: scores the customer's own IP, no longer creates records from page views and does not treat failed lookups as clean.
  • AML screening: outages send verifications to manual review instead of approving them, and a clear notice is shown if your plan lacks AML.
  • Smaller fixes: several PHP warnings and data-integrity issues.

Version 1.5.7 — 17 September 2026

Added

  • Risk-Based KYC: require verification for customers connecting through VPNs, Tor, proxies or with a high fraud score (ProxyCheck.io or IPQualityScore). Two modes: override (high-risk connections always need KYC) and strict only (KYC only when risk is detected). Results are cached for 24 hours to save API quota, and local IPs are skipped.
  • IP risk panel: the verification view shows the risk score, connection badges (VPN, Tor, Proxy, Clean IP), country, ISP and detection reasons.

Version 1.5.6 — 16 September 2026

Added

  • KYC badge on tickets: the admin ticket view shows whether the client is verified, in review or unverified, with a warning against sensitive actions for unverified clients and a one-click KYC invite button.

Fixed

  • Checkout gating: orders are reliably captured across all checkout themes and gateways.
  • Provisioning and domains: more reliable handling of provisioning and domain registration/transfer checks, and no duplicate auto-provisioning.
  • Background tasks: cron and background provisioning work even when no API admin user is configured.
  • Compatibility: e-mail merge fields and admin downloads work across more WHMCS versions; domain scope matching is more precise.

Security

  • Admin actions: all admin changes are protected with WHMCS's security token, and the client IP is taken from WHMCS's verified value.

Version 1.5.5 — 14 September 2026

Fixed

  • E-mails: the verification invite is sent right after checkout, and welcome e-mails are sent when services are auto-provisioned.

Version 1.5.4 — 11 September 2026

Fixed

  • Auto-provisioning: services are only created and orders accepted once the invoice is paid; with an unpaid invoice the service stays Pending.

Version 1.5.3 — 20 August 2026

Added

  • Aadhaar details: verified name, e-mail, date of birth, gender and the DigiLocker reference ID are saved to the verification record and shown on the review screen, while the Aadhaar file itself is discarded in line with UIDAI rules.

Version 1.5.2 — 20 August 2026

Fixed

  • UIDAI compliance: Aadhaar cards from DigiLocker / API Setu are never downloaded or stored; other approved documents still are.

Version 1.5.1 — 13 August 2026

Added

  • Version badge: the Settings & endpoints tab shows "Latest version" or an "Update to version X" button.

Version 1.5.0 — 13 August 2026

Added

  • Auto-delete rejected entries: optional daily removal of rejected verification records and their documents after a number of days you choose.

Version 1.4.3 — 11 August 2026

Added

  • DigiLocker documents: the customer's issued documents (such as PAN or driving licence) are fetched into the document store after a successful verification.

Version 1.4.2 — 8 August 2026

Fixed

  • DigiLocker: a dedicated callback page prevents redirect_uri_mismatch errors.

Version 1.4.1 — 8 August 2026

Fixed

  • DigiLocker: updated sign-in endpoint to resolve redirect_uri_mismatch errors.

Version 1.4.0 — 23 July 2026

Added

  • Didit KYB: clients with a company name are routed to the Didit business verification flow when a KYB workflow ID is configured.

Version 1.3.0 — 21 July 2026

Added

  • GDPR erase: KYC records and documents are erased when a client is deleted in WHMCS.
  • E-mail rate limit: verification e-mails can be sent at most once per hour per client.
  • Floating banner: the client-area warning is now a non-intrusive floating notice.
  • Support guide for administrators covering edge cases and webhook troubleshooting.

Version 1.2.3 — 7 June 2026

Fixed

  • Other Arahoster products: resolves a fatal error when another Arahoster product is installed on the same WHMCS. Each module reads its own licence correctly.

Version 1.2.2 — 6 June 2026

Changed

  • Everything off by default: fresh installs start with every option switched off, so you enable exactly what you want. Existing settings are unchanged.

Version 1.2.1 — 6 June 2026

Changed

  • Plan features: your licence plan now correctly enables premium verification steps such as AML screening.
  • Reliability: internal reliability and packaging improvements. No action required.

Version 1.2.0 — 6 June 2026

Changed

  • Licensing: faster, more reliable licence validation with plan-based features. Your existing licence key keeps working; no action required.
  • Licence panel: shows your plan, expiry date and included features.

Version 1.1.2 — 6 June 2026

Security

  • Verification page hardening: the customer verification page is hardened against malicious input. No action required.

Version 1.1.1 — 6 June 2026

Changed

  • Licensing: licensing reliability improvements.

Version 1.1.0 — 5 June 2026

Added

  • New providers: Stripe Identity, Sumsub, Onfido, Persona and Shufti Pro, in addition to Didit, DigiLocker and manual review.
  • AML / sanctions / PEP screening: a potential match goes to manual review instead of being auto-approved.
  • Scope: require KYC only for specific products or product groups.
  • Re-verification: periodic re-KYC after a chosen number of months.
  • Auto-provisioning: pending services and orders are provisioned once the customer is verified.
  • Privacy: GDPR consent before verification, document encryption at rest, automatic document retention and document-access audit logging.
  • Languages: client area in English, Spanish, French and Arabic.
  • Editable e-mail templates for invitation, reminders, approved and rejected.
  • Integration hooks for other modules when a customer is verified, rejected or sent to review.
  • Admin: bulk approve / reject / e-mail, "Test connection" per provider, and AML results and consent on the review screen.
  • Client experience: mobile camera capture for uploads and automatic refresh while pending.

Changed

  • Never slows provisioning: provisioning uses a cached licence result, so a slow licence server can never delay service creation.

Security

  • Webhooks: stronger validation and replay protection; a replayed event can never un-verify a customer.
  • Starting a verification now requires consent and a security token.

Fixed

  • AML screening: requests are sent to the correct address.

Version 1.0.0 — 5 June 2026

Added

  • First release: block product, service and domain provisioning until the customer passes identity verification, with all / whitelist / blacklist TLD rules.
  • Providers: Didit (global), DigiLocker (India) and manual document upload with admin review.
  • Client area: verification status page, provider choice, document upload, menu badge and a "verify now" banner.
  • Admin area: dashboard with statistics and filters, review screen (approve / reject / upload on behalf) and an activity log.
  • Automation: invitation and reminder e-mails, and grace-period auto-suspend, terminate and account-disable, automatically reversed when the customer verifies.
  • Licensing: a missing or expired licence disables enforcement and shows a renewal notice; your provisioning is never frozen.
  • Security: signed webhooks, secure sign-in flows, security tokens and private document storage available only to signed-in admins.
Was this answer helpful?