Stela Apartmani — a secure migration off a vulnerable legacy CMS to Laravel

The Challenge

Stela Apartmani is a family business that has hosted beachfront guests near Šibenik for 30 years. The site had long been available in six languages — Croatian, English, German, Russian, Czech, and Chinese — but it ran on a CMS, a custom PHP system dating back to PHP 7.2, with a hand-rolled admin panel the owner used to edit apartments, the gallery, and the blog.

An independent security audit of that old site found nine critical vulnerabilities: the database password sitting in plaintext in a config file, SQL injection through string concatenation in dozens of places, admin passwords stored with no hashing at all, XSS in the contact form, no CSRF protection on any form — and the entire application, config included, living directly inside the web-accessible directory. 

This needed a rebuild, not a patch, while keeping the site's SEO standing and its six-language reach for tourists.

The Solution

I replaced the old site entirely with a new one built on Laravel with Livewire and Volt. The design was supplied by the client — my job was the engineering: a secure admin CMS replacing the exposed admin/ directory, Eloquent and prepared statements everywhere instead of string concatenation, Fortify-hashed authentication, and CSRF protection on every form, with files structured outside the web root the way Laravel expects.

For the six languages, I built a proper translation architecture — separate translation tables per content type, with translated slugs for every language for SEO. The admin panel is always Croatian, while the public site resolves language through three tiers: a session choice, then the browser's language, then a default — kept fully separate from the admin locale.

What I Built

• Migration off CMS — every vulnerability from the security audit closed by the move to Laravel 12
• A six-language site — hr/en/de/ru/cz/zh with translated slugs, including a fix for Chinese slugs (pinyin transliteration)
• A custom admin CMS — homepage sections, apartments and content, gallery categories, a blog with auto-calculated reading time, guides, static pages, reviews
• An apartment catalog — per-apartment image galleries with primary-image selection and drag-to-reorder
• Reservation and contact forms — Google reCAPTCHA protection and a GDPR cookie consent banner
• 301 redirects from the old site — SEO standing preserved through the whole migration

The Results

• Nine critical vulnerabilities closed — exposed database credentials, SQL injection, unhashed passwords, and XSS are history
• The owner still edits everything himself — apartments, blog, and pages in six languages, from one dashboard
• SEO standing preserved — the old site redirects to the new one with no loss of ranking
• Nothing exposed anymore — config, logs, and the admin interface are no longer reachable directly through the browser