The Ultimate, Database-Free SPanel Registration Portal
Developed by Andy Goldau | © 2026 PanelLayer (Subdomain LTD) & GoMaKe UG
📦 Product Page: SP-Register | 🧪 Live Demo: Demo | 🌐 Project: PanelLayer
SP-Register is an incredibly robust, secure, and fully-featured self-service registration portal built specifically for SPanel (by ScalaHosting). Designed from the ground up for maximum security, beautiful UI/UX, and GDPR compliance, it requires zero database setup (100% flat-file logic) and handles user creation flawlessly through the native SPanel REST API.
DISCLAIMER: This software is provided "as is" without any warranty of any kind. SP-Register is an independent software solution and is not affiliated with, endorsed by, or sponsored by ScalaHosting or its affiliates.
- k-Anonymity Password Checks: Integrates the Have I Been Pwned API directly in the client's browser using the Web Crypto API. Only the first 5 characters of a SHA-1 hash are transmitted—your plaintext password never leaves your browser.
- Advanced Rate-Limiting (Token Bucket): Fully protects the SPanel API against brute-force and DDoS spam attacks using a highly efficient, session-independent Token Bucket algorithm based on cryptographically hashed IPs.
- No Database Required: Works strictly with local flat files (JSON/PHP). All sensitive log files (
audit.log.php,used_codes.php) are completely locked down and unreadable from the web, regardless of whether your webserver is Apache, LiteSpeed, or NGINX. - Strict Content Security Policy (CSP): Ships with hardened HTTP response headers (CSP, HSTS, X-Frame-Options) out of the box, mitigating XSS and iframe-injection attacks.
- 8 Supported Languages: Comes fully translated into 8 languages (English, German, French, Spanish, Dutch, Hindi, Indonesian, Portuguese).
- Responsive Dark/Light Mode: Automatically adjusts its premium UI to the system preferences of your users.
- Live Password Checklist: A real-time, side-by-side interactive UI element that instantly visually validates password complexity requirements.
- Fail-open DNS MX Checks: Automatically verifies the existence of mail servers (MX records) for the email domains entered during registration to prevent bot signups, featuring built-in caching.
Forget spam. We support natively integrated setups for:
- hCaptcha
- reCAPTCHA (Google)
- Cloudflare Turnstile
- Altcha (Proof-of-Work, 100% GDPR compliant)
- MTCaptcha
- Invite-Only Mode: Optionally lock your registration portal so only users with pre-generated, single-use, or multi-use invitation codes can join your platform.
- A server running SPanel (by ScalaHosting)
- An Admin API Token generated in the SPanel Admin Interface:
SPanel Admin → Server Management → Manage API Tokens - At least one hosting package configured in SPanel (for
SP_DEFAULT_PACKAGE) - PHP 8.x with cURL extension enabled
Upload the contents to any PHP 8.x web directory, then open config.php:
// ── SPanel Server ──────────────────────────────────────────────────────────
define('SP_HOST', 'https://your-server.example.com'); // Your SPanel server URL
define('SP_API_PATH', '/spanel/api.php'); // Default API path
define('SP_PANEL_PORT', 2083); // Port for login link
define('SP_SSL_VERIFY', true); // true in production
// ── Admin API Token ────────────────────────────────────────────────────────
// Generate in: SPanel Admin → Server Management → Manage API Tokens
define('SP_API_TOKEN', 'your-spanel-api-token-here');
// ── Default Hosting Package ────────────────────────────────────────────────
// Must match an existing package name in SPanel Admin → Packages
define('SP_DEFAULT_PACKAGE', 'default');Note: The
SP_API_PATHis/spanel/api.phpby default. If your SPanel installation uses custom branding, the path may differ (e.g./hostpanel/api.php). Check your SPanel Admin interface to confirm.
Replace the placeholder values before deployment:
# Generate a random salt for GDPR-compliant IP pseudonymization:
openssl rand -hex 16
# Generate a random secret for ALTCHA (if used):
openssl rand -hex 32Set these in config.php:
define('LOG_IP_SALT', 'your-generated-salt-here');
define('ALTCHA_HMAC_KEY', 'your-generated-secret-here');Enable demo mode to auto-delete test accounts after a set duration:
define('DEMO_MODE', true);
define('DEMO_LIFETIME_HOURS', 2);Set up the cleanup cronjob on your server:
crontab -e
# Add the following line (runs every 30 minutes):
*/30 * * * * php /home/YOUR_SP_USER/public_html/cron_cleanup.php >> /dev/null 2>&1The cronjob uses accounts/terminateaccount via the SPanel API to permanently remove expired demo accounts.
The system automatically creates and protects the necessary data/ and logs/ folders upon the first registration.
| Function | Action | Description |
|---|---|---|
| Create account | accounts/wwwacct |
Creates a new hosting account |
| Delete account | accounts/terminateaccount |
Permanently deletes a hosting account |
API Endpoint: POST https://{server}/spanel/api.php
Authentication: Token-based (token POST parameter)
Response format: JSON ({ "status": "success"|"error", "data": ... })
This project is licensed under the MIT License.
Developer: Andy Goldau
Copyright: © 2026 SP-Register by PanelLayer, a brand of Subdomain LTD and managed on behalf of GoMaKe UG. All rights reserved.
Product Page: https://sp-register.panellayer.com/
Live Demo: https://demo.sp-register.panellayer.com/
Project: https://panellayer.com/
The above copyright notice, the developer attribution, and the permission notice must be included in all copies or substantial portions of the Software.