Weekend Wanderer — Laravel Travel Blog CMS with Affiliate Marketing & REST API

A production-ready travel blog and affiliate content platform built on Laravel 13 and PHP 8.4. One codebase gives you three surfaces: a fast public site, a full admin panel, and a token-authenticated REST API v1 that exposes every admin capability. No build step — Blade and Tailwind render server-side out of the box.

Admin Access

Panel: /admin/login
Email: admin@example.com
Password: TestPassword123!

Set ADMIN_PASSWORD in your .env before seeding a live install — the demo password is for local evaluation only.

REST API

Interactive documentation ships with the app at /api/docs (enable with API_DOCS_ENABLED=true), plus a downloadable Postman collection at /api/docs/postman.json.

40+ endpoints across public and admin groups
Laravel Sanctum bearer tokens with 24-hour expiry
Uniform {success, data, message} response envelope
Rate limited per group; paginated collections return links and meta
Health endpoint at /api/health reporting the installed version

Features

Public site

Dynamic homepage: latest, featured, popular, live stats
Article pages with reading time and auto table of contents
Category, tag and search archives
Affiliate shortcodes rendered as tracked CTA buttons
Newsletter signup and contact form
Dark mode, reading progress bar, share buttons
Google Analytics 4, toggled from settings

Admin panel

Dashboard with traffic, content and subscriber metrics
Full article CRUD with soft delete, restore, force delete
Category, tag and affiliate link management
Affiliate click tracking and reference guards
Subscriber list with CSV export
Message inbox with unread badge
Site settings, logo and favicon upload
Profile, password change, changelog viewer
Demo mode blocks all writes with one env flag

SEO Built In

XML sitemap at /sitemap.xml, excluding drafts and future posts
robots.txt referencing the sitemap
JSON-LD structured data, meta and Open Graph tags
Clean slugs, canonical URLs, semantic heading structure
Accent- and case-insensitive search that reads plain text, not raw HTML

Security Hardening

All article HTML passes an HTML Purifier allowlist — scripts, iframes, inline handlers and javascript: URIs are stripped
Changing a password revokes every other session and every API token, on both surfaces
Policy checks plus a gate short-circuit — defence in depth, not a single guard
Subscriber CSV export neutralises spreadsheet formula injection
Affiliate click IPs stored as HMAC-keyed hashes, never in the clear
SVG uploads rejected for logo and favicon
Escaped LIKE queries; zero raw SQL anywhere in the codebase

Performance

Homepage sections cached with versioned keys, invalidated on content change
Settings cached for 24 hours, failing open when the database is unreachable
Composite indexes on publish state, views, featured flag and category
Eager loading on every query that feeds a view or API resource
No asset pipeline, no Node, no compile step to deploy

Code Quality

Test suite	644 passing, 1,510 assertions
Skipped	3 — Redis-tagged cache tests, skipped automatically when no Redis server is reachable. They pass when Redis is running; the app itself does not require it.
Static analysis	Larastan level 8 — zero errors
Code style	Laravel Pint — clean

Requirements

PHP ^8.4 and Composer
MySQL 8+ or MariaDB 10.4+, database created with utf8mb4_unicode_ci
SQLite is not supported — the schema relies on MySQL generated columns and collation semantics

Laravel Travel Blog CMS with Affiliate Marketing & REST API

Overview