HisarBlok · documentation
Features
What comes in the box with HisarBlok as of version 0.2.0. It is all part of the same core; whatever you do not want, you switch off per site with one button.
Installation 0.2.0 release note
Version 0.2.0 · AGPL-3.0-or-later · Source code and a download package coming soon
Publishing
Static output
The moment you save, the affected pages are written to disk as plain HTML, along with pre-compressed copies. A visitor's request runs no code.
One visitor door
Dynamic work such as forms, comments, forum posts and member sign-in goes through go.php and get.php only: rate limits, tokens bound to the page, no visitor session.
Languages and SEO
Language versions are linked: hreflang and x-default, a language switcher, XML sitemap, RSS, OpenGraph fields, 301 redirects and a 404 page that matches the theme.
Modules
A module that is off does not run and its generated files leave the site; its data is kept. Core's own modules use the same interface as a module written by anyone else.
Content
Pages built from blocks or written in Markdown; a blog with tags and pagination; a media library (re-encoding, WebP); menus; announcements; download pages with counted links.
Engagement
A form builder, comments, on-site search, a forum and members (sign-up, sign-in, password reset, two-factor authentication). Each is switched on per site.
Importers
Content from WordPress, Joomla, Drupal, Ghost, Blogger and Disqus; forums from phpBB, MyBB, SMF, vBulletin and XenForo. Old addresses are redirected to their new places with 301.
Themes
Two themes
The redesigned default theme (type scale, CSS-only mobile menu, dark mode, print, reduced motion, visible focus) and Studio, for software product sites. This site runs on Studio.
Themes extend themes
A theme builds on another with "extends" in its theme.json and ships only the templates it changes.
Templates without a database
A template receives only the view model prepared for it and cannot write a query. Colours and sizes change through --hb-* variables.
Administration
Setup wizard
Locked by a code on the server, checks with a real request that data/ is not reachable from the web, and disappears completely once installation is done. The same can be done from the command line.
Backup and restore
Single-file backups with a SHA-256 for every file; the newest 14 are kept. Restoring happens only on the server, after every checksum is verified and the current state is backed up.
Dashboard
Real numbers per module, what needs you, the last full rebuild, a first-steps checklist and a site-health card (PHP, extensions, permissions, where data/ lives, the last backup).
Lists without load
Every long admin list, from the audit log and pages to members and form entries, pages by key on its own index; the audit log gains action and user filters.
Security
Accounts
Argon2id password hashes, two-factor authentication, a login rate limit and an audit log that answers who did what.
The panel
A nonce-based Content Security Policy, a CSRF token on every form, capability-based permissions.
Visitor input
Everything a visitor sends is escaped or sanitized; raw HTML does not pass, and javascript: and data: links are refused.