Built by 
Why Halden House
What makes it better
than the alternatives
- 01
Seven interchangeable designs
Switch themes without losing content; every design has rooms, tours, properties, blog, services, team, gallery, contact and booking pages
- 02
Booking engine for rooms, tours and properties
Availability per night with units, minimum stay, guest limits, seasonal rates, taxes, fees, deposits, and unpaid hold expiry
- 03
Stripe Checkout integration
Test mode, live mode, webhook handler for payment confirmation, refunds, guest cancellation requests, and booking confirmation emails
- 04
English + Arabic (RTL)
Translatable content fields, Arabic fonts, mirrored layouts, /ar prefix, and language switcher in the admin panel
- 05
Public demo mode
/Landing page, demo admin account, design switcher for visitors, automatic content reset, and iframe embedding for portfolios
Website (7 designs)
- Luxury Hotel
- Beach Resort
- Boutique Hotel
- Travel Agency
- Vacation Rentals
- Travel Corporate
- Hotel Group themes
- Rooms & suites
- tours
- holiday homes
- offers
- destinations
- services
- team
- gallery
- blog
- FAQ
- contact pages
- Online booking widget with date/guest search
- live prices
- guest details
- review
- payment and confirmation
- Multi-currency display (AED base
- USD option)
- seasonal rates
- taxes
- fees
- deposit percentage
- Arabic (RTL) site with /ar prefix
- mirrored layouts
- Arabic fonts
- translatable content fields
Booking & Payments
- Availability per night with room counts
- minimum stay
- guest limits
- closed dates
- Stripe Checkout (test/live modes)
- webhook handler for checkout.session.completed
- charge.refunded
- Test payment page (local
- no Stripe needed)
- full payment or deposit
- VAT/taxes
- fees
- Guest confirmation page
- printable receipt
- My booking lookup (reference + email)
- Cancellation requests from guests
- admin cancellation with refunds
- unpaid hold expiry (cron)
Admin Panel
- Dashboard with bookings
- revenue
- leads
- visitors
- top pages
- devices
- countries (last 30 days)
- Section editor for every page: text
- images
- lists
- colours
- fonts
- visibility
- order
- Bookings list (confirmed
- pending
- cancelled
- expired)
- manual bookings
- payment recording
- refunds
- notes
- Leads (contact forms)
- subscribers (newsletter)
- media library
- blog posts
- rooms
- tours
- properties
- Settings: site name
- logo
- menus
- social links
- SMTP
- Stripe keys
- reCAPTCHA
- currencies
- booking terms
Content Modules
- Rooms (name
- slug
- summary
- description
- amenities
- images
- base rate
- pricing
- limits
- availability)
- Tours (name
- slug
- summary
- description
- images
- pricing per traveller
- departure dates
- seats)
- Properties (holiday homes: name
- slug
- summary
- description
- images
- pricing per night
- cleaning fee)
- Blog posts (title
- slug
- excerpt
- content
- featured image
- published date
- meta tags)
- Services (name
- slug
- summary
- description
- icon
- order)
- team members (name
- role
- bio
- photo
- department)
Forms & Leads
- Contact form (name
- company
- phone
- message
- service
- budget
- extra fields)
- Newsletter subscription (email
- language
- source URL
- IP
- status: subscribed/unsubscribed)
- reCAPTCHA v3 integration (site key
- secret key
- min score 0.5)
- spam detection (hidden fields
- instant submit)
- Lead management (new
- contacted
- qualified
- converted
- lost)
- CSV export
- email notifications
- Consent checkbox for GDPR
- email templates (contact confirmation
- newsletter welcome
- booking confirmation)
Themes & Design
- Theme switcher (7 installed themes)
- preview mode (signed URLs
- draft sections
- theme override)
- Section editor: text fields
- images
- lists
- colours
- fonts
- visibility
- order
- snapshot overrides
- Bindings: fill section lists from content modules (rooms
- offers
- reviews
- FAQ
- blog) per theme.json
- Header/footer editor (menus
- logo
- social links
- copyright)
- branding (logo
- favicon
- colours
- fonts)
- RTL support (Arabic fonts
- mirrored layouts
- direction arrows)
- responsive (mobile
- tablet
- desktop)
Analytics & Tracking
- Visitor tracking (page views
- referrers
- devices
- countries
- browsers
- OS) without cookies
- Dashboard charts (bookings
- revenue
- leads
- visitors
- top pages
- devices
- countries) for last 30 days
- MaxMind GeoLite2 database for country detection (IP → country code)
- user agent parsing (device
- browser
- OS)
- Activity log (admin actions: login
- logout
- booking created
- payment recorded
- theme changed)
- CSV export for leads
- bookings
- subscribers
Users & Security
- Two roles: administrator (full access)
- editor (no settings
- users
- email templates)
- Admin login (email + password)
- session timeout (120 minutes)
- password requirements (12+ chars
- mixed case
- numbers
- symbols)
- Activity log (login
- logout
- failed login
- booking created
- payment recorded
- theme changed)
- Security headers (X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy)
- CSRF protection
- signed URLs
- Demo mode (public demo account
- /landing page
- design switcher
- automatic content reset every 60 minutes)
Email & Notifications
- SMTP settings (host
- port
- username
- password
- encryption)
- sender address and name
- Email templates (contact confirmation
- newsletter welcome
- booking confirmation
- booking cancelled
- cancel request)
- Booking emails (confirmation
- receipt
- cancellation
- cancel request) with tokens (name
- reference
- dates
- total)
- Lead notifications (contact form submissions) to admin email
- Queue worker (php artisan queue:work) for background email sending
Media & Assets
- Media library (upload
- delete
- search
- filter by type)
- image optimization (spatie/image)
- Public storage (public/storage symlink)
- private storage (storage/app/private)
- Theme assets (CSS
- JS
- fonts
- icons) in public/themes/<slug>/
- Shared front-end files (fonts
- icons
- main.js
- halden.js
- rtl.css
- Arabic fonts) in public/themes/_halden/
- Brand assets (logo
- favicon
- apple-touch-icon) in public/brand/
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| PHP | — | — | Web, API | 57.1% |
| CSS | — | — | Styling | 26.4% |
| Python | — | — | Web, API | 6.4% |
| SQL | — | — | Database | 5.2% |
| JavaScript | — | — | Front-end | 4.5% |
| Shell | — | — | Scripts | 0.5% |
- Primary language
- PHP 8.2+
- Framework
- Laravel 12.69
- Database
- MySQL 8 / MariaDB 10.6+
- Authentication
- Laravel session-based authentication with bcrypt password hashing
- Licence
- Single-site
- Screens
- 42
- Database tables
- 39
- Supported languages
- English, Arabic (RTL)
- Browser support
- Modern browsers (Chrome, Firefox, Safari, Edge)
| Minimum | Recommended | |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 2 GB RAM | 4 GB RAM |
| OS | PHP 8.2+, Composer, Node.js 18+, MySQL 8 / MariaDB 10.6+ | PHP 8.2+, Composer, Node.js 18+, MySQL 8 / MariaDB 10.6+ |
| Est. monthly hosting | $15 | $15 |
```bash cp docker.env.example .env # Edit .env: set DB_PASSWORD, DB_ROOT_PASSWORD, ADMIN_PASSWORD docker-compose up -d docker-compose exec app php artisan migrate docker-compose exec app php artisan cms:install --all-themes --email=you@example.com # Site: http://localhost:8080 Admin: http://localhost:8080/admin ```
```bash
sudo apt update && sudo apt install -y php8.2 php8.2-{cli,fpm,mysql,mbstring,xml,curl,zip,gd,intl,bcmath} composer nginx mysql-server nodejs npm
cd /var/www
sudo git clone <repo> halden && cd halden/Laravel\ Project
composer install --no-dev --optimize-autoloader
npm ci && npm run build
cp .env.example .env
# Edit .env: APP_ENV=production, APP_DEBUG=false, APP_URL, database credentials, SESSION_SECURE_COOKIE=true
php artisan key:generate
php artisan migrate --force
php artisan cms:install --all-themes --email=you@example.com
sudo chown -R www-data:www-data storage bootstrap/cache
sudo chmod -R 775 storage bootstrap/cache
# Configure Nginx: root /var/www/halden/Laravel Project/public; try_files $uri $uri/ /index.php?$query_string;
# Add cron: * * * * * cd /var/www/halden/Laravel\ Project && php artisan schedule:run >> /dev/null 2>&1
``````bash # Upload files to public_html/halden cd public_html/halden/Laravel\ Project composer install --no-dev --optimize-autoloader npm ci && npm run build cp .env.example .env # Edit .env via File Manager: APP_ENV=production, APP_DEBUG=false, APP_URL, database from cPanel MySQL, SESSION_SECURE_COOKIE=true php artisan key:generate php artisan migrate --force php artisan cms:install --all-themes --email=you@example.com # In cPanel: set document root to public_html/halden/Laravel Project/public # Add cron job: * * * * * cd ~/public_html/halden/Laravel\ Project && php artisan schedule:run ```
```bash cd Laravel\ Project composer install npm ci && npm run build cp .env.example .env php artisan key:generate # Edit .env: APP_ENV=local, APP_DEBUG=true, DB_CONNECTION=sqlite, DB_DATABASE=/tmp/halden.sqlite, SESSION_SECURE_COOKIE=false touch /tmp/halden.sqlite php artisan migrate php artisan cms:install --all-themes --email=test@example.com --password=TestPass123! php artisan serve # Site: http://127.0.0.1:8000 Admin: http://127.0.0.1:8000/admin ```
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (3 minor)
No real credentials found; weak demo password generation in setup docs needs attention; authorization mostly solid; missing ownership checks on booking/lead reads and demo mode bypass; database access mostly safe; minor schema gaps (missing indexes on foreign keys); moderate code duplication and some oversized files; architecture is sound but refactoring needed; build reproducible with gaps: missing node version, unclear docker setup, incomplete prerequisites. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
