Email Templates and Variables

Extendy GeoShield uses WHMCS General email templates and WHMCS SendEmail for login security alerts.

The addon does not generate arbitrary email bodies at send time. It ensures the required WHMCS template records exist, then passes custom variables to WHMCS SendEmail.

Template model

Extendy GeoShield currently uses two WHMCS General email templates:

Extendy GeoShield - Login Alert
Extendy GeoShield - Smart New Country Alert

The addon creates missing template records automatically during addon activation and from the addon admin output path.

If a template already exists, Extendy GeoShield does not duplicate it and does not overwrite its existing content.

The created templates are WHMCS general templates in the master/default language row.

Template purpose

Template	Purpose
Extendy GeoShield - Login Alert	Normal login security alert, including Unknown country / country-detection failure alerts when configured
Extendy GeoShield - Smart New Country Alert	Smart Mode new-country alert when the detected country is new for the WHMCS User and Client Account context

The Smart template can include trust_country_url when the event is eligible for a Smart Mode trust link.

The normal login alert does not receive a trust link.

Editing templates

The templates are WHMCS email template records. Administrators may review and edit them through the WHMCS Email Templates interface.

Keep these constraints in mind:

• do not remove variables that your alert workflow depends on;
• do not add provider credentials, API tokens, raw provider responses, request headers, cookies, sessions, or database credentials;
• do not configure copied recipients for Extendy GeoShield alert templates unless you intentionally want the addon to skip sending those alerts;
• keep the template names unchanged unless the addon code is changed accordingly.

Extendy GeoShield checks the selected alert template before sending. If copied recipients are configured on an Extendy GeoShield alert template, the addon skips sending and records a safe reason.

Variables

Extendy GeoShield passes these custom variables to WHMCS SendEmail.

Variable	Meaning	May be unknown or empty
client_name	Client display name from the WHMCS Client Profile, using company name when available, otherwise first/last name, otherwise Client	No fallback is provided as Client
client_email	Primary WHMCS Client Profile email address from tblclients.email	Send is skipped if a valid primary email is not available
user_email	WHMCS User email address that performed the login	Yes, can be Unknown if unavailable
login_ip	Resolved public client IP address stored on the login event	Yes, can be Unknown
login_country	GeoIP country name stored on the login event	Yes, can be Unknown Country
login_country_code	GeoIP country code stored on the login event	Yes, can be UNKNOWN
login_time	Stored login event timestamp	Yes, can be Unknown
login_provider	GeoIP provider stored on the login event	Yes, can be Unknown
alert_mode	Alert mode stored on the login event	Yes, can be Unknown
trust_country_url	Smart Mode trust URL for eligible Smart New Country alerts	Yes, empty for normal alerts and ineligible events
support_url	WHMCS support ticket URL based on the WHMCS System URL	Yes, can be empty if System URL is unavailable

The WHMCS User email and Client Profile email are different concepts:

• client_email is the email recipient context for the Client Account.
• user_email is the WHMCS User that performed the login.

Default template content

When Extendy GeoShield creates the templates, the default content includes a concise login summary:

• Client Profile email.
• Login user email.
• Login IP.
• Country and country code.
• Login time.
• GeoIP provider.
• Alert mode.
• Support URL.

The Smart New Country template also includes conditional trust-link text using trust_country_url.

If trust_country_url is empty, the default Smart template states that the trust-country action is not available for that alert.

Unknown values

Some fields can be unknown because of the deployment environment, IP source settings, provider configuration, or country-detection outcome.

Examples:

• login_ip = Unknown
• login_country = Unknown Country
• login_country_code = UNKNOWN
• login_provider = Unknown

Unknown values do not automatically mean the login is malicious. They mean the addon could not populate that specific value for the event.

Language behaviour

The addon creates the master/default WHMCS template rows only.

It does not currently create separate Arabic, translated, or per-client-language template rows.

If your organisation needs localised email content, review how your WHMCS installation handles translated email templates and manage those template rows in WHMCS. Extendy GeoShield does not add a separate email-language selection layer.

Safety notes

Email templates should never include:

• provider credentials;
• API tokens;
• database credentials;
• raw provider responses;
• raw trust token hashes;
• cookies, sessions, or request headers;
• debug dumps.

The visible trust link, when present, is intended for the recipient to use. Do not publish example links with real token values in tickets, screenshots, or documentation.

For the alert send rules, see Email Alerts.