Built by 
About this software
About Halden House
A Laravel 12 + Livewire 4 content management system for hotels, resorts, tour operators, holiday-home owners, corporate travel companies and hotel groups. The public site is a pixel-faithful conversion of seven Halden House HTML designs; owners switch designs without losing content and edit every section, text, image and list in the admin panel. Takes bookings with online payment (Stripe Checkout) for rooms, tours and holiday homes, runs in English and Arabic (right-to-left), and includes availability per night with units, minimum stay, guest limits, blocked dates and seasonal rates. Full source code, single-site licence, MySQL/MariaDB database.
Why Halden House
What makes it better
than the alternatives
- 01
Seven interchangeable designs
Switch themes without losing content; every design has rooms, tours, properties, blog, services, team, gallery, contact and booking pages
- 02
Booking engine for rooms, tours and properties
Availability per night with units, minimum stay, guest limits, seasonal rates, taxes, fees, deposits, and unpaid hold expiry
- 03
Stripe Checkout integration
Test mode, live mode, webhook handler for payment confirmation, refunds, guest cancellation requests, and booking confirmation emails
- 04
English + Arabic (RTL)
Translatable content fields, Arabic fonts, mirrored layouts, /ar prefix, and language switcher in the admin panel
- 05
Public demo mode
/Landing page, demo admin account, design switcher for visitors, automatic content reset, and iframe embedding for portfolios
Website (7 designs)
- Luxury Hotel
- Beach Resort
- Boutique Hotel
- Travel Agency
- Vacation Rentals
- Travel Corporate
- Hotel Group themes
- Rooms & suites
- tours
- holiday homes
- offers
- destinations
- services
- team
- gallery
- blog
- FAQ
- contact pages
- Online booking widget with date/guest search
- live prices
- guest details
- review
- payment and confirmation
- Multi-currency display (AED base
- USD option)
- seasonal rates
- taxes
- fees
- deposit percentage
- Arabic (RTL) site with /ar prefix
- mirrored layouts
- Arabic fonts
- translatable content fields
Booking & Payments
- Availability per night with room counts
- minimum stay
- guest limits
- closed dates
- Stripe Checkout (test/live modes)
- webhook handler for checkout.session.completed
- charge.refunded
- Test payment page (local
- no Stripe needed)
- full payment or deposit
- VAT/taxes
- fees
- Guest confirmation page
- printable receipt
- My booking lookup (reference + email)
- Cancellation requests from guests
- admin cancellation with refunds
- unpaid hold expiry (cron)
Admin Panel
- Dashboard with bookings
- revenue
- leads
- visitors
- top pages
- devices
- countries (last 30 days)
- Section editor for every page: text
- images
- lists
- colours
- fonts
- visibility
- order
- Bookings list (confirmed
- pending
- cancelled
- expired)
- manual bookings
- payment recording
- refunds
- notes
- Leads (contact forms)
- subscribers (newsletter)
- media library
- blog posts
- rooms
- tours
- properties
- Settings: site name
- logo
- menus
- social links
- SMTP
- Stripe keys
- reCAPTCHA
- currencies
- booking terms
Content Modules
- Rooms (name
- slug
- summary
- description
- amenities
- images
- base rate
- pricing
- limits
- availability)
- Tours (name
- slug
- summary
- description
- images
- pricing per traveller
- departure dates
- seats)
- Properties (holiday homes: name
- slug
- summary
- description
- images
- pricing per night
- cleaning fee)
- Blog posts (title
- slug
- excerpt
- content
- featured image
- published date
- meta tags)
- Services (name
- slug
- summary
- description
- icon
- order)
- team members (name
- role
- bio
- photo
- department)
Forms & Leads
- Contact form (name
- company
- phone
- message
- service
- budget
- extra fields)
- Newsletter subscription (email
- language
- source URL
- IP
- status: subscribed/unsubscribed)
- reCAPTCHA v3 integration (site key
- secret key
- min score 0.5)
- spam detection (hidden fields
- instant submit)
- Lead management (new
- contacted
- qualified
- converted
- lost)
- CSV export
- email notifications
- Consent checkbox for GDPR
- email templates (contact confirmation
- newsletter welcome
- booking confirmation)
Themes & Design
- Theme switcher (7 installed themes)
- preview mode (signed URLs
- draft sections
- theme override)
- Section editor: text fields
- images
- lists
- colours
- fonts
- visibility
- order
- snapshot overrides
- Bindings: fill section lists from content modules (rooms
- offers
- reviews
- FAQ
- blog) per theme.json
- Header/footer editor (menus
- logo
- social links
- copyright)
- branding (logo
- favicon
- colours
- fonts)
- RTL support (Arabic fonts
- mirrored layouts
- direction arrows)
- responsive (mobile
- tablet
- desktop)
Analytics & Tracking
- Visitor tracking (page views
- referrers
- devices
- countries
- browsers
- OS) without cookies
- Dashboard charts (bookings
- revenue
- leads
- visitors
- top pages
- devices
- countries) for last 30 days
- MaxMind GeoLite2 database for country detection (IP → country code)
- user agent parsing (device
- browser
- OS)
- Activity log (admin actions: login
- logout
- booking created
- payment recorded
- theme changed)
- CSV export for leads
- bookings
- subscribers
Users & Security
- Two roles: administrator (full access)
- editor (no settings
- users
- email templates)
- Admin login (email + password)
- session timeout (120 minutes)
- password requirements (12+ chars
- mixed case
- numbers
- symbols)
- Activity log (login
- logout
- failed login
- booking created
- payment recorded
- theme changed)
- Security headers (X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy)
- CSRF protection
- signed URLs
- Demo mode (public demo account
- /landing page
- design switcher
- automatic content reset every 60 minutes)
Email & Notifications
- SMTP settings (host
- port
- username
- password
- encryption)
- sender address and name
- Email templates (contact confirmation
- newsletter welcome
- booking confirmation
- booking cancelled
- cancel request)
- Booking emails (confirmation
- receipt
- cancellation
- cancel request) with tokens (name
- reference
- dates
- total)
- Lead notifications (contact form submissions) to admin email
- Queue worker (php artisan queue:work) for background email sending
Media & Assets
- Media library (upload
- delete
- search
- filter by type)
- image optimization (spatie/image)
- Public storage (public/storage symlink)
- private storage
storage/app/private - Theme assets (CSS
- JS
- fonts
- icons) in
public/themes/<slug>/ - Shared front-end files (fonts
- icons
- main.js
- halden.js
- rtl.css
- Arabic fonts) in
public/themes/_halden/ - Brand assets (logo
- favicon
- apple-touch-icon) in
public/brand/
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| PHP | — | — | Web, API | 57.1% |
| CSS | — | — | Styling | 26.4% |
| Python | — | — | Web, API | 6.4% |
| SQL | — | — | Database | 5.2% |
| JavaScript | — | — | Front-end | 4.5% |
| Shell | — | — | Scripts | 0.5% |
- Primary language
- PHP 8.2+
- Framework
- Laravel 12.69
- Database
- MySQL 8 / MariaDB 10.6+
- Authentication
- Laravel session-based authentication with bcrypt password hashing
- Licence
- Single-site
- Screens
- 42
- Database tables
- 39
- Supported languages
- English, Arabic (RTL)
- Browser support
- Modern browsers (Chrome, Firefox, Safari, Edge)
| Minimum | Recommended | |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 2 GB RAM | 4 GB RAM |
| OS | PHP 8.2+, Composer, Node.js 18+, MySQL 8 / MariaDB 10.6+ | PHP 8.2+, Composer, Node.js 18+, MySQL 8 / MariaDB 10.6+ |
| Est. monthly hosting | $15 | $15 |
```bash cp docker.env.example .env # Edit .env: set DB_PASSWORD, DB_ROOT_PASSWORD, ADMIN_PASSWORD docker-compose up -d docker-compose exec app php artisan migrate docker-compose exec app php artisan cms:install --all-themes --email=you@example.com # Site: http://localhost:8080 Admin: http://localhost:8080/admin ```
```bash
sudo apt update && sudo apt install -y php8.2 php8.2-{cli,fpm,mysql,mbstring,xml,curl,zip,gd,intl,bcmath} composer nginx mysql-server nodejs npm
cd /var/www
sudo git clone <repo> halden && cd halden/Laravel\ Project
composer install --no-dev --optimize-autoloader
npm ci && npm run build
cp .env.example .env
# Edit .env: APP_ENV=production, APP_DEBUG=false, APP_URL, database credentials, SESSION_SECURE_COOKIE=true
php artisan key:generate
php artisan migrate --force
php artisan cms:install --all-themes --email=you@example.com
sudo chown -R www-data:www-data storage bootstrap/cache
sudo chmod -R 775 storage bootstrap/cache
# Configure Nginx: root /var/www/halden/Laravel Project/public; try_files $uri $uri/ /index.php?$query_string;
# Add cron: * * * * * cd /var/www/halden/Laravel\ Project && php artisan schedule:run >> /dev/null 2>&1
``````bash # Upload files to public_html/halden cd public_html/halden/Laravel\ Project composer install --no-dev --optimize-autoloader npm ci && npm run build cp .env.example .env # Edit .env via File Manager: APP_ENV=production, APP_DEBUG=false, APP_URL, database from cPanel MySQL, SESSION_SECURE_COOKIE=true php artisan key:generate php artisan migrate --force php artisan cms:install --all-themes --email=you@example.com # In cPanel: set document root to public_html/halden/Laravel Project/public # Add cron job: * * * * * cd ~/public_html/halden/Laravel\ Project && php artisan schedule:run ```
```bash cd Laravel\ Project composer install npm ci && npm run build cp .env.example .env php artisan key:generate # Edit .env: APP_ENV=local, APP_DEBUG=true, DB_CONNECTION=sqlite, DB_DATABASE=/tmp/halden.sqlite, SESSION_SECURE_COOKIE=false touch /tmp/halden.sqlite php artisan migrate php artisan cms:install --all-themes --email=test@example.com --password=TestPass123! php artisan serve # Site: http://127.0.0.1:8000 Admin: http://127.0.0.1:8000/admin ```
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (3 minor)
No real credentials found; weak demo password generation in setup docs needs attention; authorization mostly solid; missing ownership checks on booking/lead reads and demo mode bypass; database access mostly safe; minor schema gaps (missing indexes on foreign keys); moderate code duplication and some oversized files; architecture is sound but refactoring needed; build reproducible with gaps: missing node version, unclear docker setup, incomplete prerequisites. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
