phpQ Developer Usage Manual & CLI Reference

Part 1: 60-Second Quickstart Workflows

Choose your preferred method to protect your PHP code.

METHOD 1

Build Entire Project

Encode whole repositories with directory structure, assets, and ignore rules preserved:

phpq protect.txt

→ Recommended for production web apps (Laravel, WordPress, Yii).

METHOD 2

Single File Encoding

Rapidly protect a standalone file with AST obfuscation and comment stripping:

phpq encode -i index.php -o index_enc.php

→ Perfect for license checkers, helper plugins, and microscripts.

METHOD 3

Windows Drag & Drop

Zero CLI setup required on Windows:

1. Open Windows Explorer

2. Drag protect.txt

3. Drop onto phpQ.exe

→ Automatically builds output in target folder!

Part 2: Master Project Specification (protect.txt)

Complete parameter dictionary and configuration reference.

Download Template

# ==============================================================================
#                      phpQ ENTERPRISE PROTECTION SUITE v1.2.0
#                   MASTER PROJECT CONFIGURATION & SECURITY SPEC
#                           (protect.txt / project.txt)
# ==============================================================================

# [project] - Unique Identity & Secret Master Key
[project]
id = MY_AWESOME_PROJECT_2026        # Alphanumeric identifier, no spaces
key = 7f8a9b2c3d4e5f601a2b3c4d5e6f7081  # Master secret for AES-256-GCM derivation
lock = true                         # Cross-File lock: prevents extracting single files

# [paths] - Source Code and Target Build Directory
[paths]
source = ./source                   # Directory containing unencoded PHP code
target = ./dist_protected           # Output directory for protected artifacts

# [options] - Code Obfuscation & Intellectual Property Protection
[options]
obfuscate = true                    # AST control-flow flattening & variable mangling
strip_comments = true               # Removes comments, PHPDocs, redundant whitespace

# [advanced_options] - PHP Engine Parsing & Compiler Strictness
[advanced_options]
asp_tags = false                    # Parse <% %> tags (Default: false)
short_tags = true                   # Parse <? ?> short open tags (Default: true)
dont_integrate_loader = false       # Omit runtime bootstrap header (Default: false)
report_e_strict = true              # Terminate on strict PHP warnings
stop_on_errors = true               # Abort compilation immediately on syntax error
keep_mtime = true                   # Retain original file timestamps
only_changed = false                # Incremental build mode (CI/CD accelerator)

# [custom_code] - Branding & Error Messages
[custom_code]
custom_header_code = // Protected by phpQ Enterprise Suite - All Rights Reserved.
loader_not_installed_error = echo "Error: phpQ Loader required.\n"; exit(1);
license_custom_text = Licensed to Enterprise Corp 2026

# [lock_options] - Licensing & Expiration Restrictions
[lock_options]
lock_to_license = false             # Require valid web.lic to execute (true/false)
license_file_name = web.lic         # Cryptographic license filename
# expiration_date = 2027-12-31      # Absolute expiration timestamp
# expire_in_days = 365              # Relative validity calculated from build time

# [domain_locks] - Domain Name Restrictions
[domain_locks]
# myclient.com
# *.myclient.com
# localhost
ignore_domain_cli = true            # Bypass domain checks when executed via CLI/Cron

# [ip_locks] - Server IPv4 / IPv6 Restrictions
[ip_locks]
# 192.168.1.100
# 10.0.0.0/24
ignore_ip_cli = true

# [machine_locks] - Hardware Machine ID Node Lock
[machine_locks]
# b857dbc162a4e36aca703dcd3008336b324e60bb87306f285090285c7b9829b1

# [ntp_time] - Anti-Clock Tampering Network Verification
[ntp_time]
server = pool.ntp.org
server = time.google.com
check_date_ntp = false              # Real-time online clock verification

# [encode] - Matching files to encrypt into bytecode
[encode]
*.php
*.phtml

# [copy] - Static assets copied 1:1 without alteration
[copy]
.htaccess
robots.txt
composer.json
public/*
assets/*

# [ignore] - Excluded development files, VCS, and logs
[ignore]
.git
.vscode
node_modules/*
storage/logs/*
tests/*
*.log
*.tmp

Part 3: Complete CLI Command Reference

Command syntax for encoding, licensing, and diagnostics.

1. BUILD PROJECT FROM CONFIGURATION FILE CORE BUILD

phpq protect.txt

Override source and target folders on the fly without modifying config:

phpq protect.txt -s /var/www/source -t /var/www/dist

2. ENCODE STANDALONE PHP FILE SINGLE FILE

phpq encode -i <source_file.php> -o <output_file.php> [flags]

Supported Flags:

--obfuscate: Flattens control-flow and mangles variables.
--strip: Strips all comments, PHPDocs, and redundant whitespace.
--machine-id <hash>: Locks execution to a specific server hardware hash.
--expire "YYYY-MM-DD": Binds execution to a hardcoded expiration date.
--domain "example.com": Locks file to an authorized domain.

3. ISSUE OFFLINE CRYPTOGRAPHIC LICENSE (web.lic) LICENSING

phpq license --project-id <ID> --project-key <KEY> -o <path/web.lic> [options]

Real-world Example (Locking Domain & Hardware & Expiration):

phpq license --project-id "MY_APP" --project-key "7f8a9b2c..." \
  --domain "client.com" \
  --machine-id "b857dbc162a4e36aca703dcd3008336b324e60bb87306f285090285c7b9829b1" \
  --expire "2027-12-31" \
  -o /var/www/html/web.lic

4. QUERY MACHINE ID & DIAGNOSTICS DIAGNOSTICS

# Print server Machine ID:

phpq machine-id

# Inspect loader diagnostics:

phpq info

Part 4: Cryptographic Offline Licensing (web.lic)

ECDSA P-256 asymmetric cryptographic protection with zero phone-home servers.

Unlike traditional licensing tools that mandate maintaining an active authentication server (which breaks if the licensing server goes down or is firewalled), phpQ employs NIST ECDSA P-256 asymmetric cryptography.

100% Offline

Validated locally within the PHP loader extension in memory. No network calls, telemetry, or external pings.

Hardware Node-Lock

Binds to CPU and motherboard UUID. If the license file is copied to an unauthorized VPS, the application halts immediately.

Expiration Enforcement

Cryptographically enforces trial and subscription dates. System clock rollbacks can be blocked via optional NTP verification.

How to Deliver Licenses to Customers:

Client runs: php -r "echo phpq_machine_id();" on their server and sends you the hash.
You generate the license: phpq license --project-id APP --project-key KEY --machine-id HASH -o web.lic
Client uploads web.lic into their web root directory next to index.php.

Part 5: CI/CD Pipeline Automation (GitHub Actions)

Automate software protection and deployment in continuous integration workflows.

Example .github/workflows/encode-and-deploy.yml workflow:

name: Build & Protect PHP Application

on:
  push:
    tags:
      - 'v*'

jobs:
  encode:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Setup PHP Runtime
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'

      - name: Download phpQ Compiler
        run: |
          wget https://your-server.com/phpq/download/phpQ
          chmod +x phpQ
          sudo mv phpQ /usr/local/bin/phpq

      - name: Compile and Obfuscate Project
        run: |
          phpq protect.txt --source ./src --target ./dist

      - name: Upload Protected Release Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: protected-release
          path: ./dist

phpQ Usage Guide & CLI Reference