A client is an account that is billed: it has a name and address, a currency, services, domains, invoices and tickets. A user is a person who signs in with an email address and a password. One account can have several users, and one user can work in several accounts. This chapter covers the Clients menu in the admin area: finding clients, the client page and its tabs, adding a client, the account flags, Manage Users, signing in as a client, password resets and email confirmation, client groups and custom fields, marketing consent, the search box and banned addresses.
Clients > View/Search Clients
/admin/clients lists every client, newest first, with the number, name, company, email address, country, group (with its colour), status and the sign-up date. Click the number or the name to open the client. The number of records per page follows Records per page in General Settings.
Filters
The search form at the top has four quick filters:
| Filter | What it matches |
|---|---|
| Name, company, email, phone or number | Text found in the first and last name, the company, the email address or the phone number. A number on its own opens the client with that number. |
| Status | Active, Inactive or Closed. |
| Group | A client group, or "No group". Shown when groups exist. |
| Country | The client's country. |
More search options
"More search options" opens the advanced filters. It stays open when one of them is in use.
| Filter | What it matches |
|---|---|
| Email address, Phone, Company, City, State/region, Postcode, Tax number | Text found in that field. |
| Sign-up IP address | The address the client registered from. |
| Has | Active services, Unpaid invoices (unpaid, payment pending or in collections), Overdue invoices (unpaid or in collections and past the due date), Account credit (a credit balance above zero), Domains, or No services at all. |
| Uses the product | Clients with an active or suspended service of that product. |
| Currency | The account's currency. Shown when more than one currency exists. |
| Marketing email | Agreed or Not agreed to marketing email. |
| Signed up from, Signed up to | The sign-up date range. |
Search runs the filters; Clear removes them. The count of matches is shown next to the buttons. The Mass Message button at the top becomes "Message These Clients" while a search is active and carries the same filters to the mass message page (see Email). Add New Client is also here.
The client page
Opening a client shows the name, company, status badge and group at the top, with three buttons: Create Invoice, Add New Order and Sign in as Client (none of them for a closed account). Under that is a row of tabs. A tab is shown only to staff whose role allows its records.
| Tab | Address | What it holds |
|---|---|---|
| Summary | /admin/clients/ID | Overview, actions, notes pinned to the top, recent activity, kept payment methods. |
| Profile | /admin/clients/ID/profile | Every detail and flag of the account, editable. |
| Contacts | /admin/clients/ID/contacts | People who receive copies of chosen emails. |
| Products/Services | /admin/clients/ID/services | The account's services with product, domain, billing term, amount, next due date and status. Add New Order. |
| Domains | /admin/clients/ID/domains | Domains with registrar, registration and expiry dates, next due date and status. |
| Orders | /admin/clients/ID/orders | Orders with date, amount, invoice status and order status. "Open full list" goes to Orders filtered to this client. |
| Billable Items | /admin/clients/ID/billables | Billable items with quantity, amount, when they are invoiced and the due date. Add Billable Item. |
| Invoices | /admin/clients/ID/invoices | Invoices (up to 500) with dates, total, payment method and status. Create Invoice; "Open full list". |
| Quotes | /admin/clients/ID/quotes | Quotes with subject, dates, total and stage. Create Quote. |
| Transactions | /admin/clients/ID/transactions | Payments and refunds (up to 500) with payment method, reference, invoice, amounts in and out and fees. Add Payment; "Open full list". |
| Users | /admin/clients/ID/users | The people who can sign in to the account, and waiting invitations. |
| Notes | /admin/clients/ID/notes | Staff notes about the client. |
| Files | /admin/clients/ID/files | Files kept with the account. |
| Emails | /admin/clients/ID/emails | Every email sent to the account, with links to the log. |
| Log | /admin/clients/ID/log | The activity log entries about this client: date, who, description, IP address. |
Each row in a record tab links to the record's own page. Tickets have no tab of their own; the summary shows how many the client has, and Support > Support Tickets lists them.
Summary
Three cards:
- Client information: number, email address (as a mail link), phone, address, tax number (named after the Tax ID label in Tax Configuration) and every custom client field that has a value. Password fields show dots; tick boxes show Yes.
- Account: the owner (the user who created or owns the account, with badges for two-step sign-in and an unconfirmed email address), the number of users and contacts, the currency, the credit balance with a Manage link (
/admin/clients/ID/credit, see Billing), client since, last sign-in, the sign-up address, whether marketing email was agreed to, and the affiliate account or the affiliate who brought the client in. - Products and billing: how many services, domains, invoices, orders, quotes, tickets and transactions the account has. Orders, invoices and transactions link to their lists filtered to this client.
Notes marked "Show it at the top of the client summary" appear as yellow alerts under the cards, with the author and date.
The Actions card has:
| Action | What it does |
|---|---|
| Send Email | Opens the page to send a template or write a message (see Email). |
| Email the Owner a Password Reset Link | Emails the owner a link to choose a new password. The link works for 24 hours. |
| Account status, Set | Active, Inactive or Closed (no sign-in). Closing the account ends every client-area session that was working in it. |
| Export Data | Downloads everything stored about the client as a JSON file: the account, custom fields (passwords hidden), users, contacts, marketing consent records, emails and activity. For data requests. |
| Delete Client | Deletes the account for good. Only possible when it holds no services, domains, invoices, orders, quotes, tickets or transactions; otherwise close it instead. Users stay; the client's notes, files, contacts, invitations and consent records go, and its emails in the log lose their link to the client. |
Recent activity shows the last eight log entries with a link to the full log. Kept payment methods (cards kept through a gateway) are listed with brand, last four digits, expiry and a Default badge; Remove deletes the stored reference so automatic charges stop until the client adds another.
Profile
The Profile tab is one form:
- Details: first and last name, company (optional), email address, street address, second address line (optional), city, state or region (optional), postcode (optional), country, phone number and tax number (optional). The email address here is the account's address, where its emails go; it is separate from the address a user signs in with (see Manage Users).
- More details: the custom client fields, including staff-only ones.
- Account settings: client group, currency (locked once the client has invoices), status, payment method, billing contact, language (when more than one language is installed) and the flags below.
- Emails the client receives: one tick box per kind of email (general, invoices and payments, services, domains, support tickets, affiliate programme). Emails about signing in and passwords are always sent.
Saving writes which fields changed to the activity log. Setting the status to Closed ends the client's sessions.
Client flags
| Flag | What it does |
|---|---|
| Payment method | The gateway new invoices for this client are made with. "Use the default" takes the usual one. |
| Billing contact | Invoices are addressed to this contact and emailed to them as well as to the account. "The account holder" turns it off. Deleting the contact turns it off too. |
| Exempt from tax | No tax is charged on the client's invoices. |
| No late fees | The late fee run skips this client. |
| No overdue notices | The three overdue notices are not sent to this client. |
| A separate invoice for each service | Renewals due on the same day get one invoice each instead of being put on one invoice. A client group can set this for all its members. |
| Do not charge saved payment methods automatically | Kept cards are not charged by the capture run. The client pays by hand. |
| Never close this account automatically | Stored with the account, but no automatic process acts on it yet. |
| Allow one-click sign-in to services | Stored with the account, but not checked yet: the control panel button on a service follows the user's permission "Sign in to services". |
| Agreed to marketing email | The marketing consent (see below). |
| Status | Active: normal. Inactive: the account is kept but is not in use; the client can still sign in. Closed: the client cannot sign in to the account and staff cannot sign in as them; nothing can be ordered or invoiced for it. |
The automation setting "Client status follows their products" (Off, Inactive when no active product, or Inactive when no active product and no sign-in for 90 days) is listed in Automation Settings but is not carried out by any task yet; the status changes only when staff change it.
Contacts
A contact is a person attached to the account who cannot sign in but can receive copies of chosen emails: an accounts team that needs the invoices, for example. Add Contact asks for the same details as a client (only the name and email address are required) and a tick box per kind of email to copy. The list shows each contact's name, company, email, phone and the kinds they receive. Delete removes the contact; if it was the billing contact, the account goes back to "The account holder".
Users
See Manage Users below for what a user is. The Users tab lists the people who can sign in to this account with their email address, name, owner and disabled badges, what they may do and their last sign-in in this account. For a user who is not the owner, "N of 14, change" opens the permission tick boxes; Save applies them. The buttons on the right:
| Button | What it does |
|---|---|
| Reset Link | Emails that user a password reset link (24 hours). |
| Make Owner | Makes this user the owner. The old owner keeps access with every permission. |
| Remove | Takes the user's access to this account away. Their sign-in and their other accounts stay. |
Waiting invitations are listed with their expiry; Cancel withdraws one. "Give someone access" takes an email address and a set of permissions (See services, See domains, See and pay invoices and Use support tickets are ticked to start with). Someone who already has a sign-in gets access at once; anyone else is emailed an invitation that works for 7 days.
Notes
Staff notes about the client. A note can be pinned ("Show it at the top of the client summary"). Each note shows who wrote it and when, and when it was changed. Staff with the notes permission can edit a note in place; deleting needs its own permission. Notes are up to 20,000 characters.
Files
Upload a file (up to 20 MB) with a title. "Staff only" (ticked by default) keeps it from the client; untick it to let the client download it under Account Details in the client area. Files are stored under storage/files with random names and are served only through CoreInto. The list shows title, file name, date added and who can see it; Delete removes the file.
Emails and Log
Emails lists every email sent to the account with date, subject, recipient and status; the subject opens the entry in the Email Message Log. Log lists the account's activity entries: sign-ins, changes by staff and by the client, orders, payments and so on, with the IP address.
Clients > Add New Client
/admin/clients/new has three parts:
- Details: the same fields as the Profile tab. First name, last name, email address, street address, city, country and phone are required; company, second address line, state, postcode and tax number are optional.
- Account:
- Password (optional). Leave it empty to email the client a link to choose one (the link works for 7 days). If the email address already has a sign-in, that user becomes the owner of the new account and keeps their own password; no reset link is sent.
- Client group.
- Currency. The list has every currency; when Settings > Currencies has "Currency by country" set up, the first choice is "Automatic, by country": the client gets the local currency when their country is the home country, otherwise the currency for other countries. The currency cannot be changed once the client has invoices.
- Status: Active or Inactive.
- Send the welcome email: sends
client_signup(and the password link when no password was typed). - The client agreed to receive marketing email.
- More details: the custom client fields.
The new client is written to the activity log and opened. Staff-added clients have no sign-up address.
Manage Users
Clients > Manage Users (/admin/users) lists every person who can sign in to the client area: email address, name, how many accounts they can use, security badges (two-step, email not confirmed) and last sign-in. Search by name or email address.
Users and client accounts are kept apart on purpose:
- A user signs in with an email address and password, may have two-step sign-in and a security question, and has a language.
- A client account is what is billed. Every account has one owner (a user) who may do everything in it. Other users are given a set of permissions on the account.
- One user can be the owner of one account and an invited user of another. When a user signs in and has more than one account, they choose which one to work in; they can switch later.
A user's page
/admin/users/ID shows and edits the user's first name, last name and the email address they sign in with. Changing the address marks it as not confirmed and emails the old address that it was changed. The Security card shows whether the address is confirmed, whether two-step sign-in is on, the last sign-in with its address, and when the user was created. Buttons:
| Button | What it does |
|---|---|
| Email a Password Reset Link | Sends password_reset; the link works for 24 hours. |
| Mark Email as Confirmed | Marks the address confirmed without the link, for example after checking by phone. |
| Turn Off Two-Step | Removes the authenticator and the recovery codes, and ends all the user's sessions. For a user who lost their phone. |
| Sign Out Everywhere | Ends every session of this user. |
| Disable / Enable | A disabled user cannot sign in; their sessions end at once. |
| Delete | Removes the user and their access to accounts; the accounts stay. A user who owns an account cannot be deleted: make someone else the owner first. |
When the user has set a security question (Security Settings in the client area, with the questions from Settings > Security Questions), the page shows the question with a box to type an answer and Check Answer, which says whether the answer is right and records the check in the activity log. The answer itself is never shown.
Accounts lists every account the user can use, with Owner or the number of permissions, and the last sign-in in each.
Permissions a user can have on an account
| Permission | Lets the user |
|---|---|
| Change the account's details | Edit Account Details. |
| Manage contacts | Add, change and delete contacts. |
| See services | Open My Services and the service pages. |
| Manage services | Change passwords, request cancellation, upgrade and downgrade, reissue licences. |
| Sign in to services | Use the control panel sign-in button. |
| See domains | Open My Domains and the domain pages. |
| Manage domains | Change nameservers, lock, contacts, auto-renew, ask for the transfer code, renew. |
| See and pay invoices | Open invoices, pay them, add funds, manage payment methods. |
| See and accept quotes | Open and accept quotes. |
| Use support tickets | Open and reply to tickets. |
| Use the affiliate programme | Open the Affiliates page. |
| See emails sent | Open Email History. |
| Place orders | Check out with this account. |
| Invite and manage other users | Open User Management. |
The owner has every permission. A user with "Invite and manage other users" can only hand out permissions they hold themselves.
Invitations
An invitation is sent by email (template user_invite) when the person has no sign-in yet. The link works for 7 days; only a hash of it is stored. Opening the link shows the account's name. Someone who is signed in accepts with one click; someone whose address already has a sign-in is asked to sign in first and open the link again; anyone else types their name and a password, and the new sign-in is made with the address already confirmed (the link proved they read the mailbox). Accepting puts them straight into the account.
Sign in as client
On a client's summary, Sign in as Client opens the client area in the same browser as the account's owner. The session remembers which staff member did this: the client area shows a bar "You are signed in as this client by a staff member", nothing is recorded as the client's own sign-in, and the staff member cannot change the user's sign-in settings (password, email address, two-step, security question) under Security Settings. A closed account, or one without an owner, cannot be opened this way. The action needs the permission "sign in as client" and is written to the activity log.
Password reset
Staff send a reset link from the client summary (to the owner), from the Users tab (to any user of the account) or from the user's page. The link works for 24 hours. A user asks for one themselves with "Forgotten your password?" on the sign-in page; that link works for one hour, and the page says the same whether or not the address exists. In both cases:
- Only a hash of the link is stored, and it works once.
- Choosing the new password ends every other session of the user, clears their failed sign-in count, marks the email address confirmed (the link proved they read the mailbox) and emails
password_changed.
Passwords must reach the "Least password strength" set in General Settings, Security.
Email verification
With "Ask new users to confirm their email address" on (General Settings, Security), a new user gets email_verify with a link that works for 48 hours. Until they use it, the client area shows a bar asking them to confirm, with "Send it again". Changing the sign-in address starts the check again. Staff see "email not confirmed" badges on the client summary and in Manage Users, and can mark the address confirmed by hand on the user's page. Nothing is blocked while an address is unconfirmed.
Settings > Client Groups
/admin/settings/client-groups groups clients for display and for a few billing rules. Each group has:
| Field | What it does |
|---|---|
| Name | Shown as a badge on the client's page and in the clients list. |
| Colour | The dot shown with the name. |
| Discount % | Taken off the prices of products and add-ons in new orders by members of the group. The product must allow group discounts. |
| Never suspend or close automatically | The automatic suspension run skips the services of members; their overdue invoices still get reminders and late fees. |
| Separate invoices | Each service of a member gets its own renewal invoice, as the client flag does. |
The list shows the number of clients in each group. Deleting a group leaves its clients with no group.
Settings > Custom Client Fields
/admin/settings/custom-fields adds fields to every client account. (The same page, reached from a product or an add-on, holds that product's or add-on's custom fields; see Catalogue.)
| Field | What it does |
|---|---|
| Name | The label. |
| Type | Text, Link (web address), Password, Dropdown, Tick box or Text area. Password values are stored encrypted and shown to staff as dots. |
| Help text | Shown under the field, and used as the error message when the pattern does not match. |
| Pattern the value must match | A regular expression, for example ^[0-9]{5}-[0-9]{7}-[0-9]$ for a national identity number. Optional. |
| Choices | For a dropdown, one per line. |
| Order | The position among the fields. |
| Required | The field must be filled in. A staff-only field cannot be required, since clients do not see it. |
| Staff only (clients do not see it) | Shown on the admin pages only. |
| Ask at sign-up and checkout | Shown on the registration form and at checkout for new clients, and under Account Details. |
| Print on invoices | The value is printed on the client's invoices. |
The edit page says how many values are stored in the field. Delete Field removes the field and every value.
Marketing opt-in
With "Ask clients to agree to marketing email" on (General Settings, Security), the registration form, the checkout for new clients and Account Details show a tick box with the "Marketing consent text". Every change of the answer is recorded with the date, the IP address and whether staff made it; the records are part of the client's data export. Staff set the answer on the Add New Client form ("The client agreed to receive marketing email") and the Profile tab ("Agreed to marketing email"); the summary shows Agreed or No.
What the consent controls: mass messages with "Only clients who agreed to marketing email" ticked go to these clients only, and Email Marketer rules marked as marketing are sent to them only. Service emails, invoices and ticket replies do not depend on it. Settings > Marketing Consent is listed in the Settings index but is not built yet.
The search box
The admin area has a search box in the top bar on every page. Typing a name, company, email address, phone number or client number and pressing Enter opens /admin/search, which lists the matching clients (up to 25, with email and status) and the matching users (up to 25). Two or more characters, or a number, are needed. The page notes that invoices, services, domains and tickets will be searchable here as well; today each of those has its own list with filters.
Client IP bans
Settings > Banned IPs (/admin/settings/banned-ips) lists the addresses that may not sign in. Bans come from two places:
- By hand: type an address (
203.0.113.7) or a range (203.0.113.0/24,203.0.113.*,2001:db8::/32), a reason and how long (1 hour, 1 day, 1 week, 30 days or permanently) and press Ban. Banning a range that is banned already replaces the old ban. You cannot ban your own address; the page shows it. - Automatically: after the number of failed sign-ins set in General Settings, Security ("Failed sign-ins before a ban"), the address is banned for "Minutes an address is banned after failed sign-ins". Addresses listed under "Addresses never banned" are left alone.
An order's page also has Ban IP, which bans the address the order was placed from permanently with the order number as the reason (see Orders).
A banned address cannot sign in to the client area or the admin area, cannot ask for a password reset, and cannot send the contact form or open a ticket as a guest. The list shows the address, reason, when it was banned and until when (or Permanent); search by address or reason. Lift Ban removes a ban and also clears the failed sign-ins that caused it. Banning and lifting are written to the activity log.