PHPackages                             stonedz/pff2 - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Framework](/categories/framework)
4. /
5. stonedz/pff2

ActivePff2-core[Framework](/categories/framework)

stonedz/pff2
============

A simple yet robust PHP MVC framework

v4.1.5(4mo ago)1619↓82.5%5[2 issues](https://github.com/stonedz/pff2/issues)9MITPHPPHP >=8.1CI failing

Since Oct 1Pushed 3mo ago5 watchersCompare

[ Source](https://github.com/stonedz/pff2)[ Packagist](https://packagist.org/packages/stonedz/pff2)[ Docs](https://github.com/stonedz/pff2)[ RSS](/packages/stonedz-pff2/feed)WikiDiscussions master Synced 2w ago

READMEChangelog (2)Dependencies (11)Versions (99)Used By (9)

**Pff2 MVC PHP framework**
==========================

[](#pff2-mvc-php-framework)

[![Build Status](https://camo.githubusercontent.com/668960e5955c166020fdc1de8888321f0504d8132d3aac4defb197f6e2becf1e/68747470733a2f2f6170702e7472617669732d63692e636f6d2f73746f6e65647a2f706666322e7376673f6272616e63683d6d6173746572)](https://travis-ci.org/stonedz/pff2)[![Coverage Status](https://camo.githubusercontent.com/d735b80f19cfedd79f35f7292a45cdee365424fc097b0f0143c30820528c85f6/68747470733a2f2f696d672e736869656c64732e696f2f636f766572616c6c732f73746f6e65647a2f706666322e737667)](https://coveralls.io/r/stonedz/pff2?branch=master)[![Latest Stable Version](https://camo.githubusercontent.com/8336e166aa0037df32444c113b7a5d28d2112fcdcbadeb4c12be6c59e8e79971/68747470733a2f2f706f7365722e707567782e6f72672f73746f6e65647a2f706666322f762f737461626c652e737667)](https://packagist.org/packages/stonedz/pff2)[![License](https://camo.githubusercontent.com/497a056e2f8413f7303565603d4483a9462d1f57c90bdf10626ae6c3e23d4f79/68747470733a2f2f706f7365722e707567782e6f72672f73746f6e65647a2f706666322f6c6963656e73652e737667)](https://packagist.org/packages/stonedz/pff2)

Pff2 is a lightweight MVC framework for PHP 8.1+.

Quick start (Composer)
----------------------

[](#quick-start-composer)

1. Create a new project directory and add `stonedz/pff2` to `composer.json`.
2. Install dependencies:

```
composer install
```

3. Scaffold app files:

```
vendor/bin/init
```

4. Your project entry point is generated from `resources/site_skeleton/index.php`.

Generated development files include:

- `development/compose.yaml`
- `development/nginx.conf`
- `development/PHP.Dockerfile`

Quick start (Docker)
--------------------

[](#quick-start-docker)

The canonical development compose file is:

`development/compose.yaml`

Run:

```
docker compose -f development/compose.yaml up --build
```

Default service endpoints from this setup:

- Web: `http://localhost:8081`
- Mailcatcher UI: `http://localhost:1080`
- MariaDB: `localhost:33061`

Installation notes
------------------

[](#installation-notes)

- Composer install no longer auto-creates app symlinks; run `vendor/bin/init` explicitly.
- `vendor/bin/update` refreshes framework-controlled generated files (for existing projects), including Docker dev files in `development/`.
- Generated writable folders now default to `775` permissions (instead of `777`).
- `vendor/bin/init` and `vendor/bin/update` skip optional copies when source files are not present, avoiding noisy `cp: cannot stat` errors.

Security defaults
-----------------

[](#security-defaults)

Pff2 now uses safer defaults in the app skeleton:

- Exception details are configurable via `show_exception_details` and should be disabled in production.
- Session/cookie hardening options are available in `app/config/config.user.php`:
    - `security_cookie_httponly`
    - `security_cookie_samesite`
    - `security_cookie_secure`
    - `security_session_strict_mode`
- Auth module default hashing is `password_hash` / `password_verify` (legacy `md5`/`sha256` remain deprecated compatibility paths).

Upgrade notes
-------------

[](#upgrade-notes)

- Mail module has migrated from SwiftMailer to Symfony Mailer.
    - `swiftmailer/swiftmailer` is removed from dependencies.
    - Existing `mail/module.conf.yaml` keys (`Type`, `Host`, `Port`, `Username`, `Password`, `Encryption`) continue to work.
    - `sendMail(...)` API remains available and returns `true` on success, `false` on transport failure.
- If your app still uses auth `passwordType: md5` or `sha256`, plan migration to `password_hash`.

Notes on templates
------------------

[](#notes-on-templates)

PHP views are the recommended template path for new apps. Smarty templates are considered legacy/best-effort support.

Documentation
-------------

[](#documentation)

- [Installation guide](docs/install.md)
- [Smoke app guide](docs/smoke-app.md)
- [Security baseline](docs/security.md)
- [Architecture overview](docs/architecture.md)
- [Upgrade guide](docs/upgrade-4.x.md)

**Additional details:** [Wiki](https://github.com/stonedz/pff2/wiki)

###  Health Score

50

—

FairBetter than 95% of packages

Maintenance59

Moderate activity, may be stable

Popularity18

Limited adoption so far

Community22

Small or concentrated contributor base

Maturity88

Battle-tested with a long release history

 Bus Factor1

Top contributor holds 99.6% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~43 days

Recently: every ~3 days

Total

97

Last Release

111d ago

Major Versions

v1.0.0-beta7 → v2.0.0-beta82014-10-14

v2.7.1 → v3.0.02024-05-03

v3.0.2 → v4.12026-02-17

PHP version history (4 changes)v2.0.0-alphaPHP >=5.3.2

v2.0.9PHP >=5.4

v2.3.12PHP >=5.5

v3.0.0PHP >=8.1

### Community

Maintainers

![](https://www.gravatar.com/avatar/b25781e23d83f6dc0a4fac1dc29ec623c2ad0996976c0d869b1bd85022651e11?d=identicon)[stonedz](/maintainers/stonedz)

---

Top Contributors

[![stonedz](https://avatars.githubusercontent.com/u/13465?v=4)](https://github.com/stonedz "stonedz (272 commits)")[![dseguy](https://avatars.githubusercontent.com/u/170418?v=4)](https://github.com/dseguy "dseguy (1 commits)")

---

Tags

framework

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan, Rector

Type Coverage Yes

### Embed Badge

![Health badge](/badges/stonedz-pff2/health.svg)

```
[![Health](https://phpackages.com/badges/stonedz-pff2/health.svg)](https://phpackages.com/packages/stonedz-pff2)
```

###  Alternatives

[laravel/framework

The Laravel Framework.

34.8k532.1M19.4k](/packages/laravel-framework)[shopware/platform

The Shopware e-commerce core

3.4k1.5M3](/packages/shopware-platform)[prestashop/prestashop

PrestaShop is an Open Source e-commerce platform, committed to providing the best shopping cart experience for both merchants and customers.

9.1k16.8k](/packages/prestashop-prestashop)[shopware/core

Shopware platform is the core for all Shopware ecommerce products.

585.4M514](/packages/shopware-core)[drupal/core

Drupal is an open source content management platform powering millions of websites and applications.

19564.8M1.6k](/packages/drupal-core)[sulu/sulu

Core framework that implements the functionality of the Sulu content management system

1.3k1.4M196](/packages/sulu-sulu)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)