PortWatch Vessel Finder — Setup Guide (cPanel / Shared Hosting)
=================================================================

WHAT'S IN THIS FOLDER
----------------------
All files sit flat in one folder, no subfolders. Upload every file
into the public folder for your domain (e.g. public_html, or a
subfolder like public_html/vesselfinder if you want it at a path).

  index.php              Homepage
  signup.php             User sign up
  login.php               User sign in
  logout.php              User sign out
  vessels.php             Vessel dashboard (stats + in-port list) — login required
  vessel.php              Single vessel detail page — login required
  search.php              Search by IMO number or vessel name — login required
  admin_login.php         Admin sign in
  admin_logout.php        Admin sign out
  admin_dashboard.php     Admin overview
  admin_vessels.php       Admin: list/filter/delete vessels
  admin_vessel_form.php   Admin: add or edit a vessel
  admin_vessel_delete.php Admin: delete handler (POST only)
  config.php              Database credentials — EDIT THIS
  functions.php           Shared helpers (security, auth, DB) — do not edit
  schema.sql               Database structure + sample data
  .htaccess                Server hardening rules

SETUP STEPS
-----------
1. In cPanel, go to "MySQL Databases" and create:
     - a new database, e.g.  yourcpaneluser_vessels
     - a new database user with a strong password
     - add that user to the database with ALL PRIVILEGES

2. Open phpMyAdmin, select your new database, click "Import",
   and upload schema.sql. This creates all tables and adds:
     - one admin account  (username: admin / password: Admin@12345)
     - ten sample vessels, including HR BALU (IMO 9266114)

3. Open config.php in a text editor and fill in the four values
   cPanel gave you for the database (host is almost always
   "localhost" on shared hosting):

     DB_HOST, DB_NAME, DB_USER, DB_PASS

   Also set SITE_URL to your real domain.

4. Upload every file in this folder to your hosting account via
   File Manager or FTP — keep them all in the same folder, exactly
   as they are here.

5. Visit your domain. The homepage should load. Click "Sign up"
   to create a normal account, or go to /admin_login.php to manage
   vessel records.

6. IMPORTANT — change the default admin password immediately:
   the simplest way is to log in to phpMyAdmin, open the `admins`
   table, and update the password field to a new bcrypt hash. You
   can generate one by temporarily running this on any page:
       <?php echo password_hash('YourNewPassword123', PASSWORD_DEFAULT);
   then paste the result into the password column, and delete that
   temporary snippet.

SECURITY NOTES
---------------
- All database queries use prepared statements (PDO) — no raw SQL
  is built from user input anywhere in the app.
- Passwords are hashed with PHP's password_hash() (bcrypt); plain
  passwords are never stored.
- Every form submission is protected by a CSRF token.
- Login attempts are rate-limited: 5 wrong passwords locks the
  account for 15 minutes (applies separately to users and admins).
- Sessions use HttpOnly, SameSite cookies and are regenerated on
  login/logout to prevent session fixation.
- config.php, functions.php and schema.sql are blocked from direct
  browser access via .htaccess.
- FORCE_HTTPS in config.php redirects all traffic to HTTPS. Keep
  this on once your SSL certificate is active (most cPanel hosts
  give you a free one via AutoSSL).

GOOGLE SIGN-IN
---------------
Not included in this build, per your request — only email/password
sign up and login are implemented. If you want Google sign-in added
later, that's a separate, self-contained addition (OAuth requires a
Google Cloud project + Client ID/Secret) and won't require changing
anything else in this codebase.

EXTENDING IT
------------
- To add more vessel fields, add columns to the `vessels` table in
  phpMyAdmin, then add matching inputs in admin_vessel_form.php and
  display them in vessel.php.
- To change colors/fonts, each page has its own <style> block in the
  <head> — the CSS variables at the top of each (--navy-deep,
  --accent, etc.) control the whole palette.
