The Urban Static Store

Included capabilities

• Editorial storefrontOriginal graphite, bone and signal-orange campaign design, six collections, product discovery, variant selection, cart and account journeys.
• Commerce workflowSKU-level stock, coupons, Stripe Checkout, signed webhook fulfilment, order history, transactional notifications and password recovery.
• Focused administrationDashboard, catalogue, categories, variants, orders, customers, coupons, content, email, store settings, Coming Soon mode and licence status.
• Protected deliveryRetry-safe database installation, secure sessions, throttled login, encrypted secrets, signed one-domain licensing and finite offline grace.

• Store identityReview name, contact email, currency, timezone, delivery wording, homepage copy, navigation, footer, FAQ and legal policies.
• CatalogueReplace all fictional products, upload properly licensed images, set prices, sizes, colours, unique SKUs and accurate stock for every sellable variant.
• StripeCreate restricted live keys, add the supplied webhook endpoint, subscribe to checkout.session.completed and payment-intent events used by the package, then save the signing secret.
• EmailSave a verified sender, SMTP host, port, encryption and credentials. Send the built-in test before relying on customer or administrator notices.
• Checkout testUse Stripe test mode first. Confirm cart totals, coupon rules, webhook signature, stock decrement, order state, customer history and notifications.

• One key belongs to urban-static-store and one exact normalized hostname.
• The installer sends activation from PHP over HTTPS and verifies the RSA-SHA256 signature locally.
• www, root and every subdomain remain distinct unless the licensing service explicitly returns otherwise.
• The retained licence key is AES-256-GCM encrypted with the random application key; interfaces show only a masked hint.
• Normal traffic uses the signed cache. Remote validation occurs only after its interval or on a manual administrator check.
• Temporary network failure uses a finite grace period and is not treated as revocation.
• Explicit invalid, mismatched, expired, suspended or revoked state protects content without deleting store data.
• A new hostname requires a new licence. The package cannot deactivate, release or substitute a domain locally.

• IdentityReplace the favicon, wordmark text, brand narrative and metadata. Keep the Frey Gabor authorship and commercial-licence notices in distributed source.
• Palette and typographyEdit the documented CSS custom properties for graphite, bone and signal orange, then recheck contrast, focus, hover and error states.
• Product imageryUse consistent aspect ratios, truthful alternative text and commercially licensed optimized images. Avoid embedding private metadata.
• ContentReplace demonstration collections, products, policies, FAQs and editorial text through the focused administration wherever available.
• TemplatesBack up before PHP edits and preserve output escaping, CSRF fields, prepared database access and authorization checks.

• Enforce HTTPS, use unique administrator/database/SMTP/Stripe credentials and enable multi-factor authentication in Stripe and hosting.
• Keep PHP and MySQL or MariaDB supported and current; disable production error display.
• Verify direct browser access to app, config, storage, tests, logs and backups is denied.
• Retain secure cookies, CSRF, prepared statements, throttling, CSP, clickjacking and MIME-sniffing protections.
• Back up the database, uploaded product images, config.php, application key, atomic lock and storage/licence together.
• Test restores only on the same licensed domain. Never copy production Stripe secrets into a staging clone.
• Before updating, read the changelog, back up, preserve config and uploads, apply changed files, then retest checkout and licence validation.