v1.0 — live on GitHub · GPL-3.0 · no build step

Your agent should be writing routing the interface.

PlugPHP is a modular vanilla-PHP starter kit for cPanel and shared hosting. Routing, auth, the database layer, uploads, mail and an admin dashboard are already written and hardened — so the only thing left to build is the part people actually see.

Get PlugPHP See the 4-step install

git clone https://github.com/Bcp-Sambo/plugphp.git

public/install.php try the toggles

This is the real module picker. Flip one and watch the routes it registers.

Routes registered —

8 modules on 6 tables migrated 0 lines you had to write

PHP 8.0+ MySQL 5.7.8+ / MariaDB 10.2+ Apache + mod_rewrite No Composer step — vendor/ committed GPL-3.0

The problem

Every new site starts by paying an agent to rebuild the same login form you already paid for last month.

Leaving WordPress usually means giving up the thing that made it easy — a working installer, an admin panel, modules you switch on. PlugPHP keeps that feel, drops the 20 years of legacy, and runs on the cheapest plan you already have.

Routing and a front controllerAlready built
Login, sessions, password resets, CSRFAlready built
Database layer with prepared statementsAlready built
Image uploads, SMTP mail, settingsAlready built
Admin dashboard with CRUD for every moduleAlready built
The look, the layout, the brandYour agent

Clone to live

Four steps, and none of them are a build pipeline

No node_modules, no bundler, no Composer run. Download the ZIP and it works — vendor/ ships with the kit.

STEP 01

Get the code

Clone it, or grab the ZIP from GitHub. Nothing to compile.

git clone https://github.com/
Bcp-Sambo/plugphp.git

STEP 02

Point it at a database

Serve public/ locally, or upload to your host. No MySQL on your laptop? Create the database in cPanel and use that.

php -S 127.0.0.1:8000 -t public
   public/router.php

STEP 03

Run the browser installer

Open /install.php. It checks your environment, tests the connection, runs migrations, seeds demo content and creates your admin user. Then delete it.

rm public/install.php
# the step everyone skips

STEP 04

Hand it to your agent

Point the agent at SKILL.md. It styles the views that are already wired to real data — and leaves core/ alone.

> read SKILL.md, then design
   the blog index

What ships in the box

Eight modules in 1.0. Each one removable.

Every module owns its routes, migrations, views and its own SKILL.md. Turn one off and its routes are never registered — no dead links, no leftovers.

modules/blog

Blog

Posts with slugs, draft/publish visibility, and full admin CRUD at /admin/blog.

modules/services

Services

Structured service pages with detail routes, ready for pricing and schema markup.

modules/projects

Projects

A portfolio with case-study pages and a native JSON column for flexible metadata.

modules/contact-form

Contact form

Validated, CSRF-protected, stored to the database and delivered through Mailer::send().

modules/auth

Auth

modules/admin-dashboard

Admin dashboard

One control panel that every module plugs into. Your client edits content; nobody touches code.

modules/home · modules/about

Home & About

The two static pages every site starts with, seeded with demo content so nothing is blank on first run.

modules/your-idea

Write your own

A module is a folder: routes, migrations, views, a module class. Build one end to end →

Next off the bench

Not in 1.0

These are being built the same way everything above was — as modules you switch on, or leave off. No dates promised.

Media libraryOne place for every upload, reusable across modules.
Newsletter captureSignup forms with the subscriber list kept in your own database.
TestimonialsClient quotes with photos, approved in the admin before they show.
Form builderBuild a form in the dashboard; validation and CSRF come with it.
StorefrontProducts, cart, and a handoff to a hosted checkout.
AnalyticsPaste your Google Analytics ID into settings — no template edits.

Need one of these first? Say so in an issue — that's how the order gets decided.

Built for agents

A rulebook your agent reads before it types

Every kit has conventions. This one writes them down, in the repo, where the agent will actually look — root SKILL.md plus one per module.

Core is off limits

Auth, CSRF, database access and mail live in core/ and are marked read-only. An agent can't quietly reinvent a session handler at 2am.
Views ship unstyled on purpose

Semantic HTML wired to real data, waiting for a design. That's the whole job you hand over — and the whole budget you spend.
Secure and indexable by default

Prepared statements, escaped output, CSRF on every state-changing route, correct heading order and real alt text — enforced by the rules, not by review.

SKILL.md — the five hard rules

# Read this before doing anything else

1. No raw SQL outside core. Database::fetchAll()

2. No unescaped output. <?= e($post['title']) ?>

3. No hand-rolled sessions. Auth::requireLogin()

4. No mail(). Mailer::send()

5. Every POST starts with

Auth::requireCsrf($_POST['csrf_token'] ?? null);

# core/ is read-only. modules/*/views is yours.

Have a say

The roadmap is decided in the open

PlugPHP is built by one person, in public. What gets fixed and what gets built next comes out of what people ask for — so ask.

Something broke

Clone it and build something today

Free, GPL-3.0, and running on shared hosting in about the time it takes to make coffee. Bring a project — we want to see what your agent does with it.

Star it on GitHub Read the docs