FaithChurch Pro
v1.5.2

Required PHP extensions

Option A: the domain already exists in cPanel

Option B: create a new domain or subdomain

In cPanel's Domains interface, create the registered domain or subdomain and give it its own document root. Do not accidentally share the document root with another live website unless that is intentional.

Enable HTTPS before payment or social-login testing

Use cPanel SSL/TLS Status or your host's AutoSSL interface and confirm that https://yourdomain.com loads without a certificate warning. Payment webhooks and OAuth callbacks should use HTTPS in production.

your-domain-document-root/
├── .htaccess
├── index.php
├── bootstrap.php
├── app/
├── database/
├── documentation/
├── public/
├── server/
├── storage/
└── views/

Permissions

Start with normal hosting permissions: directories 0755 and files 0644. The storage/ directory must be writable by the PHP process. If ownership on your host requires it, the host may recommend 0775 for writable directories. Avoid using 0777 as a permanent fix.

Step 1 of 4: Verify your DevWeb Themes purchase

Step 2 of 4: Server check

The installer checks pdo, pdo_mysql, curl, openssl, mbstring, fileinfo, sodium, and whether storage/ is writable. Do not continue by editing source code to bypass a missing extension; enable the missing module in cPanel/PHP Selector or contact the host.

Step 3 of 4: Connect the database

Enter the database values created earlier. On success FaithChurch writes the environment configuration, generates an application key when required, and creates the database tables from database/schema.sql.

Step 4 of 4: Create the church and administrator

• Open https://yourdomain.com/login and sign in with the administrator you created.
• Open /admin and confirm the dashboard loads.
• Go to Admin → Settings and replace the example church contact details.
• Go to Admin → Appearance and set your colours, homepage copy and hero.
• If you want starter content, use Admin → Demo Import before creating a large amount of your own content.
• Configure payment gateways in test/sandbox mode and complete a real end-to-end test transaction.
• Configure Google/Facebook login only after HTTPS and the final domain are correct.
• Review every starter legal page and adapt it to the laws and procedures of your organisation.
• Back up the new database and application once the first configuration is complete.

The installer activates against the current site hostname automatically. If you later move the production installation to a different domain, deactivate the old domain in the DevWeb customer license page before activating the new production domain.

FaithChurch provides three official presets:

How the import works

The application downloads structured JSON from the configured DevWeb demo-content service. It verifies the package with the included Ed25519 public key before changing the database. Existing demo records with the same type and slug are updated instead of duplicated.

Font choices included

• Modern System / Inter style – the default modern UI stack.
• Aptos – a softer office/system presentation.
• Editorial Serif – Georgia/Cambria style for a more traditional editorial feel.

Hero media

Editable homepage text

The same Appearance screen lets you edit the Hero heading/text, Welcome heading/text, Giving heading/text, Giving quote/reference, Community heading/text and Visit heading/text.

Motion controls

Premium preloader controls the branded loading screen. Smooth reveal animations controls public reveal motion. Disable animation if the organisation prefers a more static presentation.

Click Save all settings after editing this screen. Payment, social login, storage and AdSense settings are on the same page and are explained separately below.

The admin sidebar has dedicated managers for Sermons, Events, Ministries, Leadership, Testimonies, Pages & Policies, and Blog.

Shared editor fields

Every content editor provides Title, Slug, Short description, Main content, Status, Publish date and Featured image. Draft content remains out of the published public queries until you publish it.

Featured-image rules

JPG, PNG and WebP images are accepted up to 8 MB. The server reads the real MIME type instead of trusting the filename and rejects invalid image dimensions.

FaithChurch installs core pages such as About, Give, Prayer, Contact, Privacy Policy, Terms, Donation & Refund Policy, Cookie Policy and Accessibility. Core URLs are protected from accidental slug changes and deletion, but their public content remains editable.

Page settings

Simple page formatting

## Section heading
### Smaller heading
- First bullet item
- Second bullet item

Normal paragraph text.

FaithChurch safely escapes page content; it is not a raw HTML editor. Use the simple heading and list syntax above.

Sitemap and robots

The public application exposes /sitemap.xml and /robots.txt. After launch, submit the sitemap URL to the search engines you use and confirm that pages you intentionally set to noindex are not submitted as important landing pages.

Public users can register and manage a member account. Staff accounts have additional capabilities based on their role.

How FaithChurch protects the payment result

FaithChurch creates a pending donation record before redirecting to the gateway. On callback/webhook it verifies with the provider and compares the returned amount and currency with the local donation before marking the record paid. Webhook deliveries are signature-checked where the provider supplies signatures, then the transaction is re-verified through the provider API.

Default currency

Enter a three-letter currency code such as ZAR, USD or another currency supported by the gateway and your merchant account. A syntactically valid three-letter code does not guarantee that every provider/account supports that currency.

Google

Facebook

Google callback
https://YOUR-DOMAIN/auth/google/callback

Facebook callback
https://YOUR-DOMAIN/auth/facebook/callback

Local storage

This is the simplest option. Uploaded media is stored below public/uploads/ in folders such as content, hero, avatars and credentials. The application creates required upload folders as needed.

S3 storage

Select Amazon S3 / S3 compatible in Admin, but place infrastructure credentials in .env. FaithChurch intentionally does not expose S3 access keys through the normal admin form.

AWS_ACCESS_KEY_ID="YOUR_ACCESS_KEY"
AWS_SECRET_ACCESS_KEY="YOUR_SECRET_KEY"
AWS_DEFAULT_REGION="af-south-1"
AWS_BUCKET="your-bucket-name"
AWS_ENDPOINT=""
AWS_USE_PATH_STYLE=false

FaithChurch v1.5.2 includes an SMTP service and environment variables, but the core contact/prayer workflows currently store submissions in Admin → Messages & Prayer rather than automatically emailing them. There is also no SMTP settings form in Admin in this release.

If you are extending the bundled SMTP service or a later update connects it, the packaged environment keys are:

MAIL_DRIVER=smtp
MAIL_HOST=mail.yourdomain.com
MAIL_PORT=587
MAIL_USERNAME=no-reply@yourdomain.com
MAIL_PASSWORD="YOUR_MAILBOX_PASSWORD"
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=no-reply@yourdomain.com
MAIL_FROM_NAME="Your Church Name"

The bundled mailer supports STARTTLS when MAIL_ENCRYPTION=tls. Port 587 + STARTTLS is the safest documented choice for this implementation. Do not assume implicit TLS on port 465 works without testing or code changes.

You can enable AdSense and enter the publisher client ID such as ca-pub-.... When enabled with a client ID, the public layout loads the Google AdSense script.

The Partner area is more than a donation tier. It includes partner profiles, contribution state, care requests, prayer workflow, sessions/meetings, resources and Covenant formation tools.

Core partner settings

Administrators with partners.manage can configure partner currency, Family minimum amount, Covenant minimum amount, suggested contribution values, Covenant grace days, public headings/descriptions, benefit lists, formation copy, credential notes, integrity copy and partnership FAQs.

Operational sections

Covenant training modules support title, description, category, display order, HTTPS resource URL and draft/published status. Admin can record each Covenant Partner as not started, in progress or completed, together with a mentor note.

Formation standing values

formation, mentoring, ready_for_review, released, ordained or paused. Badge status can be active or suspended.

Credential types

Completion, Release, Ordination and Recognition. Issuing a credential creates a certificate number and random verification code. The public verification route is /credential/verify/{code}.

Optional uploaded certificate files use the normal storage driver. If you use S3, read the direct-object-URL warning in the Storage section before storing sensitive certificates there.

Public Contact and Prayer forms create message records that appear in this admin screen. Staff with messages.manage can change message status to New, Reviewed or Archived.

This is the primary built-in inbox in v1.5.2. As noted in the Email section, the current core flows do not automatically send these records by SMTP.

The donations table shows Reference, Donor, Amount, Gateway, Status and Date. Payment attempts begin as pending, can become paid only after provider verification, or become failed when initiation/verification fails.

cPanel / Apache / LiteSpeed

The commercial package includes a root .htaccess for buyers who extract the full package directly into the domain document root. It blocks direct web access to application internals such as app/, database/, storage/, server/, views/ and documentation/; public assets are internally mapped from public/.

Nginx / VPS preferred layout

On a server where you control the virtual host, keep the application outside the public web root and set the virtual host root to the package's /public directory. An example configuration is included at server/nginx.conf.example.

server {
    listen 80;
    server_name example.com;
    root /var/www/faithchurch/public;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
    }

    location ~ /\. { deny all; }
}

Subfolder installation

The routing helpers detect a mount path such as https://example.com/church. OAuth, payment and webhook URLs must then include that same subfolder, for example https://example.com/church/webhooks/stripe. For less experienced buyers, a dedicated domain/subdomain is easier to configure and troubleshoot.

• Use HTTPS before accepting logins, payments or OAuth callbacks.
• Keep APP_ENV=production and APP_DEBUG=false.
• Never publish or email your .env, database password, gateway secrets, OAuth secrets or S3 secret.
• Keep the DevWeb license mode remote. Do not create a local bypass.
• Use a unique administrator password and remove/restrict staff access when personnel change.
• Keep PHP, MySQL/MariaDB and the web server updated through your host/server maintenance process.
• Use real payment webhooks and test failed, cancelled, duplicate and successful payment cases.
• Back up before theme/source updates and test restore procedures.
• Keep normal file permissions and correct ownership; do not leave the whole site writable.
• Review every starter legal policy for your jurisdiction before launch.

FaithChurch v1.5.2 includes CSRF protection for state-changing forms, login/payment rate limiting, prepared PDO queries, secure password hashing, strict session settings, upload MIME/size validation, upload execution protections, Content Security Policy, HSTS on HTTPS, X-Frame-Options and other browser security headers.

Minimum backup set

• Export the FaithChurch MySQL/MariaDB database.
• Download or archive the application files, especially .env, storage/ and public/uploads/.
• If using S3, confirm the bucket has the retention/versioning/backup policy appropriate to your organisation.
• Keep backups outside the public website directory and preferably off the hosting server as well.

Applying future DevWeb updates

Read the update notes first. A safe update package should tell you exactly which files it replaces and whether a database change is required. Never overwrite your production .env with an example environment file.

Environment variables shipped in .env.example

APP_NAME
APP_ENV
APP_DEBUG
APP_URL
APP_KEY
APP_TIMEZONE
SESSION_NAME

DB_CONNECTION
DB_HOST
DB_PORT
DB_DATABASE
DB_USERNAME
DB_PASSWORD

DEVWEB_PRODUCT_SLUG
DEVWEB_LICENSE_MODE
DEVWEB_LICENSE_ENDPOINT
DEVWEB_DEMO_BASE_URL
DEVWEB_DEMO_PUBLIC_KEY

MAIL_DRIVER
MAIL_HOST
MAIL_PORT
MAIL_USERNAME
MAIL_PASSWORD
MAIL_ENCRYPTION
MAIL_FROM_ADDRESS
MAIL_FROM_NAME

GOOGLE_CLIENT_ID
GOOGLE_CLIENT_SECRET
GOOGLE_REDIRECT_URI
FACEBOOK_CLIENT_ID
FACEBOOK_CLIENT_SECRET
FACEBOOK_REDIRECT_URI

AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
AWS_DEFAULT_REGION
AWS_BUCKET
AWS_ENDPOINT
AWS_USE_PATH_STYLE

• The final domain resolves to the correct hosting document root.
• HTTPS loads without warnings and HTTP redirects according to your hosting policy.
• The DevWeb license is active on the correct domain.
• Administrator and member login work.
• Primary, Navy, Accent, Background and Text colours have been reviewed on desktop and mobile.
• Hero image/copy, service information, church address, phone and email are correct.
• Demo/sample content has been replaced or intentionally retained.
• Sermons, Events, Ministries and public pages open correctly.
• Privacy, Terms, Donation & Refund, Cookie and Accessibility wording has been reviewed for the organisation's jurisdiction.
• Every enabled gateway has been tested end-to-end, including webhook delivery.
• Google/Facebook callbacks point to the production domain.
• Storage uploads work and any S3 object-access policy is intentional.
• Prayer/contact messages reach Admin → Messages & Prayer.
• Partner registration, dashboard, meetings/resources and Covenant tools have been tested if enabled operationally.
• /sitemap.xml and /robots.txt load correctly.
• APP_DEBUG=false and production secrets are not exposed.
• A complete post-configuration database/file backup exists off the public web root.

Third-party dashboards change over time. If a menu label in this manual moves, use the provider's official documentation below and keep the FaithChurch-specific values (webhook paths, callback paths and fields) exactly as documented above.