Turn one memorable link into your complete online presence.

BioLink Pro is a self-hosted link-in-bio and creator-profile platform. It gives each account holder a public profile URL where they can combine rich content blocks, social networks, recognized creator-platform destinations, contact forms, access controls, sharing tools, and performance analytics.

You can add standard link cards, headings, explanatory text, dividers, uploaded images, supported video embeds, countdowns, and contact forms. Standard links can include titles, subtitles, icons, badges, price labels, featured styling, schedules, password protection, sensitive-content treatment, and an external checkout presentation.

Yes. Your handle creates a public address in the format /@yourhandle. You can place that same address in social biographies, messages, QR codes, printed materials, or campaigns while changing the blocks behind it from your dashboard.

Yes. The dashboard supports ordering controls and drag-and-drop reordering. This lets you move the most important campaign, live destination, membership, store, booking form, or announcement to the top without recreating the profile.

Yes. Creator-platform destinations are stored as independent records, so a profile can contain multiple accounts or pages from the same provider when each URL is valid and the installation policy permits it.

The catalogue contains 54 definitions, including representative live services such as Chaturbate, Stripchat, MyFreeCams, CAM4, BongaCams, LiveJasmin, CamSoda, and Streamate; membership services such as OnlyFans, Fansly, Fanvue, LoyalFans, and FanCentro; and clip stores such as ManyVids, Clips4Sale, and iWantClips. It also includes support, wishlist, private-interaction, social, and professional destinations.

Yes. Use a standard link block or the generic Website destination for any valid public HTTP or HTTPS URL. Automatic provider labeling, official-domain validation, and automatic adult classification apply only to recognized definitions.

No. Creator destinations are public links. The application does not request or store your password, session cookie, API token, private account data, or payment credentials for those external platforms.

When strict validation is enabled, the hostname of a destination must match the recognized provider or one of its valid subdomains. A misleading address such as provider.example.net is not treated as the official provider. The destination is checked during saving and again before the public redirect.

For recognized adult destinations, the installation can require a visitor to confirm that they meet the applicable age requirement before continuing. The confirmation is processed server-side and remembered temporarily in the visitor session. It is a declaration, not identity-document or legal age verification.

Yes. A block marked as sensitive is rendered behind a reveal control. Sensitive image media is deferred rather than loaded into the page before the visitor explicitly reveals the content.

Yes. Password-protected links first show an unlock form. The destination is made available only after the correct password is submitted. Use this for limited resources, private campaign links, or material intended for a known audience—not as a replacement for full digital-rights management.

No subscription or payment is required to use the platform. Creator profile owners may still place links to their own external offers or checkout pages; those transactions remain outside BioLink Pro. Service continuity is supported by clearly identified banners and occasional pop-ups.

Yes. Set an optional start date and end date. Before the start or after the end, the block is excluded from the public profile. This is useful for launches, temporary offers, live schedules, ticket windows, event links, and limited collaborations.

Yes. Add a contact-form block. Valid submissions are delivered to your private dashboard inbox, where you can search, mark them read or archived, delete them, and export recent messages. Optional email notifications require working SMTP configuration.

The form uses CSRF protection, a honeypot field, input validation, rate limiting, and a one-way visitor fingerprint for abuse control. These measures reduce automated abuse but do not guarantee that every unwanted human message will be blocked.

The dashboard can report profile views, destination clicks, social-platform clicks, click-through rate, device categories, and referrer hosts across supported reporting periods. The purpose is to help you compare blocks and improve profile structure.

The application analytics module is designed to use one-way hashes for network identifiers rather than storing raw visitor IP addresses. Your web server, CDN, reverse proxy, or hosting provider may keep separate access logs according to its own configuration and retention policy.

Yes. The theme studio includes profile layouts, primary and secondary colors, background, surface and text colors, typography, card style, corner radius, background treatment, and an optional platform-branding preference. Your avatar, cover, and sharing image add further identity.

Yes. Profiles can use a custom Open Graph image and SEO title/description. The application also provides canonical profile URLs and social-card metadata so compatible services can build a richer sharing preview.

Yes. Eligible public profiles have a PNG QR endpoint. The QR foreground and background are derived from accessible theme colors, and the profile interface can expose copy, share, or download actions depending on browser support.

Discover is an optional directory of eligible public profiles. Visitors can search and filter it, while profile owners can opt out through their visibility settings. Administrators can disable the directory globally or feature selected profiles.

Yes, when following is available and the visitor is signed in with an eligible account. Your profile can display its follower total, or you can hide that public counter while the relationship data remains available to the application.

Yes, when reporting is enabled. Supported reasons include spam, impersonation, harassment, phishing or malware, unlawful content, copyright or trademark concerns, adult-safety concerns, and another explained issue. Rate limits, duplicate suppression, and fingerprints help reduce report abuse.

Accounts use password hashing and secure sessions. The security center can support TOTP two-factor authentication, encrypted authenticator secrets, one-use recovery codes, local password management, and connections to configured Google, Facebook, or X OAuth providers.

The application includes OAuth flows, but each provider requires valid credentials and exact callback URLs configured by the administrator. A provider button should not be considered operational until its developer application, secrets, redirect URL, and production permissions have been tested.

Yes. The installation includes an option that can require administrators to activate two-factor authentication before using protected administration functions.

The operator deploys the PHP application on their own compatible hosting account, domain, database, and Nginx/PHP-FPM environment. The operator is responsible for server maintenance, backups, SMTP, OAuth credentials, legal pages, abuse handling, upgrades, security patches, and availability.

The package targets PHP 8.2 or newer, PDO MySQL, MariaDB/MySQL, writable runtime directories, and a web server whose document root points to /public. The installer checks required extensions such as cURL, Fileinfo, GD, JSON, Mbstring, OpenSSL, PDO, PDO MySQL, Sodium, and ZIP. Application packages are restored directly from the browser.

A landing page can render static product information even when the database connection, table prefix, schema migration, seed data, PHP-FPM extension set, or locked application packages are incomplete. This release detects that degraded state, disables account calls to action, returns a structured 503 for database failures, provides a safe /healthz report, and offers browser-only dependency repair.

Run php scripts/diagnose.php --reference=REFERENCE from the application root. The command reports the active CLI runtime and application checks, then searches the protected application log for matching entries. PHP-FPM and CLI can use different versions or configuration files, so both environments must be compared.

After a complete source release is uploaded and a database/files backup is made, an administrator opens /admin/update. The updater checks code and database versions, applies pending migrations in order, prevents concurrent runs, writes logs, updates the installation lock, and clears application caches.

No. The health endpoint, logs, cron history, diagnostics, and updater are operational tools, not a substitute for tested database backups, file backups, uptime monitoring, TLS maintenance, malware monitoring, resource alerts, or a rehearsed restoration procedure.

No. Terms, privacy, and help pages are operational starting templates. The site operator must adapt them to the actual business model, hosting logs, cookies, payment destinations, moderation practices, age requirements, data-retention policy, and applicable jurisdiction.