ViralBoxy – viral images, videos & memes sharing platform

Thank you for purchasing ViralBoxy! This guide takes you from upload to a running community site, and explains every part of the admin panel.

If anything is unclear, see Troubleshooting and FAQ, or contact support.

System requirements

The installer checks all of this automatically in step 2 and tells you what is missing.

Package contents

Installation on cPanel (recommended)

1. Create a database. cPanel → MySQL® Database Wizard: create a database, create a user with a strong password and give the user ALL PRIVILEGES on the database. Write down the three values.
2. Upload the files. cPanel → File Manager → open public_html (or the folder of your subdomain) → Upload the file upload.zip from the package (zip the contents of upload/ first if needed) → right-click → Extract. The files index.php, .htaccess, app/, assets/ … must be directly in the web root.
3. Show hidden files. In File Manager → Settings → tick Show Hidden Files and check that .htaccess was uploaded.
4. Choose PHP 8.1+. cPanel → Select PHP Version (or MultiPHP Manager) → PHP 8.2 and enable the extensions listed above.
5. Run the installer. Open your domain in the browser – you are redirected to /install/. Follow the six steps.
6. Finish. Delete the install folder and set up the cron jobs.

Installation with FTP

1. Create the database as described above (any hosting panel works: Plesk, DirectAdmin, ISPConfig…).
2. Connect with an FTP client (FileZilla, WinSCP, Cyberduck) and upload the contents of upload/ to your web root. Use binary transfer mode and make sure hidden files (.htaccess, .user.ini) are uploaded.
3. Set permissions: folders 755, files 644; uploads/ must be writable (755 on suPHP / PHP-FPM hosts, otherwise 775).
4. Open your domain in the browser and follow the installation wizard.

Apache & LiteSpeed

The included .htaccess does everything: friendly URLs, protection of configuration and source folders, long cache headers for images and versioned assets. It needs mod_rewrite and AllowOverride All for the site folder. On a VPS:

<Directory /var/www/viralboxy>
    AllowOverride All
    Require all granted
</Directory>
# sudo a2enmod rewrite headers expires && sudo systemctl reload apache2

Nginx

Nginx ignores .htaccess. Use this server block (adjust paths and the PHP-FPM socket):

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    root /var/www/viralboxy;
    index index.php;
    client_max_body_size 40m;

    # versioned assets: /assets/v123/css/... → /assets/css/...
    location ~ ^/assets/v\d+/(.+)$ { try_files /assets/$1 =404; expires 1y; add_header Cache-Control "public, immutable"; }

    # never serve configuration, source code, data or tools directly
    location ~ ^/(app|database|docs|tests|tools|cron|backups|languages|license-server)(/|$) { rewrite ^ /index.php last; }
    location ~ ^/(config(\.local)?\.php|install\.lock)$ { deny all; }
    location ~ ^/install/(src|views)/ { deny all; }
    location ~ /\. { deny all; }
    location ~ \.(sql|md|example|log|neon)$ { deny all; }

    location /uploads/ { location ~ \.php$ { deny all; } expires 1y; }

    location / { try_files $uri $uri/ /index.php?$query_string; }

    location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    }
}

Installation wizard

The wizard opens automatically the first time you visit your domain (or open https://your-domain/install/).

1. Welcome & license agreement – read and accept the license terms.
2. Requirements – PHP version, extensions and folder permissions are checked. Fix any red item in your hosting panel and press Check again.
3. License key – enter the key you received by e-mail (see License activation), or continue without it and activate later.
4. Database – enter host (usually localhost), port (3306), database name, user and password. The connection is tested and all tables are created. The database must be empty.
5. Admin account & site – site name, site address, site language, time zone, your name, e-mail and admin password (at least 10 characters).
6. Finish – config.local.php and install.lock are written. If the web root is not writable, the page shows the content of config.local.php so you can create the file yourself.

The admin panel is at https://your-domain/admin. Log in with the password you chose.

Cron jobs

Cron jobs send e-mails, publish scheduled posts, empty the trash and make backups. cPanel → Cron Jobs → add (replace the path with yours – cPanel shows it in File Manager):

*/10 * * * *  php /home/USER/public_html/cron/digest.php     # e-mail queue, weekly e-mail, scheduled tasks
0 3 * * *     php /home/USER/public_html/cron/backup.php     # daily database + uploads backup
0 12 * * *    php /home/USER/public_html/cron/social.php     # optional: post of the day to your Facebook page

No cron available? Enable Admin → E-mails → Weekly email → "Send emails without cron as well": the queue is then processed a few e-mails at a time on normal page visits.

License activation

Each license key is activated on its production domain. Activation happens in the installer (step 3) or later in Admin → License.

Where is my license key?

1. After your purchase on Codester the seller sends the license key to your e-mail address. It looks like VBX-1A2B-3C4D-5E6F-7A8B.
2. Not received it within one working day? Request it at viralboxy.com/license with your Codester order number, or write to the seller through your Codester account.
3. You do not have to wait: install now and activate later in Admin → License.

Regular vs. Extended License

• Regular License – use in one website (one domain) for personal or commercial purposes, by you or on behalf of a client.
• Extended License – use in up to 5 websites (5 domains) for personal or commercial purposes, by you or on behalf of your clients; the key is activated on each of them.

Moving to another domain

Open Admin → License on the old site and press Move to another domain, then activate the key on the new site. Local and test hosts (localhost, *.test, *.local, private IP addresses) never need activation, so you can develop freely.

What happens without activation?

The site keeps working, with some limits until you activate:

• Always available: the content types (images and GIFs, video, memes, articles), voting, comments, accounts, search, the safety plugins (sensitive content, copyright complaints) and the lite version.
• Needs an activated license key: badges, levels, polls, following authors, mentions, the weekly challenge, collections, visit streaks, the hall of fame and the data cache. In Admin → Plugins they show “License needed”; their settings are kept and take effect as soon as you activate.
• The admin panel shows a "License not activated" notice, and 14 days after the installation a small “Unlicensed copy” line appears in the public footer.

Development hosts (localhost, *.test, private IP addresses) have all features without activation. The license is re-checked automatically once a week; a temporary outage of the license server never affects your site (activations stay valid for 30 days between checks).

Updating to a new version

1. Make a backup: Admin → Health shows the latest automatic backup, or download your database (phpMyAdmin → Export) and the uploads/ folder.
2. Upload the new files over the old ones. Never overwrite or delete config.local.php, install.lock and uploads/. Do not upload the install folder again.
3. Open the site: the database is updated automatically.
4. Admin → Plugins → Performance → Clear cache (also clears the PHP code cache).

Admin panel guide

The admin panel (/admin) is grouped in the left menu. Press / anywhere to search for any setting or switch by name.

Content & moderation

• Content types: images (several per post, paste with Ctrl+V), GIFs, video links (YouTube, Vimeo, TikTok, Facebook), memes (built-in generator) and articles with headings and images.
• Guests can post, vote and comment if you allow it (Settings → Guest mode). After a guest post they are invited to register; their posts move into the new account automatically.
• Pre-moderation: turn on Moderation → Rules → Pre-moderation to approve every post first. Moderators get notified (bell, push, e-mail).
• Automatic protection: banned-words filter, duplicate image detection, rate limits, proof-of-work spam check (no captcha needed) or reCAPTCHA / Turnstile, optional OpenAI text and image moderation.
• Sample content: Admin → Maintenance → Add sample content (or php tools/demo-content.php) adds 18 sample posts with funny photos – images, memes, GIFs and articles – with four sample authors and comments, so you can see every feature at once. Remove them with Maintenance → Portal reset before you launch.

Appearance

• Theme & logo: upload a logo and favicon, choose a color scheme or your own colors for light and dark mode.
• Layouts: list, grid, compact and magazine; visitors can switch, you choose the default.
• Sidebars: drag widgets (top posts, tags, comments, poll, ads, your own text…) into left and right panels.
• Footer: columns, links, social profiles, newsletter box.
• Post navigation: arrows on the image and/or buttons above and below a post.

Plugins & features

Every feature has a switch. Plugins group the larger ones with their settings:

Integrations

Google login

1. Open Google Cloud Console → create a project → OAuth consent screen (External, app name, support e-mail, your domain, privacy and terms URLs) → Publish app.
2. Credentials → Create credentials → OAuth client ID → Web application. Authorized JavaScript origin: https://your-domain. Authorized redirect URI: https://your-domain/auth/google/callback.
3. Copy the Client ID and Client secret into Admin → Integrations → Google & Facebook and turn on "Login with Google".

Facebook login

1. Meta for Developers → Create App → use case "Authenticate and request data from users with Facebook Login".
2. App settings → Basic: app domain, privacy and terms URLs, data deletion instructions URL (your privacy page), Website platform with your site URL.
3. Facebook Login → Settings → Valid OAuth Redirect URIs: https://your-domain/auth/facebook/callback. Add the email permission. Switch the app to Live.
4. Copy App ID and App secret into Admin → Integrations and turn on "Login with Facebook".

Spam protection

By default an invisible proof-of-work check protects forms – no keys needed. You can switch to an addition task, Google reCAPTCHA v2 (checkbox or invisible badge) or Cloudflare Turnstile in Admin → Integrations → Bot check.

Push notifications

Admin → Notifications → Create push keys creates the VAPID keys. HTTPS is required.

Other

• Facebook page: post of the day to your page (page ID + page access token with pages_manage_posts; cron social.php).
• Analytics: Plausible (privacy friendly) – enter your domain.
• OpenAI: optional API key for AI moderation.

Languages

ViralBoxy is fully translatable. All texts are written in English; Latvian and Russian are included as language packs, and you can add any other language. Manage everything in Admin → Languages.

• Default language – what visitors see first; e-mails and notifications for visitors whose language is unknown are written in it.
• Admin panel language – the language of the admin panel (it can differ from the site).
• Languages visitors can choose – tick the languages for the switcher in the footer (the switch “Language switcher” shows it when more than one language is ticked). The visitor's choice is remembered in a cookie; e-mails to a user are sent in the language they used when signing up.
• Completeness – shows how many texts of the public site each language translates. Untranslated texts are shown in English.

Edit texts

Open a language (Admin → Languages → Edit texts): the list holds only the texts visitors see on the public site – pages, buttons, messages, e-mails, badges and sidebar names. The admin panel is not translated here; it uses the built-in languages. Posts, titles and comments written by users are never translated. The left column is the English text, the right column its translation. Search, the filter “Untranslated only” and paging help with large lists. An empty field uses the text of the language pack. You can also change English texts – for example to rename “Posts” to “Memes” everywhere. Your edits are stored in the database, so updates never overwrite them; Remove edits returns to the pack.

Add a language in the admin panel

1. Admin → Languages → Add a language: enter the code (2–3 lowercase letters, optionally with a region, e.g. de, es, pt-br), the name in English and in the language itself, and the text direction (right to left for Arabic or Hebrew).
2. Translate the texts in the editor, step by step – untranslated texts stay in English meanwhile.
3. Tick the language in the list of languages visitors can choose, or make it the default.

Add a language as a file

1. In Admin → Languages press Export next to any language. You get a JSON file with every interface text:

   {"code": "de", "name": "German", "native": "Deutsch", "dir": "ltr",
    "strings": {"Add": "Hinzufügen", "Page {n} of {n}": "Seite {n} von {n}", "…": ""}}

2. Translate the values (keep placeholders such as {n}, {name}, {site} exactly as they are), set code, name, native and dir.
3. Import it with Admin → Languages → Import a language file – a new code adds a new language, an existing one updates its texts. Alternatively upload the file to languages/ on the server.

E-mail

E-mails (registration, password reset, notifications, weekly e-mail, newsletters) are sent with the server's mail function. For good delivery:

• Use a sender address on your own domain (Admin → E-mails → Design → "From").
• Add SPF and DKIM records for your domain (cPanel → Email Deliverability → Repair).
• Send a test from Admin → E-mails → Test.

Security

• Use a long admin password and enable two-factor authentication (Admin → Security).
• Moderators get only the permissions you give them (Admin → Users → Moderator rights).
• Configuration, source code and backups are blocked from web access by .htaccess / the Nginx rules above. PHP files can never run from uploads/.
• All forms are CSRF-protected; output is escaped; a strict Content Security Policy is sent on every page.
• Behind Cloudflare, add define('IP_HEADER', 'HTTP_CF_CONNECTING_IP'); to config.local.php so rate limits see real visitor addresses.

A public demo of your site

First set the admin password to the one visitors should use, e.g. demo1234 (Admin → Security). Then add define('DEMO_MODE', 'demo1234'); to config.local.php. Visitors can then open the admin panel and look around, but nothing they do there is saved; the sign-in page shows the password, e-mail addresses are hidden and the subscriber export is off. Rate limits apply to the admin too. Remove the line to leave demo mode.

To put the demo back into its starting state every night, add the cron job 0 4 * * * php /home/USER/public_html/cron/demo-reset.php. It deletes all posts, users and uploads and adds the sample content again; settings stay. It only runs while DEMO_MODE is set, so it can never empty a live site.

Troubleshooting

Blank page or "500 Internal Server Error"

Check the PHP version (8.1+) and that all files were uploaded. cPanel → Errors or the error_log file in the web root shows the exact message. On Apache, a 500 right after upload often means mod_rewrite or a .htaccess option is not allowed – ask your host to enable AllowOverride All.

Every page except the home page shows 404

Friendly URLs are not working: .htaccess was not uploaded (hidden file) or mod_rewrite is disabled. On Nginx use the server block from Nginx.

"Could not connect to the database"

Check host (usually localhost), database name and user – cPanel adds a prefix such as account_dbname. Make sure the user was added to the database with ALL PRIVILEGES.

Images do not upload

uploads/ must be writable, and upload_max_filesize / post_max_size must be large enough (the included .user.ini sets 32 MB / 40 MB). GD needs WebP support.

The license key is not accepted

• "already active on …" – free it on the old domain (Admin → License → Move to another domain) or contact support.
• "Unknown license key" – copy the key again from the e-mail (all four groups after VBX-).
• "Could not reach the license server" – your server blocks outgoing connections; you can finish the installation and activate later.

E-mails do not arrive

Look in the spam folder, set up SPF/DKIM, and check that the cron job runs (Admin → E-mails shows the queue).

Google / Facebook login fails with "redirect_uri mismatch"

The site address in Admin → Settings must exactly match the domain registered with Google / Facebook, including https:// and with or without www.

Changes are not visible

Admin → Plugins → Cache → Clear cache, then reload with Ctrl+F5.

FAQ

Can I install ViralBoxy in a sub-folder (example.com/fun)?

No – use the web root of a domain or a subdomain (fun.example.com). Subdomains are free on almost every host.

Can I use it on several websites?

A Regular License covers one website. The Extended License covers up to 5 websites (5 domains). Both may be used for personal or commercial purposes.

Does it work without users registering?

Yes. Guest mode lets visitors post, vote and comment without an account – each part can be switched separately.

Can I run ads?

Yes – ad slots between posts, in sidebars and on post pages, with text, images or any ad network code (AdSense etc.).

Is it GDPR-friendly?

Only necessary cookies are used, visitor statistics are anonymous (hashed IP), users can export and delete their own data, and the privacy policy page is editable.

How do I translate the site?

See Languages.

How do I move the site to another server?

Copy all files (including config.local.php and uploads/) and the database, update the database details in config.local.php; if the domain changes, use "Move to another domain" in Admin → License first.

Credits

• Open Sans font – SIL Open Font License 1.1 (bundled locally, no Google requests).
• Interface icons – made for ViralBoxy. Sample photos in database/demo – free stock photos, for the demo content.
• No third-party PHP or JavaScript frameworks are used.

Support

Support is provided through Codester – write to the seller from your Codester account. Please include your ViralBoxy version (Admin → License), PHP version and the exact error message. Support covers installation problems and bugs; customization is not included.

Thank you – and have fun building your community!