Tyrnarok
A secure-by-default PHP framework for people who are not security experts. It runs on any shared host with PHP 8 and FTP, with no build steps and no database server to provision. On the first request it forges its own database, seeds an admin account, hardens the session and raises the wards: CSRF on every POST, brute-force limiters on every login, optional two-factor, and a self-test that maps the weaknesses before an attacker can.