Every week another CMS site gets defaced, another plugin leaks a user table, another station owner spends a weekend restoring backups. Here's the uncomfortable truth behind most of those stories: the damage lived in the database. Fortesonic's answer is radical in its simplicity — it doesn't have one.
Security you can explain in one sentence
When you buy a website, you're also buying its risks. So read this the way a buyer should: what exactly can go wrong on my server? With Fortesonic the honest answer is — very little, because there is very little there:
- No database, ever No MySQL to inject into, corrupt, back up or leak. There is no user table because there are no user accounts — your listeners never hand you a password that could be stolen.
- Nothing is stored locally Track data, artwork, history, weather — everything arrives live from public APIs (AzuraCast, iTunes, Open-Meteo) at request time and is sanitized before it touches the page. Your server holds the code, and that's it.
- Scripts, fonts and icons served from YOUR domain No third-party CDNs to go down, get compromised or track your audience. The JavaScript, the fonts, the Phosphor icon set — all shipped locally with the product. That's both a stability and a privacy feature.
-
Hardened before you even configure it
CSRF tokens, origin checks and per-client rate limiting on every write endpoint;
HTTPS + HSTS, clean URLs and hardened headers in the included
.htaccess. Security ships configured, not promised.
Why “boring” architecture is a buying argument
Compare the maintenance reality. A typical CMS radio site is a stack of moving parts — core updates, plugin updates, PHP compatibility patches, database backups — and skipping a few months of that routine is how stations end up in breach statistics. Not because anyone targeted them, but because bots scan the whole internet for known CMS holes, around the clock.
Fortesonic simply isn't in that game. There's no admin login page to brute-force, no plugin ecosystem to rot, no database daemon listening on a port. The site is vanilla PHP and vanilla JavaScript — readable, documented code with no framework that goes end-of-life under you.
A website you don't have to babysit isn't a luxury feature. It's what "owning" is supposed to mean.
Install it, brand it, and let it run
This architecture has a second payoff nobody markets: it can sit and work for years without demanding your attention. If the stream API ever goes down, the player switches to a clean offline state and recovers on its own. The license is perpetual, so nothing expires. And because the code is plain and the owner's manual is public, you don't need to hire a developer to manage it — anyone comfortable with FTP and a text editor can find their way around one configuration file. (Here's the whole install, step by step — it's shorter than this article.)
- Update cadence is yours to choose — 12 months of updates are included, but the site keeps working even if you never renew.
- Hosting requirements are minimal — PHP 8+, HTTPS, cURL. There's nothing else to provision, which also means nothing else to misconfigure.
- Prefer zero involvement? The Fortissimo plan runs the same white-label site on our managed server with automatic core and security updates — nothing for you to maintain at all.
public_html. No installer,
no database migration, no build step.What this is — and isn't
To be precise: this is not a claim that any website is “unhackable”. It's a statement about attack surface. A flat-file site that stores nothing and accepts almost no input simply gives an attacker very little to work with — and gives you almost nothing to maintain. That combination is why we say it with a straight face: for an AzuraCast station's public website, there is no safer, more reliable architecture on the market. The cost math says own it; the security math agrees.