Built by 
About this software
About Arcade Portal
A complete Laravel 13 + Filament 5 game portal where site owners upload HTML5 games as ZIPs and visitors play them instantly in the browser. Games are unpacked safely with file-type checks and atomic replacement into storage/app/public/games/{slug}. Visitors can create free accounts to save favourites, leave moderated comments and report broken games. The admin panel manages games, categories, tags, members, comments, reports, ad slots, blog posts and static pages with role-based access (admin and editor).
Why Arcade Portal
What makes it better
than the alternatives
- 01
Safe ZIP upload
BuildInstaller unpacks games with path validation, file-type allow-list and atomic replace
- 02
Accurate play and like counters
Unique keys per game/visitor/day for plays, per game/visitor for likes, so one visitor counts once
- 03
Visitor privacy
Only a salted hash is stored (Visitor::key), never an IP address
- 04
Moderated community
Comments wait for approval (switchable), honeypot and per-IP throttles on forms, members can be blocked
- 05
Ad slots with scheduling
Four positions (top, game sidebar, under game, footer) hold banners or pasted ad-network code with start/end dates
Games
- Upload HTML5 build as ZIP or embed by URL
- Title
- summary
- Markdown description
- controls note
- developer
- category
- tags
- thumbnail
- player size
- Draft
- published and scheduled status with featured flag
- Search-engine title and description per game
- Publish/unpublish in one click
- bulk publish
- bulk feature actions
- Game page with Play button
- fullscreen
- plays/likes counters
- related games
- comments and report form
Public Site
- Home with featured
- trending
- new and most-loved games
- category tiles and latest blog posts
- Search by title
- summary and tags with sorting (newest
- most played
- most liked
- A-Z)
- Category and tag pages with pagination (games per page configurable)
- Blog with published posts
- static pages (About
- Privacy
- Contact)
- sitemap.xml
- robots.txt
- canonical and social-share meta tags
Visitor Accounts
- Free sign-up with name
- email and password (8+ chars)
- Favourites list
- recently played games (last 12)
- Comments on games (moderated or instant
- switchable)
- Report broken games with reason and optional message
- Account blocking by admin
- last login timestamp
Counters and Tracking
- Plays count once per visitor per game per day (game_plays table with unique key)
- Likes count once per visitor per game (game_likes table with unique key)
- Visitor key is salted hash from IP
- user agent and salt (Visitor::key)
- never stores raw IP
- Counters on games table updated only when a row is created
- inside transaction
- GameService handles all counter changes to prevent inflation
Moderation
- Comments wait for approval (status: pending
- approved
- rejected)
- Approve
- reject and bulk actions in admin panel
- Game reports with reason (does not load
- controls do not work
- inappropriate
- other) and optional message
- Reports list with open/resolved status
- resolve action
- Honeypot field on comment and report forms (bots fill it
- submission is dropped and logged)
- Per-IP throttles: 60 actions/minute for
play/like/favourite - 6 forms/minute for
comment/report/sign-up/sign-in
Ad Slots
- Four positions: top
- game sidebar
- under game
- above footer
- Banner with image and link
- or pasted ad-network code
- Start and end dates for scheduling
- Master switch to enable/disable ads site-wide
- Admin-only (editors cannot manage ad slots)
Admin Panel
- Dashboard with live games
- 14-day plays chart
- likes
- members
- comments waiting
- open reports
- top games
- Roles: admin (everything) and editor (role value 'staff': games
- categories
- tags
- comments
- reports
- members
- posts
- pages)
- Site settings: name
- tagline
- description
- footer
- games per page
- registration
- comments
- moderation
- ads
- game storage mode
- Filament 5 resources split into Schemas (forms)
- Tables (lists) and Pages (create
- edit
- list)
- Every create and edit page returns to the list
Content Management
- Categories with name
- slug
- description
- sort order
- active switch
- Tags with name and slug
- attached to games
- Blog posts with title
- slug
- Markdown body
- published status and date
- Static pages with title
- slug
- Markdown body
- published switch
- Markdown rendered with HTML stripped (Markdown::toHtml)
Demo Mode
- DEMO_MODE=true turns / into a landing page
- portal moves to /arcade
- One-click signed logins for demo accounts (admin
- editor
- member)
- DemoController with roles page and login endpoint
- Prevents changing logins in demo mode
- Eight playable demo games included (Breakout
- Flap
- Memory
- Simon
- Snake
- Tic-Tac-Toe
- 2048
- Whack-a-Mole)
Deployment
- Docker Compose with app (PHP 8.4-apache) and db (MySQL 8.4) services
- HTTP on port 8080
- HTTPS on port 2053 (self-signed cert or custom
origin.pem/origin.key - Optional Cloudflare Authenticated Origin Pull (authenticated_origin_pull_ca.pem)
- Entrypoint runs migrations
- seeds admin
- links storage
- sets permissions
- Volumes for uploads
storage/app/publicand database (dbdata)
Blog and Pages
- Markdown posts with cover image
- draft
- published and scheduled status
- static pages (About
- Privacy
- Contact) with footer links
- safe rendering with raw HTML removed
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| PHP | — | — | Web, API | 76.1% |
| SQL | — | — | Database | 17.2% |
| HTML | — | — | Front-end | 3.7% |
| CSS | — | — | Styling | 2.2% |
| Shell | — | — | Scripts | 0.5% |
| JavaScript | — | — | Front-end | 0.3% |
- Primary language
- PHP 8.3+
- Framework
- Laravel 13 + Filament 5
- Database
- MySQL 8 / MariaDB 10.6+ (SQLite for evaluation)
- Authentication
- Laravel session-based (web + member guards)
- Licence
- Single-site
- Screens
- 23
- Database tables
- 14
- Supported languages
- English only
- Browser support
- Modern browsers (ES6+, CSS Grid, Tailwind 4)
| Minimum | Recommended | |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 512 MB | 2 GB |
| OS | PHP 8.3+, Apache 2.4, MySQL 8 / MariaDB 10.6+ | PHP 8.3+, Apache 2.4, MySQL 8 / MariaDB 10.6+ |
| Est. monthly hosting | $10 | $10 |
```bash cp .env.example .env # set APP_KEY, DB_PASSWORD, SEED_ADMIN_PASSWORD, APP_URL docker compose up -d --build # site at APP_URL, admin at /admin ```
```bash composer install --no-dev --optimize-autoloader && npm ci && npm run build cp .env.example .env && php artisan key:generate # then set DB_*, SEED_ADMIN_*, APP_URL php artisan migrate --seed && php artisan storage:link chown -R www-data storage bootstrap/cache # point nginx at public/ ``` Full steps with nginx and Cloudflare: HowToSetup.md
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (2 minor)
Missing foreign key indexes and some unscoped queries; no injection paths found; strong authz on admin & mutations; minor ownership gaps on member reads. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
