🚀 FR-Register

The Ultimate, Database-Free Froxlor Registration Portal

Developed by Andy Goldau | © 2026 PanelLayer (Subdomain LTD) & GoMaKe UG

📦 Product Page: FR-Register  |  🧪 Live Demo: Demo  |  🌐 Project: PanelLayer

---

FR-Register is an incredibly robust, secure, and fully-featured self-service registration portal built specifically for Froxlor. Designed from the ground up for maximum security, modern UI/UX, and GDPR compliance, it requires zero database setup (100% flat-file logic) and handles user & domain creation flawlessly through the native Froxlor JSON API (Customers.add & Domains.add).

DISCLAIMER: This software is provided "as is" without any warranty of any kind. FR-Register is an independent software solution and is not affiliated with, endorsed by, or sponsored by the Froxlor Team or its contributors.

---

✨ Enterprise-Grade Features

🛡️ Unrivaled Security & Privacy

• k-Anonymity Password Checks: Integrates the Have I Been Pwned API directly in the client’s browser using the Web Crypto API. Only the first 5 characters of a SHA-1 hash are transmitted—your plaintext password never leaves your browser.
• Advanced Rate-Limiting (Token Bucket): Protects the Froxlor API against brute-force and DDoS spam attacks using a highly efficient, session-independent Token Bucket algorithm based on cryptographically hashed IPs.
• No Database Required: Works strictly with local flat files (JSON/PHP). All sensitive data and log files (audit.log.php, used_codes.php) are locked down against web access.
• Strict Content Security Policy (CSP): Ships with hardened HTTP response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) out of the box.
• GDPR Audit Log: Pseudonymized IP logging (LOG_IP_SALT) with email masking and automatic log rotation (AUDIT_LOG_MAX_SIZE).

🌐 Internationalization & UX

• Supported Languages: German (de) and English (en), matching Froxlor's primary languages.
• Responsive Dark/Light Mode: Automatically respects system preferences or user toggles, styled with Froxlor-inspired aesthetics.
• Interactive Password Generator & Checklist: Real-time visual checklist for password requirements with a cryptographically secure (crypto.getRandomValues) generator and one-click copy button.
• Accessibility Toolbar (A11y): Floating accessibility widget supporting high contrast, font size scaling, reduce motion, and grayscale modes.
• Fail-open DNS MX Checks: Automatically verifies MX records for registration emails to reduce bot signups.

🤖 Anti-Bot & Abuse Protection

• Multi-provider CAPTCHA support: hCaptcha, reCAPTCHA (Google), Cloudflare Turnstile, Altcha (self-hosted PoW, 100% GDPR compliant), and MTCaptcha.
• Honeypot form fields to trap simple automated spambots.
• Disposable email domain blocking (BLOCKED_EMAIL_DOMAINS).

🎟️ Access Control & Admin Tools

• Invite-Only Mode: Restrict registration to pre-generated single-use or multi-use invitation codes.
• Demo Mode & Automated Cleanup: Automatic deletion of temporary demo accounts after a set lifetime via cron_cleanup.php (Customers.delete).
• Instant Admin Notifications: Instant Webhook alerts (Discord/Slack) and admin email notifications upon successful registration.

---

🚀 Installation & Setup

1. Upload Files: Upload the repository files to your web server (PHP 8.x required).
2. Configuration: Copy config-blank.php to config.php (or edit existing config.php) and adjust your settings:
   • Froxlor URL (FROXLOR_URL)
   • API Credentials (FROXLOR_API_KEY, FROXLOR_API_SECRET)
   • Selected CAPTCHA Provider Keys
   • Security Secrets: Replace LOG_IP_SALT and ALTCHA_HMAC_KEY with strong random hex values (openssl rand -hex 16 / 32).
3. Apache / PHP-FPM Setup: If running Apache with PHP-FPM, ensure HTTP Basic Auth headers are passed to PHP by adding CGIPassAuth On to your vHost configuration.
4. Nginx Security (Recommended): Block direct web access to sensitive config & data directories in your Nginx config:

   location ~* ^/(config|config-blank|cron_cleanup)\.php$ { deny all; return 403; }
   location ~* /(data|logs)/ { deny all; return 403; }

5. Permissions: Ensure the PHP process has write permissions to create/modify data/ and logs/ directories.

---

📄 License & Attribution

This project is licensed under the MIT License.

Developer: Andy Goldau
Copyright: © 2026 FR-Register by PanelLayer, a brand of Subdomain LTD and managed on behalf of GoMaKe UG. All rights reserved.
Product Page: https://fr-register.panellayer.com/
Live Demo: https://demo.fr-register.panellayer.com/
Project: https://panellayer.com/

The above copyright notice, the developer attribution, and the permission notice must be included in all copies or substantial portions of the Software.