🚀 CW-Register

The Ultimate, Database-Free Control Web Panel Registration Portal

Developed by Andy Goldau | © 2026 PanelLayer (Subdomain LTD) & GoMaKe UG

📦 Product Page: CW-Register  |  🧪 Live Demo: Demo  |  🌐 Project: PanelLayer

---

CW-Register is an incredibly robust, secure, and fully-featured self-service registration portal built specifically for Control Web Panel (CWP). Designed from the ground up for maximum security, beautiful UI/UX, and GDPR compliance, it requires zero database setup (100% flat-file logic) and handles user creation flawlessly through the official CWP REST API.

DISCLAIMER: This software is provided "as is" without any warranty of any kind. CW-Register is an independent software solution and is not affiliated with, endorsed by, or sponsored by Control Web Panel (CWP) or its developers. The CWP API is used solely via its official, documented REST interface.

---

✨ Enterprise-Grade Features

🛡️ Unrivaled Security & Privacy

• k-Anonymity Password Checks: Integrates the Have I Been Pwned API directly in the client's browser using the Web Crypto API. Only the first 5 characters of a SHA-1 hash are transmitted—your plaintext password never leaves your browser.
• Advanced Rate-Limiting (Token Bucket): Fully protects the CWP API against brute-force and DDoS spam attacks using a highly efficient, session-independent Token Bucket algorithm based on cryptographically hashed IPs.
• No Database Required: Works strictly with local flat files (JSON/PHP). All sensitive log files (audit.log.php, used_codes.php) are completely locked down and unreadable from the web, regardless of whether your webserver is Apache, LiteSpeed, or NGINX.
• Strict Content Security Policy (CSP): Ships with hardened HTTP response headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy) out of the box. The HSTS header is automatically sent on HTTPS connections, enforcing secure transport for one year and mitigating XSS and iframe-injection attacks.

🌐 Internationalization & UX

• Multiple Languages: Comes fully translated into several languages (English, German, French, Uzbek, and more).
• Responsive Dark/Light Mode: Automatically adjusts its premium UI to the system preferences of your users.
• Live Password Checklist: A real-time, side-by-side interactive UI element that instantly visually validates password complexity requirements.
• Fail-open DNS MX Checks: Automatically verifies the existence of mail servers (MX records) for the email domains entered during registration to prevent bot signups, featuring built-in caching.

🤖 Ultimate Anti-Bot Protection

Forget spam. We support natively integrated setups for:

• hCaptcha
• reCAPTCHA (Google)
• Cloudflare Turnstile
• Altcha (Proof-of-Work, 100% GDPR compliant)
• MTCaptcha

🎟️ Exclusive Access Modes

• Invite-Only Mode: Optionally lock your registration portal so only users with pre-generated, single-use, or multi-use invitation codes can join your platform.

---

🚀 Installation & Setup

Prerequisites

• A running Control Web Panel (CWP) server with port 2304 accessible from the server hosting this registration portal.
• An API key generated in the CWP Admin Panel: CWP Settings → API Manager → Allow new API access.

Steps

1. Upload & Extract: Upload the contents to any PHP 8.x web directory.
2. Prepare Config: Rename config-blank.php to config.php.
3. Generate an API key in your CWP Admin Panel under CWP Settings → API Manager.
4. Configure: Open config.php and enter your:
   • CWP_HOST – Your CWP server hostname or IP (e.g. https://1.2.3.4)
   • CWP_API_PORT – API port (default: 2304)
   • CWP_API_KEY – The API key generated in step 3
   • CWP_SERVER_IP – The public IP of your CWP server
   • CWP_DEFAULT_PACKAGE – The CWP hosting package to assign to new users
   • Desired Captcha Provider Keys
   • Security toggles (HIBP, Invite-Mode, Audit Logging)
5. Generate a Salt: Replace the default LOG_IP_SALT in config.php with a random 32-character string to ensure IP pseudonymization in your audit logs. (openssl rand -hex 16)
6. Open Port 2304: Ensure TCP port 2304 is open in your server's firewall (CSF/iptables) for incoming connections from the web server hosting this portal.
7. Done: The required data/ and logs/ folders (including their .htaccess protections) are included in the repository. The script will populate them upon the first registration.

⚠️ CWP Username Restrictions

CWP enforces strict username rules at the system level:

• Only lowercase letters (a-z) — no digits, no special characters
• Length: 6–8 characters

This is enforced both client-side (JS validation) and server-side (PHP regex /^[a-z]{6,8}$/).

---

📄 License & Attribution

This project is licensed under the MIT License.

Developer: Andy Goldau
Copyright: © 2026 CW-Register by PanelLayer, a brand of Subdomain LTD and managed on behalf of GoMaKe UG. All rights reserved.
Product Page: https://cw-register.panellayer.com/
Live Demo: https://demo.cw-register.panellayer.com/
Project: https://panellayer.com/

The above copyright notice, the developer attribution, and the permission notice must be included in all copies or substantial portions of the Software.