EVPS Software & Modules

Version 2.2.1 · WHMCS 8.13 & 9.0 certified

Run your abuse desk on evidence, not on a shared inbox.

Every abuse complaint, bug report, feature request and piece of customer feedback lands in one case queue inside WHMCS, arrives with tamper-evident evidence already attached, and reaches an action only after a policy and a human have both agreed. Nothing is terminated automatically, under any configuration.

Four intake streamsHash-chained evidence vaultHuman-approved actionsionCube protected & licensedPHP 8.2 – 8.3
4
Intake streams
12
Admin tabs
16
Action types
32
Dedicated tables
8.13 + 9.0
WHMCS certified

An abuse desk you can still defend six months later

Most providers run abuse out of a mailbox and a couple of forwarding rules. That arrangement fails in predictable ways: no evidence you can hand over, no consistency between two engineers meeting the same report, no brake on a malicious reporter, and no channel back to the person who told you.

Evidence that survives the argument

Every case carries a write-once evidence vault with its own SHA-256 hash chain, keyed with an install secret. Chain verification is a button in the admin area. There is exactly one delete path and exactly one update path — content columns are never rewritten.

A policy and a human, in that order

Confidence scoring and a per-stream, per-category response policy produce a recommendation. The orchestrator executes it only after approval, and re-checks every threshold and kill switch at execution time rather than trusting the approval it was given earlier.

No automatic terminations, ever

There is no termination code path in the module. The termination action opens a high-priority review ticket for a human to act on inside WHMCS. Suspension can be automated, but only once you have deliberately armed four separate switches.

The loop actually closes

Anonymous reporters get a no-login status page. Customers get a public roadmap with voting, a “What’s new” changelog and satisfaction capture, so bug reports and feature requests stop disappearing into a mailbox nobody reads twice.

Everything the module adds

Four intake streams, a twelve-tab admin command centre, six client-area pages and sixteen orchestrated action types. Every item below is implemented in the shipped code.

Four intake streams

Abuse, feedback, feature requests and bug reports share one case model, one audit trail and one SLA clock — each with its own category list, guided description template and response policy.

Public intake, no login

A self-contained report form accepts all four streams from anyone, works without JavaScript, and passes an ordered gauntlet of switches, honeypot, optional Turnstile, reporter reputation and per-IP rate limits before anything is written.

No-oracle status lookup

Reporters check a case with its reference and the email they used. A wrong reference, a wrong email and a reference that never existed all return the identical neutral answer, and the target is never shown.

WORM evidence vault

Insert-only storage with a per-case SHA-256 hash chain, on-demand verification, legal holds, content scrubbing and hard caps. Attachments flagged by the upload scan are reviewed in quarantine and never rendered as a thumbnail.

Confidence scoring

A 0–100 score built from named, inspectable factors: source weight, reporter reputation, corroboration from distinct reporters, an AbuseIPDB score where configured, a fraud-suite risk signal, and whether the named target is genuinely one of yours.

Response policies

One editable policy per stream and category: severity, SLA windows, recommended actions, the confidence and severity thresholds for automation, and an explicit allow-auto-suspend switch. Import and export as JSON.

Action orchestrator

Sixteen action types move through recommended, approved, queued, running and succeeded or failed, each declaring whether it is reversible and whether it is destructive. Reversible actions record the reference they created, so one click undoes them.

Split-view triage

A filterable case rail beside full case detail with no page reload — keyboard navigation, a command menu, a next-best-action rail, quick-assign, bulk operations, canned-reply macros, suggested duplicate merges, appeals and CSV export.

Durable task queue

Ten handler types drain through the WHMCS cron or a standalone worker. Tasks are claimed with a conditional update so both can run side by side and nothing executes twice; the console shows depth, retries and cancellations.

SLA & escalation

Per-policy SLA windows with hourly scans and due-soon and breached states, mean time to resolve, time to first response, breach rate, admin escalation and a daily digest.

Roadmap, changelog & CSAT

A public roadmap with client voting, moderated comments and follows; a tagged “What’s new” changelog linked to the items it shipped; and satisfaction capture on resolution.

Client portal, six pages

Overview, a three-step submit wizard, case detail with a lifecycle stepper and appeals, roadmap, roadmap item and changelog — rendered inside your active WHMCS theme from a translatable language pack.

Ten probed adapters

WHMCS tickets and module actions, notifications, a fraud-suite signal, Proxmox, Cloudflare, AbuseIPDB, GitHub, GitLab and OpenProject. Each is probed read-only, and its actions stay off the menu unless the probe says it is usable.

Webhooks & chat-ops

Outbound case-lifecycle webhooks signed with a per-endpoint HMAC, delivered with retries, a delivery log, per-delivery redelivery and a dead-letter path — plus an opt-in Slack, Teams or Discord mirror.

Abuse mailbox intake

Polls an IMAP mailbox into cases with X-ARF and classic ARF report parsing, and skips any message whose Authentication-Results header records an explicit DKIM or SPF failure.

AI triage, advisory only

Suggests a category, severity and summary and can summarise evidence, validated against the module’s own vocabulary. It never transitions a case, changes a field or executes an action.

Diagnostics & audit trail

Health cards for PHP, extensions, all 32 schema tables, migrations, the secret-vault round-trip, queue depth and cron activity, plus an append-only trail of every authorized and denied action with CSV and JSON export.

Emergency controls

Twelve feature flags, seven of them kill switches: block all mutations, actions, automatic actions, public intake, external sync, notifications and chat-ops. Flips take effect immediately, and the admin panel stays reachable even with the module disabled.

Your team and your reporters

Captures from a live installation — the admin console, the client portal and the public form.

A case in full — hash-chained evidence, and an action that waits for a human to approve it.
A case in full — hash-chained evidence, and an action that waits for a human to approve it.
The evidence vault: every item write-once, chained, and re-verifiable on demand.
The evidence vault: every item write-once, chained, and re-verifiable on demand.
Admin dashboard — MTTR, first-response and SLA breach figures you can quote to an upstream.
Admin dashboard — MTTR, first-response and SLA breach figures you can quote to an upstream.
The client portal — customers vote on the roadmap and watch items ship, in your own theme.
The client portal — customers vote on the roadmap and watch items ship, in your own theme.
Public intake — four report streams, no login, and a guided template for every category.
Public intake — four report streams, no login, and a guided template for every category.

How to install & run it

  • Install. Upload to modules/addons/evps_abuse_center and activate under Configuration → Addon Modules. Activation runs three idempotent migrations, creates 32 dedicated tables, seeds one conservative policy per stream and category and writes default settings. Re-activating is safe.
  • Licence. Paste the key issued at checkout. The module validates against this store and caches the result, so it does not call out on every request. If our licensing service is unreachable it keeps working through a grace period and warns an administrator instead of taking your abuse desk offline.
  • Configure. Set the alert email, the default ticket department and your retention horizons, and leave Automated Actions off until you trust your policies. Automatic action lists ship empty, so day one is fully manual by construction.
  • Connect (optional). Add credentials for the integrations you want and press Test on each card. Test runs the same read-only connectivity probe the module uses itself — it confirms the credentials and the endpoint, not that a mutating call will succeed.
  • Pick a queue mode. The WHMCS cron by default, or the standalone worker on a one-minute cron. Both can run side by side without a task ever executing twice.
  • Operate. Diagnostics, the queue console and the audit log show what is happening. Hourly SLA scans, daily digests, retention sweeps, capability re-detection and health checks are wired to the WHMCS cron hooks out of the box.

Protected, licensed, supported

ionCube protected

Two lanes: ic14 for ionCube Loader 13.3.1 and 14.4.1 on PHP 8.2 and 8.3, and a legacy ic13 lane for PHP 8.2 only. A readable preflight runs before any protected code, so a wrong Loader produces an actionable message rather than a blank page.

Properly licensed

One licence per WHMCS installation, bound to the domain, IP and directory you install on and reissuable from your client area when you migrate. Apart from the licence check-in, the module calls out only to integrations you configure yourself.

Credential-safe

Integration secrets are encrypted with AES-256-GCM under a key derived from your WHMCS encryption hash, with a per-value IV, an authentication tag and additional data binding each blob to its own row. Secrets are never logged, never echoed back into a form and never placed in an error message.

Supported

Support and updates run with your licence type: for as long as a Subscription runs, twelve months on a One-Time licence, and for the life of the product on a Lifetime licence. Every release ships a changelog, a per-file manifest and a SHA-256 checksum.

WHMCS 8.13 verifiedWHMCS 9.0 verifiedPHP 8.2 & 8.3ionCube Loader 13.3.1+No WHMCS core table is writtenTermination is never automated

Compare the three licences

One build, all features. There is no feature gate anywhere in the code and no cut-down edition — the tiers differ only in how you pay and how long updates and support are included.

Subscription $24.95 /mo · $99.00/yr One-Time $149.00 one-time Best value Lifetime $299.00 one-time · Founding 100
Complete feature set
WHMCS installations 1 1 1
All four intake streams
Evidence vault & hash chain
Policy engine & action orchestrator
Client portal, roadmap & changelog
All adapters & integrations
Runs once the term ends While active Perpetually Perpetually
Updates While active 12 months For the life of the product
Support While active 12 months For the life of the product
Licence reissue on migration
Billed Monthly or yearly Once Once
Refund 30 days, defect 30 days, defect 30 days, defect

Requirements

WHMCS

8.13 or 9.0

PHP

8.2 – 8.3

ionCube Loader

13.3.1+ (14.4.1 recommended)

Database

MySQL 5.7+ or MariaDB 10.3+

Extensions

curl, openssl, json

Cron

WHMCS cron or a one-minute worker

Frequently asked questions

Can it suspend or terminate a customer automatically?
Suspension can be automated, but only if you deliberately configure it: the policy must list the action, the case must clear both a confidence and a severity threshold, the per-policy allow-auto-suspend switch must be on, the module-wide Automated Actions setting must be on and the kill switch must be clear — all of it re-checked at execution time. Termination cannot be automated at all. The termination action opens a high-priority review ticket and does nothing else; there is no code path in this module that calls a terminate API.
Which features ship switched off?
The three destructive or legally sensitive ones: retention enforcement, GDPR subject erasure and CSAM reporting are all dormant on installation and stay dormant until you arm them, with the arming itself written to the audit log. Until retention enforcement is enabled the sweep is a dry run that reports candidates and deletes nothing. The automatic action lists are also empty and the module-wide Automated Actions setting is off, so a fresh install is fully manual.
Does the CSAM workflow report to NCMEC for me?
No, and it is important that you know that before buying. It opens a preservation record, starts the preservation clock, engages a case-level legal hold that can never be released, tracks the human-driven state and assembles a data-only packet for a person to file by hand. It has no transmission code path and never sends anything to NCMEC or any other endpoint. The DMCA counter-notice service is the same shape: it records the workflow, it does not forward the notice or restore anything on your behalf.
Which integrations need my own credentials?
Proxmox, Cloudflare, AbuseIPDB, GitHub, GitLab, OpenProject, chat-ops, outbound webhooks, IMAP mailbox intake, Turnstile and AI triage are all inert until you supply your own token, key, endpoint or webhook URL. WHMCS tickets, module actions, notifications and the fraud-suite signal work with no credentials because they run through the local WHMCS API. Mailbox intake additionally needs the PHP imap extension.
Does it modify WHMCS core tables?
No. It creates 32 of its own tables and reaches WHMCS through the local API only. Deactivating the module preserves every table and all data; removing the schema is a separate maintenance action behind a typed confirmation phrase. Cases and the audit log export to CSV and JSON at any time.
Can an anonymous reporter discover whether one of my customers is under investigation?
No. The public status page returns the same neutral answer for a wrong reference, a wrong email and a reference that never existed, and it never shows the target. In the client area a case a customer does not own is reported as not found — identical to a case that never existed. Duplicate detection returns an existing reference only to the original reporter.
What happens if an integration or a remote service goes down?
Nothing user-visible. Adapter probes fail closed and hide the affected features, a failing outbound call trips a circuit breaker, queued tasks retry and then dead-letter with the failure recorded, and dashboard widgets degrade to an empty state. No screen in the module blocks on a remote service.
What happens if your licensing service is unreachable?
The module keeps working through a grace period and warns an administrator. An outage at our end must not take a paying customer’s abuse desk offline. The result of a successful check is cached locally, so it does not call out on every request.
Which ionCube package do I download?
The ic14 package in nearly all cases — it runs on ionCube Loader 13.3.1 and 14.4.1 and on both PHP 8.2 and 8.3. Take ic13 only if you are pinned to PHP 8.2 and cannot run an ic14 file; there is no ic13 build for PHP 8.3 at all. If your host reports Loader 14.4 rather than 14.4.1, you are almost certainly fine: ioncube_loader_version() returns major and minor only, so use ioncube_loader_iversion() for a patch-level check.
Do I have to expose a public form?
No. Public intake is a switch. Turn it off and the module runs as an internal desk fed by logged-in customers, by your admins and, optionally, by mailbox polling.

Recent updates

2.2.1Cosmetic fix to two admin panel headings; no schema, behaviour or licensing change.
2.2.0Commercial licence enforcement with a grace period; install identity now derived from the configured system URL rather than a request header; a build gate that refuses to encode an unstamped lane.
2.1.0Readable ionCube preflight on every entry point, a standalone diagnostic that runs with no WHMCS present, and a machine-enforced encoding boundary.
2.0.4WHMCS 9 compatibility: the addon upgrade callback now handles the null WHMCS 9 passes where 8.13 always passed an array.
2.0.3Case merge no longer loses a corroboration when two admins merge duplicates into the same case at the same moment.
2.0.2Adversarial release audit: closed a cross-tenant client access flaw, a plaintext-secret log path and a duplicate-detection oracle, and repaired four feature flags that had no write path.
30-day refund on a defect we cannot fixInstall it, point real reports at it and run real cases through the pipeline. If it does not do what this page says and we cannot resolve it for you, tell us within 30 days of purchase and we will refund you.

Choose your licence

Same complete module in every tier — the only difference is how you pay and how long updates & support last.

EVPS Abuse & Feedback Center - Lifetime Licence (Founding 100)

$299.00 USD/ onetime
Order now

EVPS Abuse & Feedback Center - One-Time Licence

$149.00 USD/ onetime
Order now

EVPS Abuse & Feedback Center - Subscription Licence

$24.95 USD/ monthly
Order now