Product overview
Cobalt Loom is a complete commercial website package rather than a static landing-page theme. Installation prepares the database, demonstration content, administrator, application key and domain-bound licence before any public content is released.
Included capabilities
- Public websiteThree genuinely different homepages, services, portfolio, case studies, team, process, engagements, testimonials, insights, careers, FAQ, contact and legal pages.
- Focused administrationWebsite settings, homepage selection, services, portfolio, case studies, team, testimonials, articles, enquiries, integrations, licence status and administrator profile.
- Lead handlingContact, project, newsletter and career forms with CSRF, honeypot, rate limiting, strict validation, protected attachments and optional CAPTCHA.
- Production foundationsVersioned migrations, prepared PDO statements, secure sessions, local fonts, responsive assets, structured data, sitemap, error pages and maintenance mode.
Server requirements
Use a normal PHP shared-hosting account or virtual server that can keep application files outside the public document root. Provision the final HTTPS hostname before activating the licence.
| Requirement | Minimum or expected value | Why it is required |
|---|---|---|
| PHP | 8.2 or newer | Typed application code, password hashing and current runtime security |
| Database | MySQL 8 or MariaDB 10.6+ | Versioned schema, content and enquiry storage |
| PHP extensions | PDO MySQL, cURL, OpenSSL, JSON, mbstring, Fileinfo, sessions | Database, licensing, UTF-8, secure uploads and authentication |
| Web server | Apache-compatible routing or an equivalent nginx front controller | Clean URLs and protected application files |
| Network | Outbound HTTPS to shop.freygabor.com | Licence activation and periodic validation |
| TLS | Valid HTTPS certificate | Secure cookies, credentials, forms and licensing traffic |
Writable locations during installation and operation
- config must allow the installer to create installed.php atomically.
- storage/cache, storage/licence, storage/logs, storage/sessions and storage/uploads must be writable by PHP.
- The installer must be able to create storage/install.lock after successful licence activation.
- Use the hosting provider’s ownership model. A common baseline is directories 0755, ordinary files 0644 and sensitive generated files 0640.
Deploy the package securely
The preferred document root is the package’s public directory. Application, configuration, database, storage, source views and vendor files must not be downloadable from the browser.
/home/account/cobalt-loom/public- 01
Extract the package
Upload and extract the release outside the final public folder when the hosting panel allows it. Keep the supplied directory structure intact.
- 02
Point the domain to public
Set the domain or subdomain document root to the package’s public directory. The public URL must not include /public.
- 03
Preserve hidden files
Confirm that .htaccess files were uploaded. Some FTP applications hide or skip dotfiles unless explicitly enabled.
- 04
Set permissions
Make config and storage writable by the PHP account without granting world-writable permissions.
- 05
Verify isolation
Requests for README.md, database migrations, configuration and vendor source must return a protected response rather than file contents.
Run the eight-step installer
Open the final HTTPS domain. A fresh installation automatically redirects to /install. Keep the browser session open because tested database credentials and installer progress are retained only in the protected installation session.
- 01
Welcome
Review the product name, version, author, documentation and installation stages. Starting the wizard creates a secure installer session.
- 02
Server checks
The wizard confirms PHP, required extensions, sessions and writable protected directories. Critical failures prevent continuation.
- 03
Database configuration
Enter host, port, empty database name, database username, password and an optional table prefix. The password is never displayed or written to an ordinary log.
- 04
Database installation
Retry-safe migrations create the schema, seed polished fictional content, record the installed version and generate a random 256-bit application key.
- 05
Website settings
Enter the agency name, final canonical HTTPS URL, contact and sender emails, timezone, language and default SEO content.
- 06
Administrator account
Create the single owner account with a unique password of at least 12 characters, including upper and lowercase letters, a number and a symbol.
- 07
Licence activation
Enter the Cobalt Loom licence key issued by shop.freygabor.com. Activation binds the entitlement to this exact normalized hostname and installation UUID.
- 08
Completion
The signed licence response is verified locally, the installation lock is created atomically, the installer session is invalidated and public/admin links become available.
Configure the website after installation
Sign in at /admin/login. Cobalt Loom starts in a controlled state so the owner can replace demonstration material and verify integrations before showing the full website publicly.
- 01
Review Website settings
Confirm the agency identity, contact details, announcement, footer, default SEO title and description, and demonstration-content notice.
- 02
Choose a homepage
Select the flagship creative, performance marketing or boutique studio composition as the default homepage. The other two remain available for review.
- 03
Replace fictional content
Update services, projects, case studies, people, testimonials, results and articles. Keep unfinished records as drafts and use unique stable slugs.
- 04
Review navigation and calls to action
Check the primary navigation, footer links, enquiry buttons, contact identity and any legal pages required for the operator’s jurisdiction.
- 05
Configure integrations
Set up SMTP or Brevo, send a test message, enable a supported CAPTCHA provider if needed and confirm forms save enquiries.
- 06
Test as a visitor
Use a private browser window to test responsive navigation, forms, keyboard focus, 404 pages, maintenance mode and the final public state.
- 07
Publish deliberately
Disable Coming Soon mode only after content, legal details, email, CAPTCHA, backups and licence status have been reviewed.
https://your-domain.example/admin/loginAdministration areas
- Dashboard and website settings
- Services, portfolio projects, case studies and project galleries
- Team members, testimonials and insight articles
- Stored contact, project and career enquiries
- Email, Brevo and CAPTCHA integrations with connection tests
- Administrator profile and password
- Licence status, manual validation and non-secret system information
Email, Brevo and CAPTCHA
Valid enquiries are stored before delivery is attempted, so a temporary provider failure does not discard the lead. Integration secrets are encrypted with the installation application key.
SMTP setup
- 01
Select SMTP
Enter the provider hostname, username and password or relay key.
- 02
Choose transport security
Use port 587 with STARTTLS or port 465 with implicit TLS unless the provider specifies another secure combination.
- 03
Authorize the sender
Use a From address verified by the SMTP provider and configure SPF, DKIM and DMARC.
- 04
Test delivery
Save the settings and use Test email connection. Confirm receipt and review the protected application log if the generic test message reports failure.
Brevo API setup
- 01
Verify a sender or domain
Complete sender verification in Brevo before using the API.
- 02
Create an API key
Create a transactional-email API key and store it only in the protected administration settings.
- 03
Select Brevo API
Enter the verified sender name/address, administrator recipient and API key.
- 04
Send a test
Confirm the message arrives and that SPF, DKIM and DMARC align with the visible From domain.
CAPTCHA setup
- Choose Cloudflare Turnstile or hCaptcha and register the exact production hostname with that provider.
- Copy the public site key and private secret into Administration → Email & CAPTCHA.
- Enable protection and save. The contact, project, career and newsletter forms are protected automatically.
- Test a valid submission and a missing/failed challenge. CAPTCHA supplements CSRF, honeypot checks, validation and rate limiting; it does not replace them.
Licence activation and validation
The shop is authoritative for the product, domain, activation, expiry and revocation status. Cobalt Loom never generates keys and never contains a private signing key.
- One key belongs to Cobalt Loom and one exact normalized production hostname.
- Another domain or subdomain requires another purchase. The www label is preserved and is not silently added or removed.
- Same-domain reinstallation can be revalidated by the shop, but the website does not release or transfer a licence locally.
- Activation and validation requests are sent server-side over HTTPS and successful responses are verified locally with RSA-SHA256.
- The retained key is encrypted because periodic validation requires it. Interfaces and ordinary logs show only a masked hint.
Design, content and assets
The visual system uses near-black, warm off-white, saturated cobalt and a restrained coral accent. Bootstrap supplies a dependable baseline while custom CSS creates the editorial identity.
| Area | Source |
|---|---|
| Design tokens and readable CSS | public/assets/css/app.css |
| Editable SCSS-compatible source | resources/scss/app.scss |
| Frontend interactions | public/assets/js/app.js |
| Primary navigation | resources/views/layouts/public.php |
| Local fonts | public/assets/fonts |
| Social-sharing image | public/assets/images/cobalt-loom-social.jpg |
Safe customization workflow
- Back up the database and files before changing code or assets.
- Keep readable and production-minified CSS/JavaScript synchronized.
- Test replacement colours for WCAG AA contrast in normal, hover, focus and disabled states.
- Record the source, author and licence for every replacement image, icon, font or library.
- Use responsive AVIF/WebP with a fallback, width and height attributes, meaningful alternative text and lazy loading below the fold.
- Update navigation, sitemap logic, redirects and tests together when public routes change.
Backups, restores and updates
Treat the database, generated configuration, application key, private uploads and licence state as one recoverable installation. A partial backup may be unusable even if the public assets are intact.
Back up together
- The complete MySQL or MariaDB database
- config/installed.php
- storage/uploads and storage/licence
- Replaced or customized public assets
- The exact Cobalt Loom application release
Update procedure
- 01
Read the changelog
Identify file, database and compatibility changes before touching production.
- 02
Create and verify a backup
Back up database and files, and confirm that the archive can be opened.
- 03
Enable maintenance mode
Keep administrators signed in while visitors receive the designed Coming Soon page.
- 04
Merge the release
Upload changed application/assets without overwriting config/installed.php, storage or buyer customizations.
- 05
Run documented migrations
Only run database work included with that release, then clear storage/cache.
- 06
Verify and publish
Test public pages, admin CRUD, forms, uploads and manual licence validation before disabling maintenance mode.
Diagnose common installation and runtime issues
Keep display_errors disabled in production. Use the visitor-safe message to identify the category, then review the protected PHP or application log without copying credentials into a support request.
The domain displays a file and folder tree
The document root is pointed at the package root. Point it to public, disable directory listing and verify that database, config and vendor paths no longer return file contents. nginx does not use .htaccess.
Opening /public works but / does not
Do not install using the temporary /public URL. Correct the domain document root so the final canonical URL has no /public path, then restart the installer session.
The installer returns to database configuration
Check host, port, database name, username, password and privileges. The database user must be able to create and alter the product tables.
Migration was interrupted
Correct the server or database issue and retry the migration step. Migrations detect completed checksums and seed data uses stable identifiers.
The site redirects to the installer after setup
Both the completed installation database record and storage/install.lock are required. Check configuration, database access, ownership and the lock file; do not create a fake lock.
The licence page reports a domain mismatch
Confirm the canonical hostname exactly matches the purchased activation, including the subdomain and www policy. A different hostname requires another licence.
The licence server times out
Confirm outbound HTTPS, DNS, server time and cURL. A temporary failure uses the last valid signed response only within the controlled grace period.
A blank page or generic system error appears
Review the protected application/PHP log, PHP version and extensions, database access, generated configuration and storage permissions. Do not expose stack traces publicly.
Forms save but email does not arrive
The enquiry remains in Administration. Verify the sender, provider credentials, port/encryption, spam folder and SPF/DKIM/DMARC, then run the integration test.
An attachment is rejected
Only PDF, DOCX, JPEG and PNG up to 5 MB are accepted. Fileinfo checks the content. Also review PHP upload_max_filesize and post_max_size.
Assets or clean routes return 404
Verify the public document root, front-controller rule, uploaded hidden files and canonical URL. Clear browser/CDN cache after correcting the route.
CSS changes do not appear
Clear browser and CDN caches, update the asset query version and keep app.css, app.min.css and the SCSS source synchronized.
Production security checklist
Cobalt Loom implements secure defaults, but hosting, updates, backups, sender authentication and data retention remain operator responsibilities.
- Enforce HTTPS and protect the hosting, database and email accounts with unique credentials and MFA where available.
- Keep PHP, MySQL/MariaDB, PHPMailer and Cobalt Loom releases supported and current.
- Keep application, configuration, storage, database migrations, views and vendor code outside the public web root.
- Use a unique administrator password and change it immediately if it has been shared through an insecure channel.
- Configure SPF, DKIM and DMARC for the sender domain and rotate expired integration keys.
- Define a real retention policy for enquiries and uploaded personal information.
- Back up regularly and test restoring the database, configuration, application key, uploads and licence state together.
- Never send complete licence keys, passwords, API secrets, application keys, database dumps or raw private logs in ordinary support messages.
Frequently asked questions
Short answers to common installation, ownership, licensing and support questions.
Where is the administrator login?
Use https://your-domain.example/admin/login after installation and licence activation are complete.
Why does the website show a Coming Soon page after installation?
Coming Soon mode is enabled so the owner can review content and integrations privately. A signed-in administrator can continue working. Disable it in Website settings when the site is ready.
Can I install the package inside a subdirectory?
A root-domain document root pointing to public is recommended. Subdirectory installations require careful route, asset and canonical URL testing and still bind the licence to the exact hostname.
Can one licence be used on another subdomain?
No. One licence is bound to one product and one exact normalized domain or subdomain. Another hostname requires a new licence.
Can I reinstall on the same domain?
Yes, subject to validation by the licensing service. Preserve the canonical hostname and use the documented same-domain recovery process. Do not edit the database or signed licence token.
Does a temporary licensing outage immediately disable the website?
No. A valid signed cached response can continue during the finite grace period. Explicit revocation, expiration, mismatch or an expired grace period blocks content.
Are the supplied clients, testimonials and metrics real?
No. They are fictional demonstration content and must be replaced before the buyer presents the website as a real agency.
Does production require Node.js?
No. Production runs on PHP and MySQL or MariaDB. Node.js or Sass tooling is optional for development-time asset recompilation only.
Which email providers are supported?
The administration supports SMTP and the Brevo transactional email API, including encrypted credentials and a connection test.
Where are uploaded application attachments stored?
Accepted attachments are renamed and stored under protected storage/uploads rather than a publicly executable path.
What should a support request include?
Include the product version, PHP and database versions, final hostname, expected behaviour, reproducible steps and redacted log excerpts. Never include passwords or a complete licence key.
Changelog
Review the release notes before updating an installed website.
Seamless 1600px editorial canvas
- Reduced the centered desktop website canvas from 1800px to 1600px.
- Matched the outer browser background to the website paper colour so no dark side gutters are visible.
- Removed the outer border and shadow while preserving the centered boxed composition.
- Preserved fluid tablet and mobile behavior.
Boxed desktop canvas and hosting maintenance release
- Added a centered 1800px maximum-width website canvas for wide desktop displays.
- Preserved fluid tablet and mobile behavior below the desktop maximum width.
- Updated asset cache versions and commercial release metadata.
- Included the shared-hosting installer routing correction in the downloadable package.
Initial commercial release
- Added three independent homepage compositions and the complete creative-agency sitemap.
- Added services, portfolio, case studies, team, testimonials and insights management.
- Added protected enquiry storage, secure uploads, SMTP/Brevo delivery and CAPTCHA.
- Added the eight-step installer and mandatory signed FreyDesigns licence activation.
- Added one-domain enforcement, cached validation, manual validation and finite grace handling.
- Added accessibility, structured data, sitemap, maintenance and production error pages.
- Added complete documentation, attribution and the automated test suite.
Send a safe, reproducible support request.
Include Cobalt Loom version 1.0.2, PHP and database versions, the final hostname, expected behaviour, steps to reproduce and redacted log excerpts.
Do not send passwords, API secrets, database dumps, application keys or a complete licence key.