Product overview
Ultimate SiteTest Pro combines authorised public-website diagnostics with private client reporting, maintenance records and support operations. It is a complete self-hosted application, not a browser-only speed-test page or a third-party performance API wrapper.
Included operations
- Safe server-side testingMeasure public HTTP and HTTPS websites while rejecting credentials in URLs, unsafe schemes, non-standard ports, private or reserved networks and redirects into blocked destinations.
- Performance reportingStore point-in-time tests, compare history and create branded on-screen and PDF reports for assigned clients.
- Client deliveryCreate invite-only client accounts, assign only the correct websites, publish reports and retain private messages in the application inbox.
- Maintenance and supportTrack maintenance subscriptions, completed work, client-ready maintenance PDFs, report requests and private support conversations.
- Email administrationUse Brevo Transactional API, authenticated SMTP or host PHP mail with editable event templates, connection checks, real-message tests, logs and controlled retries.
Server and hosting requirements
Install on the final licensed HTTPS hostname. Normal PHP shared hosting is supported when Apache-compatible rewriting, the required extensions and protected writable storage are available.
| Requirement | Minimum or expected value | Used for |
|---|---|---|
| PHP | 8.2 or newer | Application runtime, secure password handling and typed services |
| Database | MySQL 8.0 or MariaDB 10.6+ | Accounts, websites, tests, reports, notifications and audit history |
| PHP extensions | PDO MySQL, cURL, OpenSSL, JSON, mbstring, DOM/XML and sessions | Database access, HTTP tests, cryptography, parsing and authentication |
| Web server | Apache with .htaccess overrides or equivalent routing | Clean routes and denial of protected source/configuration paths |
| Network | Outbound HTTPS to public test targets and shop.freygabor.com | Website diagnostics, activation and periodic licence validation |
| Email network | Brevo API over HTTPS or provider-approved SMTP/PHP mail | Invitations, reports, support and operational notices |
| TLS | Valid HTTPS certificate on the exact licensed hostname | Secure cookies, credentials, client reports and licensing traffic |
Writable and protected locations
- config must allow the installer to create config/env.php without making it publicly downloadable.
- storage must allow creation of installed.lock, cache entries, licence state, private logs and generated working files.
- Preserve the supplied .htaccess file so directory listing and direct access to configuration, database, storage, logs, keys and metadata remain blocked.
- Grant write access only to the PHP/hosting account. Do not use world-writable permissions as a permanent fix.
Run the protected eight-step installer
Create an empty database, upload the complete package into the final domain or subdomain document root, enable HTTPS and open the site. Public, administrator and client content remain protected until signed activation succeeds.
- 01
Welcome
Start the secure installation session and confirm Ultimate SiteTest Pro version 1.0.0, the installation stages and documentation link.
- 02
Server checks
Resolve every critical PHP, extension, session and writable-directory failure. The wizard deliberately prevents continuation when the environment is unsafe or incomplete.
- 03
Database configuration
Enter the hosting database host, port, empty database name, username and password. The password and full connection string are never displayed or written to an ordinary log.
- 04
Database installation
Retry-safe schema and versioned migrations create the application tables, seed fictional demonstration data, record version history and generate the installation application key.
- 05
Website settings
Set the application name, final canonical HTTPS URL, contact email, verified sender email and timezone. The canonical hostname is also used for licensing.
- 06
Administrator account
Create the first administrator with a unique password of at least 12 characters. Only a secure password hash is stored.
- 07
Licence activation
Enter the key issued for ultimate-sitetest-pro and this exact normalized hostname. The signed response must pass local RSA-SHA256 verification.
- 08
Completion and lock
The installer records completion in the database, creates storage/installed.lock atomically, clears the installation session and exposes the public, administrator and client entry points.
Administrator: https://your-domain.example/admin-login
Client: https://your-domain.example/client-loginConfigure the system before inviting clients
Sign in at /admin-login and complete a private acceptance test before creating real client accounts or enabling automatic email.
- 01
Confirm identity and timezone
Review the product/business name, contact identity, canonical URL, sender details, timezone and report branding before creating scheduled or client-facing records.
- 02
Configure email safely
Choose Brevo API, authenticated SMTP or approved PHP mail. Verify the sender, check the connection and send a real test before enabling automatic delivery.
- 03
Review every notification template
Check invitation, password reset, report, maintenance, access-request and support messages. Keep required replacement variables intact.
- 04
Add a test client and website
Create a dedicated test client, add an authorised public HTTPS website and assign that website only to the test client.
- 05
Run a controlled website test
Review response, redirects, timings, resource observations, compression, technology signals and security-header notes before generating a report.
- 06
Verify both portals
Confirm administrator controls, client first-login password change, assigned website visibility, report history, maintenance, support, inbox and account settings.
- 07
Back up and launch
Back up database, config/env.php, application files and writable storage, then document a restore procedure before inviting real users.
Run and interpret website diagnostics
Tests execute from the PHP hosting server rather than the visitor’s browser. Location, network route, caching, browser rendering and third-party scripts can therefore produce different results from browser-based tools.
| Observation | What the record means | Review note |
|---|---|---|
| Requested/final URL and redirects | The submitted public URL, each accepted redirect and final destination | Every redirect is resolved and revalidated before following it |
| DNS, connection and TLS | Server-side connection phases available from cURL | Hosting location and network path materially affect these values |
| Time to first byte and total time | Point-in-time server response and transfer timing | Compare repeated runs; do not promise a fixed outcome |
| HTTP status and transfer size | Response state and bytes transferred during the test | Authentication walls, error pages and caching may change the result |
| Compression and resources | Detected compression plus parsed page resources | This is an HTTP/HTML inspection, not a complete browser rendering trace |
| Technology and security headers | Observable technology signals and selected response headers | Absence is an observation, not proof that the entire system is insecure |
Performance history and branded PDF reports
A completed test becomes a historical technical record. Administrators can review the run, compare context and generate a client-ready report without granting access to another client’s data.
- Review before publishingCheck the requested/final URL, response, redirect chain, measurements and automatically generated advice. Correct misleading wording before sharing.
- Explain measurement contextState that results came from the hosting server at a specific time and may differ from a browser, geography, warm cache or later deployment.
- Use client assignmentReports are visible only through the authenticated account assigned to the corresponding website. Recheck ownership before publishing.
- PDF handlingTreat generated PDFs as private client documents. Review the branding and operational detail, then share only through approved channels.
- Comparison requestsUse historical runs to describe change without implying causation, guaranteed rankings or guaranteed commercial results.
Client accounts, invitations and assignments
Ultimate SiteTest Pro has no public self-registration or subscription checkout. Administrators create invite-only client access and remain responsible for every website assignment.
- 01
Create one account per person
Use a unique email address and accurate company identity. Do not share one client login between several people.
- 02
Assign the correct websites
A client sees only explicitly assigned website and report records. Review assignments whenever a person joins or leaves a client organisation.
- 03
Send the invitation
The invitation includes the private client login and a one-time initial password. It must not be forwarded.
- 04
Require first-login replacement
The client must choose a new strong password before using the private portal normally.
- 05
Acceptance-test access
Verify dashboard, assigned websites, report history, report requests, maintenance, support, inbox and account settings with a dedicated test-client account.
- 06
Disable departed users
Disable the account, invalidate access as appropriate and audit website assignments without deleting client reporting history unnecessarily.
Brevo, SMTP and editable notifications
Email is optional, but invitations and operational alerts should not be enabled until the sender identity, authentication and a real delivery test have passed.
| Delivery method | Configuration | Recommended use |
|---|---|---|
| Brevo Transactional API | Verified sender domain/address and a least-privilege transactional API key | Preferred when HTTPS API delivery and provider event visibility are required |
| Authenticated SMTP | Provider hostname, port, TLS mode, username and SMTP/application password | Suitable for Brevo SMTP and other maintained business mail providers |
| PHP mail | Hosting-level sender alignment and outbound mail configuration | Use only when the host explicitly supports reliable authenticated delivery |
Safe connection sequence
- 01
Verify the sender
Complete the provider’s sender-domain and sender-address verification, including SPF, DKIM and DMARC where applicable.
- 02
Save a new credential
Paste the API key or SMTP password once. The saved secret is encrypted using the installation application key and is not displayed again.
- 03
Check the connection
Use the built-in connection action to validate authentication and network access without exposing the saved credential.
- 04
Send a real test
Confirm arrival, sender alignment and provider event status before turning on automatic delivery.
- 05
Review templates and logs
Keep required variables, inspect failed attempts and retry only after correcting the underlying transport or sender problem.
Maintenance reporting and private support
Operational records should describe work actually agreed and completed. The application preserves a private history so email is not the sole record of client service.
- Maintenance subscriptionsRecord the correct client, website, service status, cadence and next reporting date for genuine support agreements.
- Maintenance reportsDocument completed updates, backups, security/performance observations, findings and recommendations accurately before publishing a client PDF.
- Report requestsClients can request performance, comparison or maintenance reporting without receiving administrator access.
- Support ticketsUse category, priority, status and private replies to maintain an auditable support conversation. Never use tickets as a password vault.
- Private inboxIn-app notices keep important application events available even when an email is delayed or rejected.
Administrator control areas
The focused administration area separates account access, test operations, client delivery and system configuration. Every state-changing action requires authentication, role authorization and CSRF validation.
| Area | Primary purpose | Operational caution |
|---|---|---|
| Dashboard and Websites | Review activity, add authorised sites and manage ownership | Archive or reassign where possible before removing linked history |
| Run Test and Reports | Execute diagnostics, inspect results and publish reports | Review automated advice and client assignment before sharing |
| Clients and Requests | Create invitations, assign websites and handle access/report requests | One account per person; expire sensitive invitations and reset links |
| Maintenance and Support | Record genuine service work and private conversations | Do not include credentials or unrelated personal data |
| Notifications and Email Log | Edit event wording and review delivery attempts | Preserve variables; fix the cause before retrying |
| Activity and Licence | Review audit history and signed licence status | Use manual validation; never edit signed/local licence data to bypass the service |
Signed one-product, one-domain licensing
The licensing server is authoritative for product, hostname, activation, expiry, suspension and revocation. The distributed package contains only the public verification material required to validate signed responses.
- Keys are issued only by shop.freygabor.com after a verified purchase. The package never generates, releases, transfers or resets licence keys.
- One key is valid for Ultimate SiteTest Pro on one exact normalized domain. A different root, www hostname or subdomain needs a separate licence unless the official service explicitly states otherwise.
- Activation sends the key, product identifier, version, canonical hostname, environment and installation UUID from PHP over HTTPS.
- Accepted responses are verified locally with RSA-SHA256. The private signing key and licensing master secrets are never distributed.
- The complete key required for controlled validation and same-domain recovery is encrypted with AES-256-GCM derived from the installation application key; interfaces and logs show only a masked hint.
- Periodic validation is cached. A temporary network failure enters only a finite grace period while the last signed token remains valid; a timeout is not revocation.
- Explicit invalid, expired, suspended or revoked status—or grace expiry—protects application content without deleting client, test, report, maintenance or support records.
Production security checklist
Secure defaults reduce risk, but the operator remains responsible for supported hosting, authorised use, account lifecycle, mail/payment provider security and tested recovery.
- Force HTTPS; retain HSTS, Content Security Policy, clickjacking, MIME-sniffing, referrer and permissions headers.
- Keep config/env.php, database assets, storage, logs, public verification keys and installed.lock inaccessible over HTTP.
- Use a database account limited to this database, unique administrator/client passwords and hosting-account multi-factor authentication.
- Retain cookie-only secure sessions, HttpOnly/SameSite cookies, regeneration after login, CSRF checks, prepared PDO statements, output escaping and login throttling.
- Do not weaken Tester.php private/reserved-network, DNS-rebinding, redirect, credential-in-URL or port protections.
- Review generated reports before sharing because URLs, findings and operational detail may be client-confidential.
- Keep PHP, Apache and MySQL/MariaDB on supported security releases; log production failures privately and show generic public errors.
Back up, restore and update safely
A usable backup includes data and the installation-specific cryptographic/configuration material needed to read saved credentials and validate the installed state.
Back up together
- The complete MySQL or MariaDB database, including migration and installation metadata.
- config/env.php and any protected environment configuration containing the application key.
- The complete application package and writable storage, including installed.lock and cached licence state.
- Generated/private report assets and other operator-created files retained by the deployment.
- Encrypted off-site copies with a documented retention policy and regular restoration tests.
Update sequence
- 01
Read the release notes
Confirm supported PHP/database versions, changed files and supplied migrations before touching production.
- 02
Create and verify a backup
Back up database, configuration, application and storage, then confirm the archive can be read.
- 03
Use a protected test copy
Test under the product’s valid exact-domain policy without copying production activation material to an unlicensed hostname.
- 04
Deploy documented changes
Preserve environment configuration and writable customer data. Run only migrations supplied with the release.
- 05
Run acceptance checks
Verify administrator and client login, tests, reports/PDFs, assignments, email, maintenance, support, licensing and production error pages.
Brand and interface customization
Production has no Node.js requirement. The supplied CSS and PHP views can be adapted after a complete backup while retaining accessibility, authorization, output escaping and commercial authorship notices.
- Brand identityUpdate approved business wording, logo assets, sender identity and report branding without representing fictional demonstrations as real client work.
- Colour and typographyEdit the documented CSS variables and component styles, then recheck contrast, visible focus, hover states, error states and reduced-motion behaviour.
- Notification copyEdit subjects and bodies from administration while preserving the replacement variables required by each event.
- Security-sensitive codeRetain authorization, CSRF, prepared statements, safe redirects, session controls, mail-header validation, SSRF defenses, protected paths and signature verification.
- AuthorshipRetain Frey Gabor, FreyDesigns and Developments, copyright and included commercial-licence notices. Do not claim ownership of third-party libraries.
Common installation and operating problems
Use the friendly browser message, private application log and hosting control panel together. Redact personal data and every secret before sharing diagnostics.
Folders are listed instead of the installer
Point the hostname at the directory containing index.php, enable DirectoryIndex and Apache .htaccess overrides, preserve the supplied .htaccess file and disable directory listing.
The installer keeps appearing
config/env.php or storage/installed.lock is absent. On a new site, finish every step. On an existing site, do not reinstall over live data; restore the protected files from backup or contact support.
The database connection fails
Use the exact database host, port, prefixed database and username from the hosting panel and grant that user privileges on the database. The installer intentionally hides detailed credential errors.
A migration was interrupted
Back up the partial database and return to the database-installation step. Retry-safe tables, migration history and duplicate-safe seeds allow a controlled retry.
Licence activation or manual validation fails
Confirm HTTPS, exact canonical hostname, outbound HTTPS to shop.freygabor.com and the product/domain state in the licensing account. Never edit local signed state or reveal the complete key.
A website cannot be tested
Confirm it is an authorised public HTTP/HTTPS site on port 80 or 443 with compatible public DNS. Local/private/reserved addresses, embedded credentials, unsafe redirects and unresolvable destinations are blocked intentionally.
Results differ from a browser performance tool
The PHP server has a different location, network and rendering model. Compare repeated runs and explain caching, geography and browser-rendering differences.
A client sees no websites or reports
Confirm the account is active and explicitly assigned to the correct website. Do not weaken authorization checks to make records visible.
Email connection succeeds but delivery is missing
Confirm the exact sender is verified, send a real test and review the application Email Log, spam folder and provider events plus SPF, DKIM and DMARC alignment.
PDF generation or download fails
Confirm the required DOM/XML support, writable private storage and that the requested record belongs to the signed-in administrator or assigned client. Review private logs for the friendly error code.
Frequently asked questions
Short answers to common installation, ownership, licensing and support questions.
Where are the administrator and client logins?
After successful installation and activation, use /admin-login for administrators and /client-login for invited clients.
Can visitors create their own client accounts?
No. Client access is invite-only. The public request centre can collect access or report requests for administrator review.
Does Ultimate SiteTest Pro use Google PageSpeed or another paid testing API?
No. Core website diagnostics run from the installed PHP hosting server through the application’s protected tester.
Which websites may I test?
Only public HTTP/HTTPS websites you are authorised to assess. Tests are restricted to ports 80 and 443 and reject private/reserved destinations and unsafe redirects.
Why do results differ from my browser?
Server location, network route, caching, connection reuse, browser rendering and third-party scripts differ. Treat each result as a point-in-time technical observation.
Are security-header observations a complete security audit?
No. They report selected observable response headers and technical signals; they are not penetration testing, legal advice or proof of overall security.
How does a client receive a new report?
Assign the website to the correct client, review and publish the completed report, then use the configured notification workflow. The client opens it inside the authenticated portal.
Can clients see one another’s websites or reports?
No. Client routes enforce explicit website ownership/assignment. Test this isolation with a dedicated acceptance account before launch.
Which email methods are supported?
Brevo Transactional API, authenticated SMTP and host PHP mail are supported. Verify the sender, check the connection and send a real test before enabling automation.
Are maintenance reports automatic proof that work was completed?
No. Administrators must record genuine agreed work accurately and review each client-facing report before publication.
Can the same licence be used on another subdomain?
No. Each different exact normalized domain or subdomain requires its own licence unless the official licensing service explicitly documents otherwise.
What happens during a licensing-server outage?
A verified cached token can continue only within the finite permitted grace period. A timeout is not treated as revocation, and the grace period is never extended indefinitely.
Does an invalid licence delete client data?
No. Invalid, expired, suspended or revoked status protects application content without deleting accounts, tests, reports, maintenance records or support history.
Does production require Node.js?
No. Production uses PHP, MySQL or MariaDB, the supplied CSS and application JavaScript.
What should a support request include?
Include product version 1.0.0, PHP and database versions, exact hostname, expected behaviour, reproducible steps, time of failure and redacted log excerpts. Never include passwords, complete licence keys, application keys, API secrets or personal data.
Changelog
Review the release notes before updating an installed website.
Initial commercial release
- Added the protected eight-step first-run installer, retry-safe migrations, database installation metadata and atomic installation lock.
- Added signed exact-domain FreyDesigns activation, cached validation, same-domain recovery and a finite offline grace period.
- Added secure administrator and invite-only client portals, first-login password replacement and protected recovery.
- Added public HTTP/HTTPS diagnostics with redirect revalidation, private-network, unsafe-port and DNS-rebinding protections.
- Added response, redirect, DNS, connection, TLS, first-byte, transfer, compression, resource, technology and selected security-header observations.
- Added historical results, client assignment, branded performance reports and downloadable PDFs.
- Added public access/report requests, maintenance subscriptions, maintenance reporting, support tickets and private inbox notifications.
- Added editable event templates, delivery logs, retries, PHP mail, authenticated SMTP and Brevo Transactional API delivery.
- Added secure sessions, CSRF validation, prepared PDO statements, output escaping, login throttling, safe redirects and production security headers.
- Added commercial authorship, licence, third-party, installation, administration, setup, email, security and troubleshooting documentation.
Send a safe, reproducible support request.
Include SiteTest Pro version 1.0.0, PHP and database versions, the final hostname, expected behaviour, steps to reproduce and redacted log excerpts.
Do not send passwords, API secrets, database dumps, application keys or a complete licence key.