Architecture

• OverviewLayers, the "the core never dies" laws, the module lifecycle, request isolation and the theme contract.
• SecurityWAF, login defense, password and two-factor authentication, session, CSP and security headers, the AACP gate, telemetry and the security audit; with default values.
• Content modelNode and Resource, the hybrid JSON data model, the flat field index, taxonomy, revisions, trash, workflow, path patterns and tokens.
• Update systemSigned release information, maintenance mode, atomic writes, database backup and rollback; compared with other systems.
• Permission systemCapability-based access control; roles, .own/.any scopes, per-user exceptions, record-level permissions and SQL scoping in lists.
• Field system (Field API)Field definitions, field types, widget resolution, validation, flat index, view modes and Twig helpers; writing your own field type.
• Multilingual supportManaging languages, content translations, address structure, interface translations and the translation manager; rules for module authors.
• Hooks, cron and queueThe isolated hook system, lifecycle events, scheduled tasks, overlap lock and the asynchronous job queue.
• Settings and configurationDefining settings with #[CpSetting], storing and caching values, translatable and encrypted settings, moving to Git with config sync; a reference of core setting keys.
• API and webhooksREST endpoints with #[CpApi], API keys, capabilities, IP restriction, rate limiting and idempotency; outgoing and incoming signed webhooks, SSRF protection.
• Media and storageThe secure upload pipeline, allowed file types, image thumbnails, CDN, remote storage (S3, R2, FTP) and media offload.
• Cache and performanceOrigin HTML cache and tagged invalidation, Varnish and Redis/Memcached support, rebuild jobs, maintenance commands and the N+1 guard.
• Search and SEOSite search providers, the panel live search; the SEO module (title templates, Open Graph, schema.org, sitemap, robots.txt, llms.txt, IndexNow, redirects, 404 log).
• Email and notificationsSMTP sending and the queue, the email log and resending, editable email templates, notification types, channels and user preferences.
• Backup and maintenanceBackup types, shipping to remote storage and verification, restore notes, logs, trash, the recovery console and a routine maintenance list.
• URL aliases and path patternsHow pretty addresses are produced while the canonical address of content stays fixed, why old addresses never return 404 and how to write path patterns.
• Data migration
• Row-level access and tenantsTurning permission into SQL (QueryScopeApplier), permission for a single record (EntityAccessManager) and multi-tenant data (TenantFilter).
• Security Center and telemetryThe six screens of the Security Center menu in AACP, telemetry modes, threat analysis, IP bans, the malware scanner and the recovery console.
• The rebuild systemThe system that recalculates counters and derived data in batches, the rule every content-producing module must follow and writing your own rebuilder.