1. Back up the installation and record the current storage configuration.
2. Choose private directories owned and writable by the WHMCS account, outside the public website directory.
3. Move the existing attachments, downloads and templates_c contents to their intended locations.
4. Update $templates_compiledir in configuration.php to the absolute path of the new template cache directory.
5. Open System Settings > Storage Settings and add the new local storage configurations.
6. Assign the correct configurations in the storage settings and complete the appropriate switch or migration.

This example uses a fictional hosting account named example. Replace every path with your own absolute path and confirm that none is inside a website's public document root.

After moving the template cache, replace its existing assignment in configuration.php with the correct path. Preserve the rest of that file:

$templates_compiledir = '/home/example/whmcs-private/templates_c/';

The cache assignment does not move attachments or downloads. Configure those locations through Storage Settings, then choose Switch only when the existing files are already at their destination; otherwise follow the Migrate workflow.

Use Switch when the existing files have already been moved to the configured destination. Use the supported Migrate workflow when WHMCS needs to copy files from the old location. Inspect the actual source and destination before choosing, since an empty new directory is not equivalent to a completed move.

Open the client and administrator areas to check template rendering. Upload and retrieve a harmless test attachment, then test an authorised download. Confirm the private directories cannot be fetched through a public URL.

If rendering fails, check the exact cache path and PHP process permissions. If downloads disappear, review the storage assignment and whether the files were moved or merely a new location was created. Keep the old backup until these checks pass.

The cron directory has its own supported move procedure, including crons/config.php, the installation's cron path and scheduled commands. Do not assume moving attachments also protects cron scripts.

Update backup jobs to include every private location. During later manual updates, confirm any moved cron files and renamed administrator files receive the matching release updates. An installation with private paths needs those paths recorded in its recovery and migration notes.

• Complete the WHMCS security checks after installation
• Schedule the WHMCS system cron and daily automation
• Back up and restore the WHMCS database and application files
• Move a self-hosted WHMCS installation to another server

• WHMCS: secure writable directories
• WHMCS: move the cron directory