Free Rotator Script guide

Installation

Easy browser installation

  1. Extract the official release ZIP into an empty domain root or subfolder on a PHP 8.1+ host.
  2. Immediately visit https://YOUR-DOMAIN/install.php in your browser.
  3. Review the server checks, then enter the site name, exact installation URL, contact and sender emails, giveaway ZIP filename, and a unique Admin username and password.
  4. Select Create site configuration. The installer hashes the password, safely creates config.php, starts email in log mode, and locks itself.
  5. Sign in at /admin/ with the username and password you chose.
  6. Upload the giveaway ZIP beside install.php using the filename entered during setup.
  7. Add at least two destinations, optionally add a banner, and preview /demo/.
  8. Submit a lead at /. In log mode, read the confirmation URL from storage/mail.log through your hosting file manager; then confirm, download, unsubscribe, and verify the Admin lead state.

No shell, terminal, or manual password hashing is required.

Important first-visitor rule

Run install.php immediately after uploading the package. Before config.php exists, the first visitor to the installer can create the Admin account. After successful setup it returns 404 and will not overwrite the configuration.

If the installer says the application folder is not writable, use the hosting file manager to allow PHP to create config.php, complete setup, then restore the provider’s recommended permissions.

Server protection

Never expose or commit config.php. Apache uses the included .htaccess protection in the root, storage/, and uploads/. For Nginx, add equivalent protection:

location ~ ^/(storage|config\.php) { deny all; return 404; }
location ~* /uploads/.*\.(php|phtml|phar)$ { deny all; }

Adjust these expressions for a subfolder. Direct requests for config.php, storage/*.json, MOD databases, and executable uploads must fail.

Manual and existing-installation mode

Advanced operators may create config.php from config.example.php. Existing installations can temporarily open a read-only environment check by setting enable_install to true, adding a private setup_token, and visiting /install.php?token=YOUR_TOKEN. Disable the flag and remove the token afterward. The installer never replaces an existing configuration.

Older installations inherit the Admin username admin unless admin_username is added explicitly.

Email delivery

The installer deliberately uses mail_mode => log. Switch to live mail only after SPF, DKIM, DMARC, and inbox delivery are verified. Broadcasts and sequences remain outside the free core; the optional Email Campaign Manager MOD provides owned campaign features.

MOD Manager

Connect Admin’s MOD Manager to Home Base, refresh the verification key and entitlements, then claim or purchase compatible MODs. Packages are checksum- and signature-verified before installation. The free Pro Captcha MOD is a useful first test.

Final review

Complete FRESH_DOMAIN_ACCEPTANCE.md and record the domain, version, artifact SHA-256, PHP version, and result.