# Coriable — Digital Agency Website & Admin Portal

A self-contained PHP + MySQL + Bootstrap platform built on your Coriable
template: a public marketing website plus an admin dashboard with login,
a page content editor, services/portfolio/blog management, a lead-capture
CRM, and core SEO/security tooling. No Composer, no build step — it runs
on ordinary PHP/MySQL shared hosting (cPanel) exactly like your other
projects (Jayke Computers, Krave Cakes).

---

## 1. What's included

**Public website** — a fully scrollable, mobile-first homepage (hero, animated
stats counters, services, portfolio, trusted-by client logos, industries
served, testimonials, blog teaser, call-to-action) plus a full agency site
architecture: About (Who We Are / Our Approach / Our Team / Career / How We
Craft), Our Work (Featured Work / Case Studies / Before & After), Services
(list + detail), Clients (Companies We Serve / Industries Served /
Testimonials), Blog (Insights / News / Resources categories), contact &
quotation form, service booking, custom project requests, FAQs,
privacy/terms, and a dynamic XML sitemap.

**Admin portal** (`/admin`)
- Secure login: hashed passwords, session hardening, failed-login lockout, CSRF protection on every form
- Role-based access: Super Administrator, Administrator, Content Editor, Sales
- **Page Content editor** — edit hero text, intros and other on-page blocks with a rich-text editor, no code required
- **Branding** — upload your logo and favicon directly from Settings, no code or file access needed
- Services CRUD with SEO fields, features list, pricing
- Portfolio/case-study CRUD (challenge/solution/results, gallery, categories, confidential-client toggle)
- Blog CRUD with categories, tags, scheduling, rich-text editor, SEO fields
- Team members, testimonials, industries served, and client logo strip management
- **Bookings** — clients book a service/consultation with a preferred date and meeting mode; manage status (pending → confirmed → completed/cancelled)
- **Custom project requests** land in Leads & Quotes CRM alongside regular enquiries
- FAQ manager (site-wide or attached to a specific service)
- Media library (upload, browse, copy URL, delete)
- Leads & Quotes CRM: pipeline status (New → Won/Lost), assignment, follow-up dates, notes/activity log, CSV export
- Newsletter subscriber list + CSV export
- Site settings: contact info, socials, default SEO, Google Analytics/GTM/Meta Pixel IDs, **Google AdSense** (publisher ID, Auto Ads toggle, manual ad unit placement), homepage stats counters, SMTP email config
- User management (Super Admin only) and an audit log of admin actions

**Interactivity & mobile** — the homepage was rebuilt from the original
fixed-height "pagepiling" slideshow into a normal scrolling layout so it
works naturally on phones and tablets: animated counters that count up as
you scroll into view, hover-interactive service/industry cards, a responsive
Bootstrap grid throughout, and a touch-friendly collapsible mobile menu.

**Security** — PDO prepared statements everywhere, CSRF tokens, password
hashing (bcrypt via `password_hash`), login rate-limiting/lockout,
session fixation protection, upload type/size validation, `.htaccess`
hardening (blocks direct access to `/includes` and `/database`, security
headers, no directory listing).

**SEO** — per-page/service/post meta title & description, focus keyword
field, clean slugs, dynamic `sitemap.php`, `robots.txt`, Open Graph tags,
**Twitter Card tags**, **canonical URLs on every page**, **breadcrumb
navigation with schema.org BreadcrumbList markup**, **JSON-LD structured
data** (Organization, WebSite, Service, BlogPosting, FAQPage — see
`includes/seo.php`), image lazy-loading, and GA4/GTM/Meta Pixel injection
from Settings.

**Analytics & tracking** — Google Analytics 4, Google Tag Manager, Meta
Pixel, **Microsoft Clarity** (heatmaps/session recordings), **LinkedIn
Insight Tag**, and a **Google Search Console verification field** — all
configured from Admin → Settings, no code edits needed. Click tracking is
wired to phone, email, WhatsApp, and "Book a Service" buttons, and every
form submission fires a tracked event. **UTM parameters** from ad campaigns
are captured client-side and saved against the lead/quote request that
follows. A **cookie consent banner** lets visitors decline non-essential
tracking — declining sets a cookie that Analytics/Clarity/Pixel/LinkedIn
scripts respect on the next page load.

**Trust & credibility** — client logos, a separate **partner logos** row,
an **Awards & Certifications** manager, curated **Google Reviews** snippets
plus your overall rating/review count, and the homepage stats counters
(years, clients, projects) all in one trust section.

**Live chat** — a built-in FAQ-matching chat assistant (no external API
required) with WhatsApp and Messenger quick-action buttons and an admin
transcript viewer, **or** paste in a third-party widget (Tawk.to, Crisp,
etc.) from Settings to replace it entirely.

**Legal pages** — Privacy Policy, Terms & Conditions, Cookie Policy,
Disclaimer, Refund Policy, Accessibility Statement, and a Data Protection
Notice referencing Ghana's Data Protection Act — all editable from Admin →
Page Content and linked in the footer.

---

## 2. What's NOT included yet (Phase 2)

The original brief covers a very large enterprise platform (client
portal, invoicing, online payments, project management, support
tickets, multi-channel SMS automation, live calendar sync). Building
and *safely testing* all of that — especially payment integrations —
needs real API credentials and a live environment, so it wasn't
included in this build. The database schema was designed so these can
be added later without reworking what's here:

- Client portal (client login, view quotations/invoices/projects)
- Invoicing & Ghana payment gateways (Paystack, Hubtel, MoMo)
- Project/task management with milestones and time tracking
- Support ticket system
- Calendar sync for bookings (currently a request form managed manually in Admin → Bookings, not a live calendar)
- SMS/WhatsApp Business API automation
- Advanced keyword-rank tracking

If/when you're ready for any of these, they can be added as additional
modules using the same patterns already in `/admin`.

---

## A note on imagery and content sourcing

This build deliberately does not copy photos, client logos, or written
content from other agencies' websites — using another company's project
photography or listing their clients as your own would be both a
copyright problem and, for client logos specifically, a misrepresentation
of whose work it actually is. Instead:

- The site uses the Coriable template's own image assets, Bootstrap Icons
  (vector, no licensing concerns), and CSS-driven visual design (gradients,
  cards, hover states) for a modern look without relying on stock photos.
- **Add your own real project photos, team photos, and client logos** via
  Admin → Media Library, then attach them through the relevant admin
  screens (Portfolio, Team, Client Logos, Awards & Certifications). Real
  photography of real projects is also simply more convincing to visitors
  than any stock or placeholder image.
- If you want licensed stock photography for a hero image or similar,
  Unsplash and Pexels both offer genuinely free-for-commercial-use photos
  — download from there and upload through the Media Library.

## 3. Requirements

- PHP 8.0+ with PDO MySQL extension (standard on any cPanel host)
- MySQL 5.7+/8 or MariaDB 10.3+
- Apache with `mod_rewrite` and `mod_headers` (both standard on cPanel)
- An SSL certificate (Let's Encrypt via cPanel is fine)

---

## 4. Local / staging setup

1. Create a MySQL database and user, and grant the user full privileges on it.
2. Open `includes/config.php` and set `DB_HOST`, `DB_NAME`, `DB_USER`, `DB_PASS`.
3. Set `SITE_URL` to your domain (no trailing slash) and generate a random
   `APP_KEY` (e.g. run `php -r "echo bin2hex(random_bytes(32));"`).
4. Import the schema:
   - **Easiest:** open phpMyAdmin → your database → Import → choose `database/schema.sql` → Go.
   - **Or:** visit `https://yourdomain.com/install.php` in a browser and follow the on-screen form — it imports the schema *and* creates your real admin account with the password you choose (recommended, since it avoids the placeholder password in the SQL file).
5. If you used phpMyAdmin instead of the installer, update the seeded
   admin password immediately: log in with `admin@coriable.com`
   (the placeholder hash in `schema.sql` will NOT work as-is — use
   `install.php` instead, or manually update the row with a real
   `password_hash()` value).
6. **Delete `install.php`** (or leave `install.lock` in place) once setup is done — it must never be reachable on a live site.
7. Make `uploads/media` writable by the web server (`chmod 755` is usually enough on shared hosting).
8. Visit `/admin/login.php` and sign in.

---

## 5. Deploying to cPanel / shared hosting

1. Upload everything to your domain's document root (usually `public_html`), keeping the folder structure as-is.
2. Create the MySQL database + user in cPanel → MySQL Databases, and note the generated names (cPanel usually prefixes them with your account username).
3. Follow section 4 above using those credentials.
4. In cPanel → SSL/TLS Status, enable AutoSSL (or install your certificate), then uncomment the "force HTTPS" block at the bottom of the root `.htaccess`.
5. Set `APP_DEBUG` to `false` in `includes/config.php` (it should already be `false` by default) so PHP errors are never shown to visitors.
6. Go to `/admin/settings.php` and fill in your real contact details, social links, SMTP credentials (or leave SMTP host blank to use the server's own `mail()` function), and Google Analytics/Tag Manager/Pixel IDs.
7. Submit `sitemap.php` in Google Search Console.

---

## 6. Folder structure

```
/                       Public site pages (.php)
/includes/              Core app code (config, db, auth, functions, mailer, shared header/footer) — blocked from direct web access
/admin/                 Admin dashboard (requires login)
/admin/includes/        Shared admin layout
/database/schema.sql    Full database schema + seed data — blocked from direct web access
/uploads/media/         User-uploaded files (writable)
/css /js /img /fonts /favicon /video   Original Coriable template assets
install.php             One-time installer — delete after use
sitemap.php             Dynamic XML sitemap
robots.txt
```

---

## 7. Everyday content editing (non-technical staff)

- **Change homepage/about/contact text:** Admin → Page Content → find the block → Edit.
- **Update your logo or favicon:** Admin → Settings → Branding.
- **Add a service:** Admin → Services → Add service.
- **Publish a case study:** Admin → Portfolio → Add project.
- **Write a blog post:** Admin → Blog → Add post (supports scheduling).
- **Confirm a booking:** Admin → Bookings → change its status.
- **Follow up on an enquiry or custom project request:** Admin → Leads & Quotes → click the lead → update its pipeline stage and add notes.
- **Set up Google AdSense:** Admin → Settings → Google AdSense — add your publisher ID and optionally an ad unit snippet.
- **Add analytics/tracking IDs:** Admin → Settings → Analytics & marketing tags (GA4, GTM, Meta Pixel, Clarity, LinkedIn Insight, Search Console).
- **Add an award, certification, or review:** Admin → Awards & Certifications / Google Reviews.
- **Review a chat conversation:** Admin → Chat Transcripts.
- **Upload a logo/photo:** Admin → Media Library → Upload, then copy the URL into the relevant form's image field.

### A note on SEO and rankings

This build covers the technical and on-page SEO fundamentals — structured
data, clean URLs, meta tags, breadcrumbs, sitemap, page speed hygiene, and
keyword-informed copy based on real competitor research (Kava Media,
EnspireFX, WopeDigital, Ghana Web Designs, and several Ghanaian branding
agencies). No one can honestly guarantee a #1 Google ranking — that also
depends on backlinks, domain age/trust, ongoing fresh content, and how
competitive your target keywords are, none of which a single site build
controls. Submitting the sitemap to Search Console, publishing blog content
regularly, and building genuine backlinks (directories, press, partner
sites) are the next steps that move rankings over time.

---

## 8. Notes on the SMTP mailer

`includes/mailer.php` implements a minimal SMTP client using PHP's
built-in `stream_socket_client` — no Composer/PHPMailer dependency,
matching the approach used in your other cPanel-hosted projects. If no
SMTP host is set in Settings, it automatically falls back to PHP's
`mail()` function.

---

## 9. Default admin login

If you imported `schema.sql` directly via phpMyAdmin instead of running
`install.php`, the seeded account is:

```
Email:    admin@coriable.com
Password: (the seeded hash is a placeholder and will not match any
           password — use install.php, or update the row's
           password_hash with PHP's password_hash() function before
           attempting to log in)
```

**Running `install.php` is the recommended path** — it sets a real,
working password for you in one step.
