Monate Media
Part three · Open source · PHP 8.4 · MIT

A WordPress killer, with personality.

Fast static websites that clients edit from their phone, on plain shared hosting. No plugins to patch, no database behind the public pages, no Node.js on the server, and every change saved as a Git commit you can undo.

Part one taught how to wire components. Part two taught what the components should be. Slim Killer puts both to work in a real product that ships to real clients.

Roadmap2 of 10 done · 20%
Early days, built in the open.
View on GitHub How it works What is proved
~1 sto commit a client's save to GitHub from shared hosting
2–3 sto fetch, unpack and switch a real 30 MB, 217-file client site
0plugins, databases or PHP between a visitor and the page
40automated tests, and 9 host checks in hammer doctor

The one question

Every design decision in Slim Killer comes back to it.

“Does this website need a server at all?”
For visitors: no Every public page is a plain file, built ahead of time by Astro. There is nothing to inject into, nothing to patch at midnight, and nothing that slows down under traffic.
For editors: a small one A PHP control panel at /cp on the client's own domain. It saves every change as a Git commit, so nothing is ever lost and any mistake can be undone.

How it works

Four steps between a tap on a phone and a faster website. The host only ever needs PHP.

  1. Edit anywhere

    The client opens /cp on any phone or laptop, changes a page or adds photos, and taps Save.

  2. One commit

    The control panel writes the page and its photos to the site's GitHub repository in a single commit.

  3. GitHub builds

    GitHub Actions builds the Astro site into plain files. No Node.js on the host, ever.

  4. The host fetches

    Cron collects the finished build and switches the site to it in one step. The old one stays, for instant rollback.

Why not just WordPress?

WordPress powers a huge share of the web for good reasons. For a small business site that changes a few times a month, it does a lot of work nobody asked for.

A typical WordPress siteSlim Killer
Each page viewPHP and a database run, unless a caching plugin steps inA plain file is sent. That's it.
Adding featuresPlugins from many authors, each with its own updates and risksModules written in code, in one repository, behind tests
What attackers seeA login page at a well-known address, plus every plugin's endpointsStatic files, and a small control panel (two-factor login planned)
UndoRestore a backup, if there is oneEvery save is a Git commit; every release is kept
HostingAny PHP hostAny PHP host. hammer doctor checks it
Where WordPress still wins: when the site owner wants to install features themselves from a marketplace. Slim Killer is for sites built and looked after by a developer, where speed, safety and a calm Tuesday night matter more.

Twelve rules, in two parts

Slim Killer is built by the rules of the two courses before it. Rule 7 is the gate: it decides where rules 8 to 12 are worth their weight.

Part one: wiring

From PHP 8.5 OOP Mastery. Always applies.

  1. 1Config and the container belong at the entry point
  2. 2Test behaviours, not layouts
  3. 3The type system is a security layer
  4. 4Favour composition over inheritance
  5. 5Objects either hold state or perform work, rarely both
  6. 6Read the failing test before reading the code

Part two: modelling

From Advanced Domain Architecture. Only where it pays.

  1. 7Ceremony must be paid for
  2. 8The dependency rule points inward
  3. 9Make illegal states unrepresentable
  4. 10The aggregate is a consistency boundary, and it is smaller than you think
  5. 11Speak the client's words, exactly
  6. 12A failure the business can predict is not exceptional
Content editing stays simple: schema in, file out. The deploy pipeline and the shop get the full treatment, because that's where a mistake loses a client's work or money. The reasoning is in BUILD_PHILOSOPHY.md.

What is proved, rather than promised

Before a line of product code, two spikes ran on a real, entry-level shared hosting plan. These are their own words.

Spike S1: shared hosting can save to GitHub, and refuses to overwrite 
blob: markdown         HTTP 201 in 299 ms
blob: image            HTTP 201 in 289 ms
commit                 HTTP 201 in 353 ms
move branch            HTTP 200 in 622 ms     # one save, one commit, one build
move branch (stale)    HTTP 422, GitHub says: Update is not a fast forward
S1 PASSES on this host (litespeed) in 8.0 s.
Spike S2: fetch a real client build, switch to it, roll back 
zip size                 30.3 MB
files                    217
time                     142 ms                 # to unpack
GET /about/              HTTP 200
GET /_site/ directly     HTTP 403                # old builds stay private
S2 PASSES (cli, PHP 8.4.27) in 2.7 s, peak memory 12.0 MB.
What the spikes found became hammer doctor: it checks the command line's PHP and the website's (on shared hosting they are often different versions), finds the right PHP binary for cron, and proves rewrites work by asking the web server itself.

The roadmap

Read straight from the README, so it is never out of date. Early days, built in the open.

  1. Spikes S1 and S2: shared hosting can commit to GitHub, fetch and switch builds, and run cron
  2. Host checker: hammer doctor
  3. Spikes S3 to S5: export Astro's Zod schemas; editor round trip; time from save to live
  4. Control panel skeleton: Slim, Twig, SQLite migrations, login with two-factor, install, the setup page
  5. One collection end to end on a pilot client site
  6. All collections, including nested lists and single pages
  7. Releases and recovery: panel self-update, rollbacks, backups with a test restore
  8. Pilot client migration, including the move to Astro 7
  9. fleet:test across client sites
  10. Edge Storefront (Yoco checkout, stock)

Getting started

You need PHP 8.4 and Composer. Today Slim Killer can check a host; the control panel is next.

  1. Clone it

    git clone https://github.com/monatemedia/slim-killer.git
cd slim-killer

  2. Install the dependencies

    composer install

  3. Ask the doctor

    Every line is PASS, WARN, FAIL or INFO, with a hint for anything to fix.

    php hammer doctor

  4. Check a real host

    On shared hosting, include the website too. The installation guide walks through it.

    php hammer doctor --url=https://example.com --webroot=~/domains/example.com/public_html

For WordPress and Laravel developers

Frameworks are brilliant at hiding the hard parts. That's their job. These three projects are about the hard parts themselves: wiring a container by hand, testing behaviour instead of layout, modelling rules that cannot be broken, and knowing when all of that is overkill. The things most framework tutorials leave out, taught in plain PHP and then put to work.

Part one · course

PHP 8.5 OOP Mastery

SOLID, dependency injection, reflection, containers, TDD and object lifecycle. Thirty lessons, CLI-first, free.

Start here
Part two · course

Advanced Domain Architecture

Aggregates, invariants, repositories and typed failures, and first, how to tell when none of it is worth the ceremony.

Then this
Part three · product

Slim Killer

Both courses, put to work in software that real clients rely on. Read the code to see every rule applied.

Read the code