# Free Live Stream Football — PHP

Independent, responsive football streaming-directory template inspired by the supplied screenshots.
It does NOT copy NFHS Network branding/assets.

## Files
- index.php — public responsive landing page
- admin.php — password-protected event + smartlink manager
- sync.php — optional importer that attempts to read public structured event data
- data/events.json — all games
- data/config.json — site settings and smartlinks
- assets/style.css / app.js — UI

## Setup
1. Upload the folder to PHP 8+ hosting.
2. Make `data/` writable by PHP if your host requires it.
3. Open `admin.php`.
4. Change `$adminPass` near the top of admin.php.
5. Enter your smartlinks for Watch / Subscribe / Login / Banner.
6. Add/edit/delete games.
7. For schedule importing, run `sync.php` or use the "Run Schedule Sync" link in admin.php.
   The public page can be JavaScript-driven, so the importer may return no events. If that happens,
   keep using the admin JSON or adapt sync.php to the source's current API/HTML structure.

## Important
The reference site is dynamic and may change its markup. The template therefore uses a local JSON
data layer so the site keeps working even if the source changes. Use only schedule/event information
you are permitted to republish and do not imply affiliation with NFHS Network.

## Facebook / WhatsApp / Telegram Link Preview
`images/social-preview.jpg` is a 1200x630 Open Graph image. Replace it with your own JPG
using the same filename if desired. OG title and description can be edited from admin.php.
Facebook can cache an older preview; refresh the shared URL in Facebook's sharing/debugger
tools after changing the image or metadata.

## Banner ad script
Open `admin.php` → Site & Smartlinks → **Banner ad code (HTML/JavaScript)**.
Paste the complete code supplied by your ad network, including its `<script>` tags.
For example, a 320×50 iframe banner script can be pasted there directly.
The older **Banner smartlink** field is still available as a simple URL fallback.

## Direct Thumbnail Upload
In Admin → Add/Edit Game, use **Upload Thumbnail** to select a JPG, PNG, or WebP
directly from your phone or computer. The uploaded file is stored in `images/uploads/`
and is used automatically by the game. The optional Thumbnail URL remains available.
Maximum upload size: 8 MB.


## Latest updates
- Live, Upcoming and On Demand are independent status tabs with counts.
- Admin has an explicit Add New Game button and Save & Add Another.
- Each game can use its own Watch URL; the global Watch smartlink remains the fallback.
- A game can be marked Featured and also marked as the Facebook/Open Graph preview event.
- When a Social Featured event has a thumbnail, its thumbnail is used as og:image/twitter:image.
- If the Social Featured event is Upcoming, it is preferred for the social preview.

## Automatic Game Status
Add a Start Time (UTC) and End Time (UTC) in Admin. When both are present, the public site automatically calculates:
- Before Start = Upcoming
- Start through End = Live
- After End = On Demand / Replay
Live games are automatically treated as Featured on the public site. The page reloads at the next schedule transition, so no manual status change is required. Overnight games are supported when End Date is left empty and the end time is earlier than the start time.


## Security Hardened
- Direct browser access to `data/` is blocked on Apache via `.htaccess`.
- Admin login uses a password hash, secure session cookies, CSRF protection, login throttling, and session ID rotation.
- Delete and schedule-sync actions require authenticated POST requests plus CSRF tokens.
- Uploaded thumbnails are MIME/image validated, randomized, limited to 8 MB, and the upload directory blocks script execution on Apache.
- Public URLs are restricted to HTTP(S) or the local images directory before being rendered as links/images.
- JSON writes use file locking to reduce corruption during simultaneous requests.
- Security response headers are enabled.

### New Admin Password
The ZIP includes a generated admin password. Change it before public deployment if you prefer a password of your own.
**Initial password:** `d3Sp8FrEkIFEiV3vcd5JlBgy`

For Apache, keep the included `.htaccess` files. If your host uses Nginx, configure equivalent deny rules for `/data/` and script execution in `/images/uploads/` because Nginx does not read `.htaccess`.

## Admin Security
Use Admin → Security to change the password. Passwords are stored as password hashes. Changing the password invalidates all existing admin sessions. You can also use Logout All Sessions to immediately invalidate every active admin session.
