🚀 CY-Register

The Ultimate, Database-Free CyberPanel Registration Portal

Developed by Andy Goldau | © 2026 PanelLayer (Subdomain LTD) & GoMaKe UG

📦 Product Page: CY-Register  |  🧪 Live Demo: Demo  |  🌐 Project: PanelLayer

---

CY-Register is an incredibly robust, secure, and fully-featured self-service registration portal built specifically for CyberPanel. Designed from the ground up for maximum security, beautiful UI/UX, and GDPR compliance, it requires zero database setup (100% flat-file logic) and handles website and user creation flawlessly through the native CyberPanel REST API.

DISCLAIMER: This software is provided "as is" without any warranty of any kind. CY-Register is an independent software solution and is not affiliated with, endorsed by, or sponsored by LiteSpeed Technologies (CyberPanel) or its affiliates.

---

✨ Enterprise-Grade Features

🛡️ Unrivaled Security & Privacy

• k-Anonymity Password Checks: Integrates the Have I Been Pwned API directly in the client’s browser using the Web Crypto API. Only the first 5 characters of a SHA-1 hash are transmitted—your plaintext password never leaves your browser.
• Advanced Rate-Limiting (Token Bucket): Fully protects the CyberPanel API against brute-force and DDoS spam attacks using a highly efficient, session-independent Token Bucket algorithm based on cryptographically hashed IPs.
• No Database Required: Works strictly with local flat files (JSON/PHP). All sensitive data and log files (audit.log.php, used_codes.php, demo_accounts.json) are completely locked down and unreadable from the web.
• Strict Content Security Policy (CSP): Ships with hardened HTTP response headers (X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, and CSP) out of the box.

🌐 Internationalization & UX

• 30+ Supported Languages: Comes fully translated into 31 languages (English, German, French, Italian, Czech, Polish, Turkish, Russian, Chinese, Korean, Arabic, Hebrew, Hindi, and 18 more).
• Responsive Dark/Light Mode: Automatically adjusts its premium UI to system preferences with an interactive manual toggle.
• Live Password Checklist: A real-time, interactive UI checklist that visually validates password complexity requirements.
• Fail-open DNS MX Checks: Automatically verifies the existence of mail servers (MX records) for the email domains entered during registration with built-in 60-second caching.

🤖 Ultimate Anti-Bot Protection

Native, zero-friction integration for:

• hCaptcha
• reCAPTCHA (Google v2)
• Cloudflare Turnstile
• ALTCHA (Self-hosted Proof-of-Work, 100% GDPR compliant)
• MTCaptcha

🎟️ Exclusive Access & Demo Modes

• Invite-Only Mode: Lock registration so only users with pre-generated, single-use or multi-use invitation codes can register.
• Automated Demo Mode: Temporarily track created websites and automatically purge them after a configurable time window (e.g. 2 hours) via a background CLI cronjob (cron_cleanup.php).

---

🚀 Installation & Setup

1. Upload & Extract: Upload the files (index.php, config.php, .htaccess, altcha-challenge.php, cron_cleanup.php) to your PHP 8.x web server directory.
2. Configure: Rename config-blank.php to config.php (or edit config.php directly) and specify:
   • CP_HOST – Your CyberPanel URL (e.g., https://your-server.example.com)
   • CP_PORT – Your CyberPanel web port (default: 8090)
   • CP_ADMIN_USER / CP_ADMIN_PASS – Your CyberPanel credentials (must have API access enabled)
   • CP_DEFAULT_PACKAGE – Name of an existing CyberPanel package
   • CP_PHP_VERSION – PHP version for new websites (e.g., '8.1')
   • Captcha keys (CAPTCHA_PROVIDER and site/secret keys)
3. Set Random Secrets: Generate and set unique random strings for security:
   • LOG_IP_SALT: For GDPR-compliant IP pseudonymization (openssl rand -hex 16)
   • ALTCHA_HMAC_KEY: If using ALTCHA proof-of-work (openssl rand -hex 32)
4. Done: The system automatically creates and protects the necessary data/ and logs/ folders upon the first registration attempt.

CRITICAL SECURITY NOTE: Ensure your CyberPanel server is updated to version 2.3.8 or higher. Older versions are vulnerable to a severe OS Command Injection vulnerability (CVE-2024-53376).

---

⏱️ Demo Mode & Cron Setup (Optional)

If DEMO_MODE is enabled in config.php, websites created during testing or live demos will be scheduled for deletion after DEMO_LIFETIME_HOURS.

To enable automatic cleanup, add the following cronjob to your server's crontab:

# Edit crontab
crontab -e

# Add cron entry (runs every 30 minutes)
*/30 * * * * php /path/to/your/webroot/cron_cleanup.php >> /dev/null 2>&1

---

📄 License & Attribution

This project is licensed under the MIT License.

Developer: Andy Goldau
Copyright: © 2026 CY-Register by PanelLayer, a brand of Subdomain LTD and managed on behalf of GoMaKe UG. All rights reserved.
Product Page: https://cy-register.panellayer.com/
Live Demo: https://demo.cy-register.panellayer.com/
Project: https://panellayer.com/

The above copyright notice, the developer attribution, and the permission notice must be included in all copies or substantial portions of the Software.