MVC Forge 1.0: stable multilingual PHP MVC/CMS platform

MVC Forge 1.0.0 is the first stable release of the private, self-hosted PHP MVC/CMS platform for multilingual websites, SEO content and administration systems whose owners need full operational control. The project has moved well beyond an initial MVC skeleton: it now includes page and news management, languages, users, permissions, an API, installation commands, security checks and production monitoring.

MVC Forge is not intended to be another WordPress clone or a generic framework that claims to solve every possible problem. It focuses on websites where clean URLs, multilingual content, controlled publishing, owned infrastructure and CMS workflows tailored to the business are more important than a large plugin catalogue.

What is MVC Forge 1.0?

MVC Forge is a custom PHP platform based on the Model–View–Controller architecture. Its application core connects the router, middleware pipeline, controllers, services, models, database layer and view rendering. The public surface is isolated through public_html, while configuration, business logic, migrations and runtime data remain outside the directly exposed web root.

The platform uses PSR-4 autoloading, PHP 8.2 or newer, MariaDB/MySQL, Composer and a modern frontend build based on Vite and Tailwind CSS. This keeps server-rendered output suitable for SEO while providing a contemporary workflow for CSS and JavaScript assets.

What can MVC Forge do today?

Multilingual pages, news and navigation

MVC Forge manages pages, blog posts, categories, tags and navigation menus separately for each language. Localized variants of the same content share a translation group but retain their own title, slug, URL, SEO metadata and taxonomy.

This separation prevents practical publishing errors: Croatian news does not have to reuse Serbian records, a German article cannot accidentally receive a Serbian category, and public lists expose only already-published content in the requested language. The newest posts appear first, with a deterministic fallback when two items have the same publication timestamp.

API-first publishing and content automation

A protected API is available for pages, posts, categories, tags, languages, menus and users. The authenticated author is derived from the API token and access is constrained by permissions. Multiple translations can be published through an atomic bulk operation: if one language variant fails validation, the complete set is rolled back instead of leaving partially published content.

The API also supports featured-image uploads. This enables controlled work with AI tools and other automation: existing languages and taxonomies are inventoried first, translations, imagery and SEO fields are prepared next, and content becomes public only after validation succeeds.

CMS and administration workflows

The administration area covers pages, blog content, navigation, languages, users, roles and permissions. Page-constructor modules, contact messages, geographic data and additional domains such as VideoTube content and Stripe business operations are also present. Some advanced modules are still being stabilized, but the core editorial path already runs on a real production installation.

Security as an architectural layer

The security stack includes authentication, roles and permissions, CSRF protection for browser requests, Bearer tokens for the API, rate limiting, HTTP security headers and session controls. A dedicated CLI audit enumerates state-changing routes and reports missing authentication, CSRF or API-token protection.

This does not mean the security work is complete. A deeper permissions audit across dashboard routes, stricter production policies for selected headers and more tests for uploads, sessions and sensitive editorial operations are still required. The important change is that security now has a measurable control framework rather than relying only on manual inspection.

Installation, migrations and production visibility

The app/bin/console command line covers initial setup, PHP-extension and database checks, storage preparation, application keys, migrations, seed data, cache clearing, route inspection, security audits and system health checks.

Production deployments receive a marker containing the commit identity, branch and build time. A health endpoint checks the database, cache, logs and writable directories, while an external smoke test verifies the homepage, frontend assets, images and multilingual news sections. This makes the exact code running on the server visible and testable.

What does the MVC Forge 1.0 release represent?

MVC Forge 1.0.0 was released on July 16, 2026 as the first stable framework and CMS baseline. Its annotated SemVer tag v1.0.0 confirms that installation, multilingual publishing, the API, security controls, deployment identity and core production checks now form a stable foundation. The platform powers aleksandar.pro and is used for real multilingual publishing, image management, SEO metadata and controlled production changes.

The current quality gate includes PHP linting, PHPStan, PHPUnit and legacy integration checks. At the time of this update, the complete suite passes 79 PHPUnit tests with 306 assertions, in addition to model and dashboard checks. Release 1.0 standardizes the process on the main branch and annotated SemVer tags, while Vite 6.4.3 and PostCSS 8.5.19 remove known npm audit findings. Production has a deployment marker, a health check and an external smoke test.

What comes after version 1.0?

• fully automated Git/CI/Coolify deployment without manual production steps;
• a CI database service that accurately reproduces the production MariaDB/MySQL workflow;
• a complete permission audit for all dashboard routes;
• a standardized media library for asset reuse and safe deletion;
• automated database and upload backups with a tested restore procedure;
• further separation of large controllers, route files and legacy compatibility code;
• fully tested editorial, VideoTube and payment/entitlement workflows.

Version 1.0 does not mean development is finished. It establishes a stable foundation and clear SemVer upgrade rules; these items now form the post-1.0 roadmap for deeper automation, operational resilience and reliable use across more projects.

Which projects is MVC Forge designed for?

• multilingual company and personal websites with strong SEO requirements;
• portals and specialist blogs that need controlled editorial publishing;
• projects that want an owned CMS without dependence on a large plugin ecosystem;
• self-hosted applications with custom administrative and business modules;
• teams that want AI automation to operate through a constrained, verifiable API.

Frequently asked questions about MVC Forge

Is MVC Forge a replacement for WordPress?

Not as a universal drop-in replacement. MVC Forge is a better fit when architectural control, custom workflows, multilingual publishing and owned deployment matter more than access to a large library of ready-made themes and plugins.

Is the platform production-ready?

Yes. MVC Forge 1.0.0 is the first stable baseline for the documented CMS core, multilingual publishing, API, installation flow and operational checks that already run in production. Automated deployments, backups, deeper permission auditing and advanced modules remain part of post-1.0 development.

Can MVC Forge support AI-assisted publishing?

Yes. Its API-first flow can inventory existing content, prepare localized variants, publish them atomically, upload a featured image and verify the author, taxonomy and public URLs before the operation is considered complete.

A platform shaped by real production use

MVC Forge is not developed only against a theoretical roadmap. Every new capability is exercised through a real website, a real database, multiple languages and production verification. The next phase is therefore not uncontrolled feature growth. It is the systematic removal of operational risk and the continued evolution of a stable 1.0 platform as a reproducible, maintainable and dependable product.