Manalas Dungeon — case study

What’s on the site

Passwordless administration

The admin pages open only on a registered device — with a fingerprint, face, device PIN or a security key (WebAuthn / FIDO2). The server side is written in plain PHP without external libraries: CBOR decoding, COSE key conversion and ES256 / RS256 signature verification.

WebAuthn
FIDO2
OpenSSL

Trilingual architecture

Every page exists in Latvian, English and Finnish. The language comes from the URL (?lang= or clean /en/, /fi/ paths), with hreflang links and a sitemap for search engines.

hreflang
.htaccess
sitemap

News & travel blog

Two public pages read from one database table — a category decides where an entry appears. A custom admin handles entries, image uploads and a shortcode for placing images in the text.

PDO
CRUD
lightbox

Guestbook

Messages are published after moderation. Spam is stopped by a hidden honeypot field and a per-IP time limit, and the admin receives an email notification.

moderation
honeypot
rate limit

Vitrupe beach gallery

A travel site with a rotating hero image, a masonry gallery and an image viewer you can browse with arrows, the keyboard or a swipe.

Bootstrap 5
JSON-LD
responsive

Vidzeme travel guide

Links to places to eat, sights, nature trails and accommodation, organised by municipality and town, using official tourism sources.

structured data
i18n

New-post badge

The home page button shows the date of the latest news post until the visitor has read it. The state is kept in the browser (localStorage), without cookies.

localStorage
UX

Security

Security was designed in from the start, following the OWASP Top 10 guidance.

Phishing-resistant sign-inPasskeys are bound to the domain, and no passwords are stored on the server.
SQL injection preventionEvery database query uses PDO prepared statements.
XSS protectionAll output is escaped with htmlspecialchars; links in text are created only after escaping.
CSRF protectionEvery admin action — including sign-out — requires a one-time token.
HTTPS onlyAll traffic is redirected to a single canonical HTTPS address.
Safe image uploadsThe file type is checked from its content, size is limited, and PHP execution is disabled in the upload folder.

Tech stack

PHP 8.4
MySQL / MariaDB
PDO
JavaScript
HTML5
CSS3
Bootstrap 5
WebAuthn / FIDO2
OpenSSL
LiteSpeed · .htaccess
Google Analytics 4
Playwright

Quality & testing

Automated tests

38 unit tests for the passkey cryptography and browser tests with a virtual FIDO2 authenticator (Playwright).

Responsive design

Works on phones, tablets and desktops, including a fix for the iPad background-zoom bug.

Performance

Cache busting by file timestamp, gzip compression and optimised images.

SEO

hreflang, Open Graph, structured data (JSON-LD) and a sitemap.