Request Flow

Every request hits index.php. That's the only PHP file nginx allows to execute — everything else returns 404. From there:

Browser → nginx → index.php
  ├── POST/GET form?  → app/controler/request.php
  └── Clean URL?      → app/controler/start.php → match slug → page

Routing

URLs are mapped to page templates via slug constants in class/config.php:

define('PAGE_00_SLUG','home');   // → /home
define('PAGE_01_SLUG','about');  // → /about
define('PAGE_02_SLUG','start');  // → /start

Add a new page: define the slug in config, add menu text in lng/{lang}/menu.php, create the template in lng/{lang}/{slug}.phtml. Done.

Languages

Multi-language support is file-based. Each language gets its own directory under lng/ with a menu.php (navigation text + error messages) and .phtml templates for each page. Browser Accept-Language header auto-detects the language. Users can switch via the nav dropdown.

Security (no config required)

• nginx blocks all .php except index.php
• Session cookies: httponly, SameSite=Lax, strict_mode
• Input sanitized via FILTER_SANITIZE_FULL_SPECIAL_CHARS
• Bot detection: 30+ UA patterns + browser heuristic bypass
• Rate limiting: blocks at 5 req/s per session
• Path traversal protection via basename()