🚀 CP-Register

The Ultimate, Database-Free cPanel/WHM Registration Portal

Developed by Andy Goldau | © 2026 PanelLayer (Subdomain LTD) & GoMaKe UG

📦 Product Page: CP-Register  |  🧪 Live Demo: Demo  |  🌐 Project: PanelLayer

---

CP-Register is an incredibly robust, secure, and fully-featured self-service registration portal built specifically for cPanel & WHM. Designed from the ground up for maximum security, beautiful UI/UX, and GDPR compliance, it requires zero database setup (100% flat-file logic) and handles user creation flawlessly through the native WHM API 1 (/json-api/createacct).

DISCLAIMER: This software is provided "as is" without any warranty of any kind. CP-Register is an independent software solution and is not affiliated with, endorsed by, or sponsored by cPanel, L.L.C. or its affiliates.

---

✨ Enterprise-Grade Features

🛡️ Unrivaled Security & Privacy

• k-Anonymity Password Checks: Integrates the Have I Been Pwned API directly in the client's browser using the Web Crypto API. Only the first 5 characters of a SHA-1 hash are transmitted—your plaintext password never leaves your browser.
• Advanced Rate-Limiting (Token Bucket): Fully protects the WHM API against brute-force and DDoS spam attacks using a highly efficient, session-independent Token Bucket algorithm based on cryptographically hashed IPs.
• No Database Required: Works strictly with local flat files (JSON/PHP). All sensitive log files (audit.log.php, used_codes.php) are completely locked down and unreadable from the web, regardless of whether your webserver is Apache, LiteSpeed, or NGINX.
• Strict Content Security Policy (CSP): Ships with hardened HTTP response headers (CSP, HSTS, X-Frame-Options) out of the box, mitigating XSS and iframe-injection attacks.

🌐 Internationalization & UX

• 38 Supported Languages: Comes fully translated into 38 languages including full RTL support for Arabic and Hebrew.
• Responsive Dark/Light Mode: Automatically adjusts its premium UI to the system preferences of your users.
• Live Password Checklist: A real-time, side-by-side interactive UI element that instantly visually validates password complexity requirements.
• Fail-open DNS MX Checks: Automatically verifies the existence of mail servers (MX records) for the email domains entered during registration to prevent bot signups, featuring built-in caching.

🤖 Ultimate Anti-Bot Protection

Forget spam. We support natively integrated setups for:

• hCaptcha
• reCAPTCHA (Google)
• Cloudflare Turnstile
• Altcha (Proof-of-Work, 100% GDPR compliant)
• MTCaptcha

🎟️ Exclusive Access Modes

• Invite-Only Mode: Optionally lock your registration portal so only users with pre-generated, single-use, or multi-use invitation codes can join your platform.

---

🔌 cPanel/WHM API Integration

CP-Register uses the official WHM API 1 to create hosting accounts:

• Endpoint: GET https://your-server:2087/json-api/createacct?api.version=1
• Authentication: Authorization: whm <username>:<api_token> header
• No password storage: Only API tokens are used (never the WHM root password)
• Parameters sent: username, domain, password, contactemail, plan, cpmod, featurelist, locale, dkim, spf, hasshell, cgi, quota, owner, mxcheck, ip, send_invite

WHM Username Rules (enforced by CP-Register):

• 3–16 lowercase alphanumeric characters (a-z, 0-9)
• Must not start with a digit (0–9)
• Must not start with test
• Must not end with assword

---

🚀 Installation & Setup

1. Upload & Extract: Upload the contents to any PHP 8.x web directory (does not need to be on the cPanel server itself—any server with internet access to WHM port 2087 works).
2. Create a WHM API Token:
   • Log in to WHM
   • Go to Development → Manage API Tokens
   • Click Generate Token, give it a name (e.g. cp-register)
   • Ensure it has the create-acct permission (or select "Everything")
   • Copy the generated token secret
3. Configure: Open config.php and enter your:
   • CP_HOST – your WHM server hostname (e.g. https://your-server.example.com)
   • CP_PORT – WHM HTTPS port (default: 2087)
   • CP_ADMIN_USER – your WHM username (e.g. root or a reseller)
   • CP_API_TOKEN – the API token secret from step 2
   • CP_DEFAULT_PLAN – an existing package name defined in WHM
   • Desired Captcha Provider Keys
   • Security toggles (HIBP, Invite-Mode, Audit Logging)
4. Generate a Salt: Replace the default LOG_IP_SALT in config.php with a random 32-character string for GDPR-compliant IP pseudonymization in audit logs:

   openssl rand -hex 16

5. Done: The system automatically creates and protects the necessary data/ and logs/ folders upon the first registration.

---

📄 License & Attribution

This project is licensed under the MIT License.

Developer: Andy Goldau
Copyright: © 2026 CP-Register by PanelLayer, a brand of Subdomain LTD and managed on behalf of GoMaKe UG. All rights reserved.
Product Page: https://cp-register.panellayer.com/
Live Demo: https://demo.cp-register.panellayer.com/
Project: https://panellayer.com/

The above copyright notice, the developer attribution, and the permission notice must be included in all copies or substantial portions of the Software.