Frequently asked questions

General#

Is CPalius a CMS? No; it is a CMF. It provides content management infrastructure, but the actual product is produced as a module by you (or by module authors). Details: What is CPalius?

Which PHP version is required? PHP 8.4 and above. The core runs on Symfony 7.4 LTS.

Which databases are supported? MySQL 8+ and MariaDB 10.6+. Installation with PostgreSQL and SQLite is not supported at the moment.

Does it work on shared hosting? Yes, if PHP 8.4 and the required extensions are available. Since the package contains the Composer dependencies (cp-includes/vendor), SSH or Composer is not needed; installation is done with the browser wizard.

Is Node.js required? No. It is not needed to run the core and the panel. When developing a theme, using Vite or esbuild is the theme author's choice; CPalius serves only the compiled output.

Modules and themes#

Which modules ship with the core? A new installation starts with the Media, Menu, Pages, Blog, Forum and Seo modules. Others (Portal, Docs, Widget, Showcase, VisitorStats…) are enabled from the store or from disk.

Can a module break my site? Hardly. Before a module is activated it goes through build and YAML checks; if a hook, route or event listener fails while running, it is quarantined and the request continues. Still, a malicious module can do anything; packages in the store come from the signed catalogue and pass the package contract, but do not install modules from sources you do not know.

If I remove a module, is its data deleted? Deactivating does not delete data. The uninstall hook depends on the module author; take a backup before removing.

Can I write my own theme? Yes. The theme contract: theme.json and the compiled dist/ output. Details: Theme contract.

Security#

The WAF blocks legitimate content by mistake; can I turn it off? Do not turn the WAF off. There is already a narrow exemption for human-written areas such as blog, forum and docs: only for POST requests on known write paths and only for text fields such as body, content, excerpt and description. If a new write path of yours gets blocked, have the path added to the exemption list. See Security.

How are passwords stored? With Symfony's password hasher (one-way). The password policy is applied, and passwords that appear in known leaks can be rejected.

I want to report a security vulnerability. Follow the reporting guidance in the SECURITY.md file in the repository; do not post the vulnerability anywhere public.

Updates#

What happens if an update breaks something? The updater takes a backup before the operation; if something goes wrong it restores the files and database. Details: Update system.

Who trusts the update package? Release information is signed with Ed25519 and has an expiry; sites reject unsigned, expired or older release information.

The site behaves strangely after an update. Clear the cache (empty cp-core/var/cache/prod/); and Redis too if you use it. Then run cp:doctor.

Multilingual support#

How many languages can I add? As many as you like from AACP → Languages. Content is a separate record for each language and is linked with a translation group.

How do I translate interface texts? Translation files are in cp-content/translations/ and in the modules' Resources/translations/ folders. They can be edited from the localization screen in AACP. cp:doctor checks TR and EN key parity.

Performance#

Is there caching? Yes: origin-side page caching with tagged invalidation, plus status checks for Redis, Memcached, Varnish and Nginx PageSpeed. Anonymous requests do not open a session; this is a precondition for the cache to be efficient.

How do you prevent N+1 query problems? In the development environment an exception is thrown if the same query passes the threshold; this way the problem is noticed before it reaches production. Permission filters are added to the list query as SQL; permission is not asked row by row.

Support#

I found a bug, where should I report it? Send bug reports to the support and forum areas on cpalius.com. Report security-related ones only through the channel in SECURITY.md.