Plain technology that runs on your own hosting
The stack, and why
Every choice here traded novelty for the ability to run on a €4 hosting plan.
Statically exported frontend
Pages ship as flat HTML and come to life in the browser. Nothing waits on a render server, and a CDN can hold the whole site.
Pure PHP and PDO
There is no framework to keep current and no Composer step at install. Every database query uses prepared statements, without exception.
HMAC-signed licence calls
Master Hub requests are signed over the method, the route, a timestamp and a body hash. Anything that fails to check out is refused.
No Node runtime in production
The build produces static files. The server needs PHP and MySQL, and nothing else has to keep running in the background.
Signed payment webhooks
Each payment callback carries a token for that one order, compared in a timing-safe way. An unsigned call cannot fulfil an order.
Safe file uploads
Uploads get random names in folders that refuse to run scripts. The real file type is read from the bytes, not trusted from the browser.
Why we chose this technology
Server-rendered pages need a process alive to answer every request. On shared hosting, that means a Node process you must watch, or a platform fee on top of your licence.
Exporting to static HTML removes that. The frontend is just files, and the only moving part is the PHP API it calls. Static files are also easy for a content delivery network to hold.
Why plain PHP
A framework would add an install step, a tree of dependencies and constant upgrades. Customers deploy this software by unzipping it. Plain PHP with PDO has none of that weight, and every host that supports WordPress supports it. That includes the shared hosting a web design agency sells with a website.
Security choices worth naming
Passwords use a one-way hash and can never be recovered. Payment webhooks carry a token for each order, compared in a timing-safe way, so an unsigned call cannot fulfil an order.
Anonymous uploads get random names in folders that refuse to run scripts. The real file type is read from the bytes rather than trusted from the browser. Small choices like these keep a shared hosting plan safe to use.
Easy to set up
Upload the ZIP, unzip it and open the installer in your browser. You do not need SSH or Composer. To see what each site pack covers, compare the site packs.
Key takeaways
- The technology is PHP, MySQL and static HTML.
- It runs on ordinary shared hosting.
- Licence calls and payment webhooks are signed.
- Setup needs no SSH and no Composer.
Frequently asked questions
Will it run on shared hosting?
Yes. The technology was chosen for that limit, and the whole design was built around it.
Do I need SSH or Composer?
No. Upload the ZIP, unzip it and open the installer in a browser.
What hosting do I need?
PHP 8.1 or newer and MySQL 5.7 or newer. If your host runs WordPress, it runs PABAA.
What security measures are in place?
Passwords use a one-way hash, every query uses prepared statements, and licence calls are signed with HMAC.
Can I use my own licence server?
Yes. The Master Hub can point at your own endpoint if you run your own licensing setup.
Check it against your hosting
PHP 8.1 and MySQL 5.7 are the floor. If your host runs WordPress, it runs PABAA.