Weekend Wanderer — Laravel Travel Blog CMS with Affiliate Marketing & REST API

A production-ready travel blog and affiliate content platform built on Laravel 13 and PHP 8.4. One codebase gives you three surfaces: a fast public site, a full admin panel, and a token-authenticated REST API v1 that exposes every admin capability. No build step — Blade renders server-side and Tailwind's Play CDN generates the CSS in the browser, out of the box.

Admin Access

• Panel: /admin/login
• Email: admin@example.com
• Password: TestPassword123!

Set ADMIN_PASSWORD in your .env before seeding a live install — the demo password is for local evaluation only.

REST API

Interactive documentation ships with the app at /api/docs (enable with API_DOCS_ENABLED=true), plus a downloadable Postman collection at /api/docs/postman.json.

• 40+ endpoints across public and admin groups
• Laravel Sanctum bearer tokens with 24-hour expiry
• Uniform {success, data, message} response envelope — /api/health is the one flat-payload exception
• Rate limited per group; paginated collections return links and meta
• Health endpoint at /api/health reporting the installed version

Features

Public site

• Dynamic homepage: latest, featured, popular, live stats
• Article pages with reading time and auto table of contents
• Category, tag and search archives
• Affiliate shortcodes rendered as tracked CTA buttons
• Newsletter signup plus a one-click unsubscribe page at /newsletter/unsubscribe
• RSS feed at /feed with the 20 latest articles
• Hidden honeypot field on newsletter and contact forms stops bot spam
• Dark mode, reading progress bar, share buttons
• Google Analytics 4, toggled from settings

Admin panel

• Dashboard with traffic, content and subscriber metrics, plus affiliate clicks today and a top-5 links leaderboard
• Full article CRUD with soft delete, restore, force delete
• Admin-only article preview rendering the public template with a preview banner
• Featured image alt text for SEO and screen readers, plus one-click image removal
• Renaming an article slug keeps old URLs working via automatic 301 redirects
• Category, tag and affiliate link management
• Affiliate click tracking and reference guards
• Subscriber list with CSV export
• Message inbox with unread badge
• Site settings, logo and favicon upload
• Profile, password change, changelog viewer
• Server-side password reset via php artisan admin:reset-password
• Demo mode blocks all writes with one env flag and sends noindex, nofollow (header + meta tag, sitemap line omitted from robots.txt)

SEO Built In

• XML sitemap at /sitemap.xml, excluding drafts and future posts
• robots.txt referencing the sitemap (sitemap line omitted when demo mode is on)
• RSS feed at /feed with autodiscovery link on every page
• Canonical link plus Open Graph and Twitter Card tags sitewide, with per-article, category and tag overrides
• Article OG images fall back to the bundled local logo
• JSON-LD structured data, meta and Open Graph tags
• Clean slugs, canonical URLs, semantic heading structure
• Accent- and case-insensitive search that reads plain text, not raw HTML

Security Hardening

• All article HTML passes an HTML Purifier allowlist — scripts, iframes, inline handlers and javascript: URIs are stripped
• Security headers on every response (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS on HTTPS)
• Public API group throttled at 60 requests per minute; the health probe is deliberately left unthrottled
• Stronger password policy by default: minimum 12 characters with mixed case, numbers and symbols
• click_count and view_count removed from mass assignment — counters move only via deduped increment methods
• Changing a password revokes every other session and every other API token, on both surfaces — the API call's own token is kept so the caller stays signed in
• Policy checks plus a gate short-circuit — defence in depth, not a single guard
• Subscriber CSV export neutralises spreadsheet formula injection
• Affiliate click IPs stored as HMAC-keyed hashes, never in the clear
• SVG uploads rejected for logo and favicon
• Escaped LIKE queries, and no user input is ever interpolated into a query — every raw SQL fragment in the codebase is a constant or a bound placeholder: a COUNT(*) guard in a migration, plus two in app/ (a read-state flip and a binary-collation path comparison)

Performance

• Homepage sections cached with versioned keys, invalidated on content change
• Affiliate clicks deduplicated per IP per link for 24 hours before the counter moves
• Settings cached for 24 hours, failing open when the database is unreachable
• Composite indexes on publish state, views, featured flag and category
• Eager loading on every query that feeds a view or API resource
• No asset pipeline, no Node, no compile step to deploy

Code Quality

Requirements

• PHP ^8.4 and Composer
• MySQL 8+ or MariaDB 10.4+, database created with utf8mb4_unicode_ci
• SQLite is not supported — the schema relies on MySQL generated columns and collation semantics