PD Object Storage for WHMCS

PD Object Storage lets a hosting company sell S3-compatible object storage on Amazon S3, Cloudflare R2, DigitalOcean Spaces or your own MinIO server, in any mix, from one WHMCS module. Your customer orders in your WHMCS cart, a private bucket and a scoped access key are created at the backend you chose for that product, and your customer manages their storage from your client area. You set the price, the provider bills you for what is stored, and the difference is your margin.

It is built for hosts who want more than one storage offer: a premium Amazon S3 product next to a lower-cost Spaces plan, an EU-resident R2 product for customers who need it, or a self-hosted MinIO plan on their own hardware, without installing and learning a different module for each.

Why hosts choose PD Object Storage

One module, four backends. Amazon S3, Cloudflare R2, DigitalOcean Spaces and MinIO are all built in. Choose the backend per product, and run several side by side in one WHMCS. An Amazon S3 product and a Cloudflare R2 product can sit in the same cart, each connected to its own account.

One experience for your customers. Whatever sits behind the product, your customer gets the same client area: connection details, usage, buckets, share links and ready-made setups. Your team learns one module and your customers learn one screen.

Placement that cannot fail. The checkout offers only the locations that suit the backend: AWS regions, DigitalOcean datacenters or Cloudflare data locations, curated so a customer is never offered a choice that will fail. Cloudflare R2's EU-only choice is a hard data-residency boundary, which is what lets you promise it to customers.

Only what the backend can do. The module offers only the features a backend supports. Cloudflare R2 does not expose object versioning, so an R2 product simply does not show the Versioning option. Nothing appears that would not work.

Isolation the provider enforces. Each order gets its own bucket and its own scoped credential: an access key, a token or a user, depending on the backend. One customer's credential cannot reach another's data on any backend.

Nothing is deleted by accident. Terminating a service revokes access at once but keeps the data through a retention window you choose, and nothing is purged without your approval unless you switch on automatic purging.

How it works

1. Connect your backends. Add one WHMCS server per backend, holding that backend's credentials. The panel shows exactly which fields to fill for each, and Test Connection checks every account and proves it can issue customer credentials.
2. Create a product and pick its Backend. Choose Amazon S3, Cloudflare R2, DigitalOcean Spaces or MinIO. You can change it until the product has its first order.
3. Generate the options. One click builds the cart options for that backend: Storage Quota, Max Buckets, the right placement choice and, where the backend supports it, Versioning. You set the prices.
4. Your customer orders. The bucket and credential are created at that backend and the customer's storage page is ready.

What you get in WHMCS

Selling and pricing

• Storage Quota from 10 GB to 5 TB, or unlimited
• Placement tailored to the backend: Region for Amazon S3 (fifteen general-purpose regions) and DigitalOcean Spaces (twelve datacenters), Data Location for Cloudflare R2 (eight locations including EU-only)
• Show or hide any option per product; hidden options use the product's defaults
• Rebuilding the options keeps the choices existing customers already made
• Soft or hard quota mode per product
• Daily usage readings, from the backend's own API, written into WHMCS's disk-usage fields for native usage display and overage billing
• Upgrades and downgrades through WHMCS's normal flow, with data preserved

Provisioning you can trust

• Setup guidance that names the exact server fields for each backend, and a product with no backend selected is stopped with a clear message instead of being set up blind
• A failed check names the server and backend and says what permission to fix
• Works inside the provider account you already have, touching only what it creates
• Test Connection confirms the credential can issue customer keys, not merely read

Running it day to day

• Clients & Storage lists every service across all backends with its client, state, access mode, quota and usage
• Change a service to read and write, read-only or disabled without touching the customer's keys or data
• Suspend as read-only so customers can still download, or as disabled; unsuspending restores the previous access
• Keep terminated data for 7, 14, 30, 60 or 90 days, or delete it straight away; an immediate purge needs the bucket name typed
• A read-only reconcile compares each provider with WHMCS and flags orphans without deleting anything
• A health report, an activity log, and 80% and 100% quota emails you can switch off or copy to your administrators

What your customers get

• Connection details: endpoint, bucket, region, access key and secret key, in your client area
• Key rotation in one click: a new key pair is issued in seconds and the old one is deleted
• Their own buckets: create extra buckets up to their plan
• Automatic clean-up rules per bucket, and versioning where the backend supports it
• Cross-origin (CORS) rules for web apps
• Share links: expiring download or upload links, without sharing keys
• Usage against their quota, with a 30-day history
• Ready-made setups for the AWS CLI, rclone, s3cmd, Cyberduck and WinSCP, cPanel backups and WordPress backup plugins, plus SDK examples for developers

Bucket management, share links and storage settings are each a switch on the product. The pages render on WHMCS's Six, Twenty-One and Nexus themes and are fully translatable.

On Amazon S3 and MinIO, hard mode pauses uploads at 100% while downloads and deleting keep working. On DigitalOcean Spaces and Cloudflare R2, uploads are never paused: the customer is emailed at 80% and 100% and you see the overage. Downloads always work.

Security built in

• Your backend credentials stay on your WHMCS server, stored encrypted, and are used only for that backend's API calls.
• Customers never see or use your credential: they get their own scoped one.
• Terminating a service revokes the customer's key immediately.
• Nothing about your customers' data is sent to us: the module talks only to your backends and to the PD Modules licence check.
• Some providers cap credentials per account, and each service uses one. The setup notes tell you what to check.

One product, every feature

PD Object Storage is one paid module with all four backends and every feature included. There are no tiers to compare. If you sell only one backend, the single-provider modules offer the same engine focused on that provider. It installs into PD Modules in one click and updates itself.

If your subscription ever lapses, nothing is deleted. You get a 14-day grace period with everything working, then admin management locks while customers keep their storage, and only after that do customer features pause, behind a neutral message that never mentions licensing.

Requirements

• WHMCS 9 or later on PHP 8.2 or later, with the ionCube Loader
• An account at each backend you sell: Amazon S3 (IAM access key), Cloudflare R2 (account ID and API token), DigitalOcean Spaces (personal access token) or your own MinIO server (admin key)
• PD Modules, the free control panel every PD module installs into