Small PHP sites, thoughtfully configured.

Render pages on the server, keep configuration private and expose only the public document root.

The public directory is a boundary

Serve public/, not the project root. Keep credentials, Composer files and internal configuration outside it. The starter escapes dynamic HTML output and includes a separate health endpoint.

Local PHP is not production PHP

php -S is a convenient local test tool, not a public production server. Choose PHP site for the managed web-server integration. Select an enabled PHP version and check that its image includes the extensions your site requires.

Database and sessions are separate choices

This starter does not create user accounts or a database. Add parameterized queries, session protection and authorization when needed. Database credentials must come from environment configuration, never a public PHP file.

Uploads need their own policy

If you add uploads, define size and type limits and prevent execution of uploaded files. Persistent content and backups consume storage. A successful page render is not a security audit.

A minimal public directory

public/
  index.php
  health.php
  style.css
.env.example   ← outside the document root

No Composer dependency or database is required for the included example.

Plan your resources

Try a concrete starting point

Websites

PHP website

A small server-rendered site with escaped output and a JSON health endpoint.

7 files · instructions includedExplore project

Enabled profiles can be deployed from the panel. Configure addresses and HTTPS in Domains; a custom domain requires DNS verification. No performance or availability guarantee is implied.