Your website, your way.

Everything a website needs

What a professional website needs, in one administration, without plugins to hunt for.

New in version 8

Version 8 is a new generation of Pandao CMS for PHP 8.2 to 8.5: hardened, extensible, and easier to use every day. See Upgrading from version 7 before you move a site.

Live demo

The online demo runs this very version with the sample texts of the package. Its photos are shown for preview only and are not included: the package comes with its own sample photos, under the CC0 licence.

Requirements

Pandao CMS runs on most shared hosts, VPS and managed servers. Once it is installed, the Diagnostic screen checks every point below on your own server.

Package contents

The main file downloaded from CodeCanyon holds this documentation and the website, ready to upload. The PHP libraries are already installed: you do not need Composer.

pandao-cms-8.2.0/
├── documentation/            this documentation: open index.html
└── upload/                   the website: upload the contents of this folder
    ├── admin/                the administration (www.your-site.com/admin)
    ├── bin/                  command line: scheduled tasks and extensions
    ├── config/               the configuration, written by the installation wizard
    ├── extensions/           the extensions you add
    ├── public/               public files: media, brand images
    ├── setup/                the installation wizard
    ├── templates/default/    the theme of the website
    ├── vendor/               PHP libraries
    └── common/, core/, …     Pandao CMS

Installation

Allow about five minutes.

1. Create a database

   In your hosting panel (MySQL Databases in cPanel, Databases in Plesk), create an empty database with the utf8mb4 character set, and a user who has every privilege on it. Keep its name, its user, its password and its host (often localhost) at hand.

2. Upload the files

   Upload the contents of the upload/ folder to the web root of your domain (often public_html/ or httpdocs/), or to a sub-folder such as public_html/site/. The quickest way is to upload the zip with the file manager of your host, extract it there, then move the contents of upload/ into place. With an FTP client, make sure the hidden .htaccess files are sent too.

3. Run the installation wizard

   Open the address of your site: the wizard starts by itself. Give the title of the site, its public address (https://www.your-site.com, without a slash at the end), the e-mail address that receives the notifications, the login and password of the administrator (12 characters at least), then the details of the database. Click Install.

   www.your-site.com

   

   The wizard writes config/config.php and public/robots.txt: PHP must be allowed to write in config/ and public/ while it runs, which is the case on most hosts.

4. Log in

   Click Log in and sign in with the administrator account: the dashboard opens, and your site is ready to be made your own.

Sample content

A new site does not open on an empty page: it shows what each block can do, in English and French, ready to be replaced by your own words.

The photos are under the CC0 licence and the video is in the public domain: you may keep them on your site. Every sample is edited or unpublished like any content. A site with one language only keeps the English texts.

Launch checklist

The settings to review before you open your site, in the order that saves time.

1. General settings

   Settings › General: title of the site, public site URL, time zone, date and time formats, the languages (Enable foreign languages) and the template.

   www.your-site.com/admin/module=settings

   

2. Contact details and e-mails

   Settings › Contact: name, address, phones and e-mail of your company, shown in the header, the footer and the contact page. Settings › Email settings: the sender, and the SMTP server of your mailbox for a reliable delivery.

3. Your brand

   Settings › Appearance: logo, footer logo, e-mail banner, favicon and brand colours. See Branding & theme.

4. Your content

   Replace the sample texts and photos, page by page: the home page and its widgets, the Features page, the articles and the footer.

5. Your legal pages

   The Legal notices and Privacy policy pages hold model texts: complete the passages between brackets.

6. The anti-robot check

   Create reCAPTCHA keys on google.com/recaptcha and paste them in Settings › General (Captcha: public key and secret key): the contact form, the forms and the comments are then checked.

7. Your users

   Change the password of the administrator if needed, and create an account for each person who edits the site, with the right role (Users & roles).

Upgrading from version 7

Version 8 is a new generation: its database has new tables and columns, its administration new screens, and its theme new widget positions. It is installed as a new site beside your version 7 site, then imports its content in a few clicks. The old site is only read: it keeps working until you switch.

1. Back up

   The files and the database of your version 7 site.

2. Install version 8

   Follow the installation in a folder beside the old site, on the same hosting (a temporary sub-domain is ideal), with a new, empty database: never reuse the one of the old site.

3. Import your site

   In Settings › Database, click Import a Pandao CMS 7 site. The sites found beside the new one are offered: choose the old one, or type its folder, the one that holds its config folder. The screen lists what it holds; tick the confirmation, click Import, and keep the page open until the report, usually within a minute.

4. Read the report

   It lists what is left to do: set your brand colours, look again at the pages whose layout you had changed in the theme of version 7, complete the privacy policy page that was added. Then browse the new site.

5. Switch the domain

   Point your domain to the folder of the new site, and update the Public site URL in Settings › General.

The import takes the languages, pages, articles, menus, widgets, slides, media library, comments, messages, popups, texts, e-mails and accounts of the old site, the files of its media, its logos and its settings. Each page and article keeps its address, so that links and search rankings follow, and each account its password. What version 8 adds is kept, in your languages: its new texts and e-mails, the privacy policy page and the slideshow widget. The content of the new site is replaced; its administrator account stays.

Updating

New versions are published on CodeCanyon, in your Downloads, with their notes in the changelog.

1. Back up

   The files and the database of the site.

2. Upload the new files

   Upload the contents of the upload/ folder of the new package over your site. Your configuration (config/config.php), your media and your brand images are not in the package: they are kept. Changes made to the theme belong in a child theme (see Customisation), so that an update never overwrites them.

3. Apply the updates of the extensions

   When an extension receives new files, every screen of the administration shows a banner with its new version and an Update now button (also offered in Extensions). Click it when the upload is complete: its database is brought up to date in a few seconds. Until then, its pages tell your visitors that the site is being updated, with a code that search engines read as temporary.

The administration

Everything is managed from https://www.your-site.com/admin/, on a computer, a tablet or a phone.

www.your-site.com/admin/

The menu on the left groups the modules in sections: Content (pages, articles, slideshow, widgets, popups, menus, media, tags), Communication (comments, messages, forms, e-mail templates) and Configuration (texts, social links, languages, locations, currencies, users). Each extension adds its own section. Settings, Extensions, Diagnostic and Trash sit beside them.

Every module has a list, with a search, filters, sorting by drag and drop when the order matters, and actions on several items at once (publish, unpublish, delete), and a form, with a tab per language for what is translated.

Pages & page builder

The pages form the tree of your site: each has its place, its model, its address and its text.

www.your-site.com/admin/module=page&view=list

• Model: the layout of the page. page shows the text of the page builder, home the home page, blog a list of articles, contact the contact form and the map, privacy the privacy policy, search the search results, 404 the “Not found” page. Extensions add their own models.
• Parent: the page it belongs to, for the tree, the breadcrumb and the menus.
• Alias: its address (/en/features), Title tag, Description and Robots for search engines.
• Images and files: the photo of the header of the page, a gallery of two images or more, and documents to download.
• Comments and ratings, turned on page by page.

The page builder

The text of a page is composed with the page builder: drag containers, rows of one to four columns, headings, texts, images, videos (YouTube, Vimeo or a file), buttons, cards and separators, then write in each block. Code shows the HTML of the page, to copy it or paste one.

www.your-site.com/admin/module=page&view=form

A form built in Forms is placed in a page or a widget with its shortcode, such as [form id="quote"].

Articles & blog

Articles are the news, posts and stories of the site. Each article belongs to a page, which lists it (a blog page, or any page), and has its own page too.

• A summary for the lists and the cards, a text, photos and files.
• Tags (Content › Tags), which become filters above the list of articles.
• Publication and end dates: an article appears and disappears on its own.
• Home: the article is featured on the home page, by the Featured articles widgets.
• Comments and ratings, article by article.

www.your-site.com/en/features

Slideshow & widgets

The blocks of the pages are widgets you place, order, translate and hide in Content › Widgets, without touching any code.

www.your-site.com/admin/module=widget&view=list

The slides are edited in Content › Slideshow: an image or a YouTube video, and a text with its title, in each language. On the home page, the title of the first slide is the main title of the page for search engines.

Menus

In Content › Menus, each entry leads to a page, an article or an address, in the main menu (header), in the footer menu, or in both, with its sub-entries and its order. A new page can be added to the main menu from its own form.

Media library

All the images and files of the site, in folders, in Content › Media, and from the text editor.

www.your-site.com/admin/module=media&view=list

• An image is resized for phones, tablets and computers, and receives a lighter WebP copy, served to the browsers that read it.
• The focal point of an image keeps its subject in view when it is cropped to fit a block.
• Replace a file keeps its address: the pages that use it show the new version at once.
• The images of a page, an article, a slide or a widget are uploaded in its form, with their label (the alternative text read by search engines and screen readers).

Popups

A popup (Content › Popups) shows a message over the page, once per visit: an announcement, an offer, a closing notice. It has its text in each language, its background colour, its pages or all of them, and its publication dates.

Forms & messages

Build the forms you need, field by field, without code: a quote, a registration, a survey.

1. Create the form

   In Communication › Forms: its title, its identifier (used in the shortcode), the addresses that receive the answers, whether the answers are kept in the administration, the subject of the e-mail, the label of the button and the message shown once it is sent.

2. Add its fields

   Text, e-mail, phone, number, date, long text, list, check boxes or radio buttons, with their label, their placeholder and whether they are required, in each language.

3. Place it

   Paste its shortcode, such as [form id="quote"], in a page or a widget.

The messages of the contact page and the answers kept are listed in Communication › Messages. Forms are protected against robots by reCAPTCHA when its keys are given, and limited per visitor.

Comments & ratings

Turn on the comments, and the ratings, in the form of a page or an article. A comment waits in Communication › Comments until you publish it. The published comments with a rating of a page are shown by the Testimonials widget of that page.

E-mails

Every e-mail of the site is a template of Communication › Emails content, in each language, with variables such as {name} or {site_url} replaced when it is sent: the confirmation of an account, the request of a new password and the password itself, a message of the contact page. Extensions add their own templates.

The e-mails carry the banner of Settings › Appearance, and are sent through the SMTP server of Settings › Email settings when you give one. Microsoft 365 with OAuth needs the league/oauth2-client library, installed with Composer. A sender address of your own domain, and the SPF and DKIM records of your domain set with your host, help delivery a lot.

Languages & texts

Offer your site in as many languages as you need, right-to-left ones included.

1. Turn on Enable foreign languages in Settings › General: the language selector appears in the header, and the addresses carry the language (/en/…, /fr/…).
2. In Configuration › Languages, publish or add a language: its name, its code (de), its locale (de_DE), its flag and, for Arabic or Hebrew, right to left. Each content receives a copy to translate, in the main language.
3. Translate the content in each form (a tab per language), then the interface: Configuration › Texts for the texts of the website, and Communication › Emails content for the e-mails.

www.your-site.com/fr

In a right-to-left language, the whole website is mirrored: menus, carousels, forms and buttons. The administration is available in English, French, Spanish, Portuguese, Dutch, Russian and Turkish, chosen in Settings › General (Admin panel language).

Users & roles

In Configuration › Users, each account has a role:

Extensions add their own roles, with the only permissions they need. Each user changes their name, e-mail and password in Settings › Profile.

Branding & theme

Your logo and your colours, without editing a file: Settings › Appearance.

www.your-site.com/admin/module=settings#appearance

• Visual identity: the site logo, the footer logo (for the dark background), the e-mail banner and the favicon (32 × 32 px), in PNG. Use the template default goes back to the images of the theme.
• Brand colours: the main colour and the highlight colour. Left empty, the colours of the theme apply, shown in grey.

The website uses the default theme of Pandao CMS, chosen in Settings › General › Template. To change the theme itself, create a child theme (see Customisation).

Social links, locations & more

• Social links (Configuration › Social links): the icons of your networks in the header of the site.
• Locations (Configuration › Locations): the places shown on the map of the contact page, with their address and their position. The map needs a Google Maps key (Settings › General).
• Currencies (Configuration › Currencies): the main currency of the prices, and others for extensions that sell.
• Search: Enable search in Settings › General adds a search to the header, with its results page: the pages and articles that hold every word typed, with or without accents, each with a passage of its text.

SEO

• Clean addresses in each language (/en/features/extensions), with the Alias, Title tag, Description and Robots fields of each page and article.
• When an alias changes, the old address redirects to the new one (301), so that links and rankings follow.
• A sitemap (/sitemap.xml) with the pages and articles of each language, and a robots.txt kept up to date.
• A canonical address for each page, from the Public site URL of the settings, and hreflang tags between the translations.
• Light pages: images resized with WebP copies, loaded when they come into view, and no call to an outside library.
• The code of Google Analytics in Settings › General: with the cookie banner, it only runs once the visitor accepts the statistics cookies.

Privacy & security

Maintenance mode

Turn on Maintenance mode in Settings › General while you prepare your site: visitors see a page with your message, and search engines are told to come back later (code 503), while you, logged in to the administration, browse the site as usual.

Trash, drafts & locks

• Deleted items go to the Trash, from which they are restored, or deleted for good.
• A form keeps a draft while you type: closed by mistake, it offers to restore what you wrote.
• An item being edited by someone else is locked for you meanwhile, and says by whom.

Diagnostic

The Diagnostic screen, next to the settings, checks PHP, the database, the server and the scheduled tasks, and says what to ask your host.

www.your-site.com/admin/module=diagnostic

Copy the report copies a report without any password, to join to a request for support.

Scheduled tasks

Pandao CMS runs the scheduled tasks of its extensions: a site without extension has none. When an extension needs them, add a cron job that runs bin/pandao cron every minute: Diagnostic › Advanced configuration shows the exact line for your server, with the path of its PHP. It looks like this:

* * * * * /usr/bin/php /home/your-account/public_html/bin/pandao cron >/dev/null 2>&1

Without a cron job, the site runs the tasks itself after a visit, at most every ten minutes, on hosts that use PHP-FPM (most of them).

Customisation

Keep your changes out of the files of the package, so that every update stays a simple upload.

A child theme

A theme is a folder of templates/. A child theme only holds the files it changes: every file it does not have is taken from the default theme.

1. Create templates/my-theme/ (lowercase letters, digits, hyphens).
2. Add your styles in templates/my-theme/assets/css/custom.css, loaded after the styles of the theme.
3. To change a template, copy it at the same path from the default theme: views/partials/header.php, views/partials/footer.php, views/page.php, widgets/featured_home.php…
4. Choose it in Settings › General › Template.

Texts and e-mails need no code: they are edited in the administration.

Extensions

An extension adds a whole feature to the site (a booking engine, a shop, a directory) without touching the files of Pandao CMS, so that each one is updated apart.

www.your-site.com/admin/module=extensions

• Upload the folder of an extension into extensions/, then click Enable in Extensions: its tables are created and its menu appears.
• Settings opens its settings, Disable stops it and keeps its data.
• New files of an extension wait for Update now, as described in Updating.
• An extension that does not suit the version of Pandao CMS or PHP of the server is shown as Incompatible, and is not loaded.

Build an extension

An extension is a folder of extensions/, whose name is its identifier (lowercase letters, digits and underscores).

extensions/my_extension/
├── extension.json            its manifest
├── src/Extension.php         Pandao\Extensions\MyExtension\Extension
├── admin/modules/            its modules of the administration
├── admin/langs/              its texts of the administration
├── templates/views/          its pages, which a theme can override
├── public/                   CSS, JS and images, served under /extensions/my_extension/
└── migrations/0001_create_tables.php

{
    "name": "my_extension",
    "title": "My extension",
    "description": "A short text shown in the administration.",
    "version": "1.0.0",
    "requires": { "pandao": "^8.1", "php": ">=8.2" },
    "admin": { "title": "My extension", "icon": "puzzle-piece", "menu": ["item"] }
}

The register() method of its Extension class declares what it adds: routes of pages and system routes, XHR actions, screens and actions of the administration with their permission, widgets, settings, roles, scheduled tasks, and hooks (actions and filters) such as front.head, front.footer, admin.dashboard or sitemap.entries. It only declares: it runs at each request, without touching the database.

A migration is a PHP file that returns static function (\PDO $db): void; the migrations run in the order of their numbers, once, at the activation and at each update, and their history is kept. "multilingual": true in the manifest opens a new site in its languages, when the extension ships with Pandao CMS in a package.

Command line

From the folder of the site, with the PHP of the site and its user:

php bin/pandao cron                                # runs the scheduled tasks that are due
php bin/pandao extension:list                      # lists the extensions and their state
php bin/pandao extension:enable my_extension       # enables an extension, as the Extensions page does
php bin/pandao extension:update my_extension       # applies the update of an extension
php bin/pandao extension:disable my_extension      # disables it, and keeps its data
php bin/pandao import:v7 /path/to/old-site         # what a version 7 site holds
php bin/pandao import:v7 /path/to/old-site --run   # imports it into this site

To display the PHP errors while you investigate a problem, add define('PMS_DEBUG', 1); to config/config.php, then remove it: a live site never shows its errors, it writes them in the PHP log of the server.

Troubleshooting & FAQ

Start with the Diagnostic screen: it checks PHP, the database, the server and the scheduled tasks, and says what to ask your host.

The wizard does not open, or every page answers “Not found”

The .htaccess files were not uploaded (they are hidden: show the hidden files in your FTP client), or the server ignores them. Ask your host to turn on mod_rewrite and allow .htaccess files (AllowOverride All). On IIS, URL Rewrite reads the web.config file.

A blank page or an “error 500”

Check the version and the extensions of PHP (see Requirements), then the PHP error log of your hosting panel. define('PMS_DEBUG', 1); in config/config.php shows the error for a while.

E-mails do not arrive

Give the SMTP server of your mailbox in Settings › Email settings, with a sender address of your own domain, and look in the spam folder.

The map of the contact page is empty

Give a Google Maps key in Settings › General, and at least one place in Configuration › Locations.

An image looks cut

Set its focal point in the media library: the part of the image you choose stays in view.

A language is missing from the selector

Turn on Enable foreign languages, and publish the language in Configuration › Languages.

An extension is shown as Incompatible

It needs another version of Pandao CMS or of PHP: its line says which. Update Pandao CMS, or ask your host for the version of PHP it needs.

Support

We answer through the Support tab of the page of Pandao CMS on CodeCanyon.

• Item support comes with your purchase for 6 months, and can be extended to 12 months. It covers questions about the features of the product, the fixing of bugs, and help with the third-party assets it includes, as described by the item support policy of Envato. Installation services and customisation are not included.
• To get a quick answer, describe what you did, what you expected and what happened, give the address of the page, and paste the report of the Diagnostic screen (Copy the report). Never send a password in a message.

Credits & licences

Pandao CMS is made by Pandao and sold under the licences of Envato Market. It includes the following resources, each under its own licence. The photos of the online demo, which the screenshots of this guide show, are for preview only and are not included.

Changelog

Version 8.2.0 New

The first version 8 of Pandao CMS sold on its own. A new generation for PHP 8.2 to 8.5 (see New in version 8):

• hardened security: rewritten routers, prepared queries, protection of the forms, security headers, limited login attempts;
• extensions, with their pages, modules, widgets, settings, roles, scheduled tasks and database updates, and an Extensions page;
• page builder, form builder, popups, media library with folders, focal points and WebP copies, trash, drafts and editing locks;
• widgets in every position of the theme, evenly spaced on every page, right-to-left languages, a cookie banner with “Reject all”, a privacy policy page;
• a Diagnostic screen, scheduled tasks run by the visits when the server has no cron job, and a command line;
• icons, fonts and sample photos under open licences, and real sample texts in English and French;
• a new site opens in the languages of the extensions shipped with it;
• while an extension waits for its update, the site tells its visitors that it is being updated, and every screen of the administration offers the button;
• the import of a version 7 site, with its content, accounts, media and settings, keeping its addresses (see Upgrading from version 7);
• a search of the site that finds its pages and articles, with or without accents.