Download the PHP package golovanov/weft without Composer

Weft

A lightweight PHP 8.4 engine for quickly launching simple websites — SEO, optional multilingual routing, caching, request tracing and form protection out of the box. You write pages and a little business logic; the engine handles the rest.

Weft is for content-first sites: landing pages, portfolios, product and documentation sites. It is deliberately not a full-stack framework — no ORM, no DI container, no admin panel.

That file is the whole route. No route table, no controller, no registration.

Why

Every small site re-solves the same problems: clean URLs, locale prefixes, a correct <head>, sitemap, spam-resistant forms, tracing, asset hashing. Weft puts all of it behind a small, convention-driven core so a new site is mostly content.

Features

• Convention routing — pages/about.php → /about, api/contact.php → /api/contact, pages/notes/[slug].php → /notes/anything, pages/wiki/[...path].php → /wiki/any/depth. One address per page: /about/ and /home redirect, a malformed path is a 404.
• SEO under the hood — title templates, canonical, Open Graph, Twitter cards, hreflang and JSON-LD rendered from config + per-page overrides; JSON-LD builders that check required fields, breadcrumbs and pagination with self-canonical pages. Generated /sitemap.xml and /robots.txt.
• Visible to search engines and AI assistants — robots.txt rules per crawler with presets for AI search, user-triggered and training bots; /llms.txt; IndexNow submission of new and changed pages from cron; vendor/bin/weft-seo-audit checks a live site's pages, in CI too.
• Optional i18n — off by default. Turn it on and the default locale stays prefix-free (/about), others get /ru/about, with automatic hreflang and canonical redirects.
• Optional caching — file or Redis. Cache::remember() is safe even when caching is off.
• Request tracing — one JSONL timeline per request via traceloom, with redaction of sensitive keys. Request bodies are logged by default, so what your forms collect (an email, a phone number, a message) is kept in the trace for app.trace.retention_days days (30 by default) unless you list its key in app.trace.sensitive_keys. Turning app.trace.log_body off drops bodies, not the fields your code records with Trace::event().
• Form protection — rate limiting, CSRF, honeypot and a captcha (Google reCAPTCHA v3 or Yandex SmartCaptcha, off by default), called from your form's endpoint.
• Mail — plain-text UTF-8 email through PHP mail() or SMTP (STARTTLS or TLS), no extra package.
• Alerting for sensitive spots — to AlertLoop, Telegram, email or the error log; best-effort with a timeout, and a failed delivery is recorded on the request trace instead of vanishing.
• Batteries in the engine — HTTP client, PDO wrapper, JWT (firebase/php-jwt), security headers.
• Vite — dev server with HMR, hashed production assets from the manifest, with preload hints for the entry and its statically imported chunks.

Requirements

• PHP 8.4+ with ext-curl and ext-json
• ext-pdo with pdo_mysql only if you use the database (MySQL), ext-redis only for the Redis cache, ext-dom only for vendor/bin/weft-seo-audit
• Node.js 20.19+ or 22.12+ (required by Vite 7) only to rebuild the frontend — not needed to run the example, whose built assets are committed

Install

Weft expects a small site skeleton around it. The fastest way to get one is to clone the repo and copy the example/ directory — it is a complete, working site, and its composer install installs the engine:

In my-site/.gitignore, delete the line /composer.lock, then make my-site a repository (git init) and commit the lock file with your site.

To add the engine to a site skeleton of your own instead, in its directory:

Get the example by cloning, not by "Download ZIP". The package archive is kept lean: example/, tests/ and CI config are export-ignored, so composer require — and GitHub's ZIP / release "Source code" downloads — contain only the engine. git clone gives you everything.

Project layout

Quick start

No build step: the example's built assets are committed, so it runs straight after composer install.

Open http://localhost:8000. The example is the Weft documentation site — it documents the engine while being built with it. With no config/config.php present, it falls back to config/config.example.php (DEV_MODE=false) and serves the committed assets.

Working on the frontend (optional)

Node is needed only to edit styles/JS:

npm run build refreshes the committed public/dist/.

Configuration in two layers

• Environment — config/config.php, plain define() constants: secrets, DB/Redis credentials, DEBUG, DEV_MODE, APP_TIMEZONE. Per server, gitignored.
• Business — app/Configs/app.php, an array read with dot keys: SEO, locales, feature flags, rate limits. Committed.

Everything optional is a flag in app/Configs/app.php:

The captcha needs both keys: enabled without them, it rejects every form submission unless DEBUG is on. Alerts go only to the channels in app.alerts.channels (alertloop, telegram, mail, log); a listed channel without its settings is skipped. vendor/bin/weft-health lists what is missing.

Documentation

Full documentation lives in example/content/en and is served by the example site itself — read it there: links between chapters resolve on the running site, not on GitHub. Start with Getting Started.

Versioning

Weft follows semantic versioning. Pre-1.0 the API may still change between minor versions.

Security

Please report vulnerabilities privately — see SECURITY.md.

License

MIT © Roman Golovanov. See LICENSE.