🚀 HC-Register

The Ultimate, Database-Free Hestia Control Panel Registration Portal

Developed by Andy Goldau | © 2026 PanelLayer (Subdomain LTD) & GoMaKe UG

📦 Product Page: HC-Register  |  🧪 Live Demo: Demo  |  🌐 Project: PanelLayer

---

HC-Register is an incredibly robust, secure, and fully-featured self-service registration portal built specifically for Hestia Control Panel. Designed from the ground up for maximum security, beautiful UI/UX, and GDPR compliance, it requires zero database setup (100% flat-file logic) and handles user creation flawlessly through the native Hestia CP REST API (v-add-user).

DISCLAIMER: This software is provided "as is" without any warranty of any kind. HC-Register is an independent software solution and is not affiliated with, endorsed by, or sponsored by the Hestia Control Panel project or its contributors.

---

✨ Enterprise-Grade Features

🛡️ Unrivaled Security & Privacy

• k-Anonymity Password Checks: Integrates the Have I Been Pwned API directly in the client's browser using the Web Crypto API. Only the first 5 characters of a SHA-1 hash are transmitted—your plaintext password never leaves your browser.
• Advanced Rate-Limiting (Token Bucket): Fully protects the Hestia CP API against brute-force and DDoS spam attacks using a highly efficient, session-independent Token Bucket algorithm based on cryptographically hashed IPs.
• Session Locking (SESSION_LOCK_ENABLED): Prevents users from registering multiple accounts within the same browser session.
• No Database Required: Works strictly with local flat files (JSON/PHP). All sensitive log files (audit.log.php, used_codes.php, demo_accounts.json) are completely locked down and unreadable from the web via .htaccess.
• Strict Content Security Policy (CSP): Ships with hardened HTTP response headers (CSP, HSTS, X-Frame-Options) out of the box, mitigating XSS and iframe-injection attacks.

🌐 Internationalization & UX

• 22+ Supported Languages: Comes fully translated into 22 languages including English, German, French, Spanish, Russian, Czech, Hungarian, Italian, Korean, Polish, Portuguese, Swedish, Turkish, Ukrainian, Uzbek, Thai, Chinese, and more.
• Responsive Dark/Light Mode: Automatically adjusts its premium UI to the system preferences of your users.
• Live Password Checklist: A real-time, side-by-side interactive UI element that instantly visually validates password complexity requirements.
• Fail-open DNS MX Checks: Automatically verifies the existence of mail servers (MX records) for the email domains entered during registration to prevent bot signups, featuring built-in caching.

⏳ Demo Mode & Automated Cleanup

• Automatic Account Expiry: Supports a built-in Demo Mode (DEMO_MODE) with automated account deletion after a configurable number of hours (DEMO_LIFETIME_HOURS).
• Web & CLI Cron Cleanup (cron_cleanup.php): Executes v-delete-user in Hestia CP for expired demo accounts. Protected via CLI execution or secure web access using CRON_SECRET_KEY (?key=...).

🤖 Ultimate Anti-Bot Protection

Forget spam. We support natively integrated setups for:

• hCaptcha
• reCAPTCHA (Google)
• Cloudflare Turnstile
• Altcha (Proof-of-Work, 100% GDPR compliant)
• MTCaptcha

🎟️ Exclusive Access Modes

• Invite-Only Mode: Optionally lock your registration portal so only users with pre-generated, single-use, or multi-use invitation codes can join your platform.

---

🚀 Installation & Setup

Prerequisites

• Hestia CP installed and accessible on HTTPS port 8083 (or custom port)
• PHP 8.x with curl extension enabled on the web server running HC-Register
• The IP address of the HC-Register server must be whitelisted in Hestia CP: Server Settings → Configure → Security → Allowed IP Addresses for API (use 127.0.0.1 if co-located)

Steps

1. Upload & Extract: Upload the contents to any PHP 8.x web directory (can be on the same server as Hestia CP or a separate server).
2. Configure: Open config.php (or copy from config-blank.php) and enter your:
   • HST_HOST: Hestia CP hostname (e.g. https://demo.hestiacp.com)
   • HST_PORT: Default 8083
   • HST_ADMIN_USER / HST_ADMIN_PASS: HestiaCP admin username & password OR Access Key ID & Secret Key (recommended)
   • HST_DEFAULT_PACKAGE: Name of an existing Hestia CP package (e.g. default)
   • SESSION_LOCK_ENABLED: Set to true to block multiple registrations per browser session
   • DEMO_MODE: Set to true to enable temporary demo accounts
   • DEMO_LIFETIME_HOURS: Lifetime of demo accounts in hours (default: 2)
   • CRON_SECRET_KEY: Secret key to protect web-accessible cron_cleanup.php execution
   • Desired CAPTCHA provider keys
   • Security toggles (HIBP, Invite-Mode, Audit Logging)
3. Create an Access Key (Recommended):
   • In Hestia CP, go to User Profile → Access Keys → Add Access Key.
   • Permissions: Leave all permission checkboxes empty to grant full API capabilities (v-add-user and v-delete-user), or explicitly check v-add-user (and v-delete-user if Demo Mode cleanup is used).
4. Generate a Salt: Replace the default LOG_IP_SALT in config.php with a random 32-character string (openssl rand -hex 16) to ensure IP pseudonymization in your audit logs.
5. Set up Cronjob (Demo Mode only):
   • In Hestia CP or your server's crontab, add a job every 30 minutes:

     php /path/to/HC-Register/cron_cleanup.php

     or via web request:

     curl -s "https://your-domain.com/cron_cleanup.php?key=YOUR_CRON_SECRET_KEY" > /dev/null

6. Done: The system automatically creates and protects the necessary data/ and logs/ folders upon the first registration.

---

⚙️ Hestia CP API Notes

• HC-Register uses the v-add-user command via POST https://<host>:<port>/api/
• For Demo Mode cleanup, HC-Register calls v-delete-user
• Dual Authentication payload supports both hash (access_key_id:secret_key) and user/password parameters for maximum compatibility with all HestiaCP versions.
• A successful API call returns exit code 0; exit code 3 (E_NOTEXIST) is handled gracefully during cleanup. All other codes are mapped with human-readable error messages.

---

📄 License & Attribution

This project is licensed under the MIT License.

Developer: Andy Goldau
Copyright: © 2026 HC-Register by PanelLayer, a brand of Subdomain LTD and managed on behalf of GoMaKe UG. All rights reserved.
Product Page: https://hc-register.panellayer.com/
Live Demo: https://demo.hc-register.panellayer.com/
Project: https://panellayer.com/

The above copyright notice, the developer attribution, and the permission notice must be included in all copies or substantial portions of the Software.