Custom Content Management System

The website does not run on WordPress. It uses a custom PHP and MySQL content management system designed around the features I actually use. Pages, publications, media, menus, SEO settings, comments, users, redirects, banners, translations, AI tools, payments, and security controls are managed from one administrative interface.

Building the CMS myself also means I know where the code is, what it does, and why it exists. If something breaks, I do not have to determine whether the problem came from WordPress, a theme, Plugin Number 37, or Plugin Number 37's emergency compatibility plugin.

Pages and Publications

The CMS supports traditional website pages and long-form publications. Articles can have categories, subcategories, tags, featured images, custom URLs, excerpts, SEO metadata, scheduled publishing, banners, comments, translations, and paid-content controls.

Publications use clean hierarchical URLs and can be organized by topic without forcing every piece of content into the same structure. Editors can also open the live page directly after publishing, which saves the traditional ritual of opening three browser tabs and trying to remember which one contains the public version.

Quick Posts

The separate Posts section is designed for shorter thoughts, links, news, technical notes, and ideas that do not need to become a full article. Posts can contain up to 500 words and support photographs, clickable links, hashtags, shared-link cards, YouTube videos, timestamps, search, and scheduled publishing.

Think of it as my own small social feed without needing to argue with an algorithm about whether anyone is allowed to see what I posted.

Stripe Paid Content

Individual pages, publications, and quick posts can be placed behind a Stripe paywall. Each item can have its own price, and I can decide exactly where the free portion ends by inserting a Paywall Break inside the content.

Visitors see the introduction or selected preview first. If they want to continue reading, they can unlock the rest with a one-time Stripe payment. When I am signed into the CMS as an administrator, the full content remains visible to me without requiring me to pay myself, which would be a strangely inefficient business model.

Search-Friendly Paid Articles

Paid articles can remain eligible for search-engine indexing while the restricted section is visually protected for ordinary visitors. Structured data identifies the paid portion of the page, allowing search engines to understand that the article contains premium content rather than interpreting the restriction as accidental hidden text.

Individual content can still be marked noindex and nofollow when I specifically do not want it appearing in search results.

SEO Center

The SEO Center provides tools for managing titles, descriptions, keywords, canonical URLs, indexing preferences, sitemap generation, redirects, translated URLs, and other search-related settings. Pages and publications can be individually excluded from search engines when necessary.

The CMS automatically generates and updates an XML sitemap containing eligible public content. Publications, pages, categories, translations, quick posts, and supported standalone public applications can be discovered and incorporated without manually editing an XML file every time something changes.

Inbound Links and Traffic Analysis

The SEO Center records external referring URLs that actually send visitors to the website. This makes it possible to see which domains are linking to the site, which pages visitors are reaching, and how frequently those referrals occur.

Specific IP addresses, network ranges, and referring domains can also be excluded from analytics. This is useful for filtering bots, monitoring systems, server traffic, and other visitors that may be technically real but are not particularly useful when trying to understand actual human traffic.

OpenAI and AI-Assisted Publishing

Artificial intelligence is integrated directly into the CMS rather than existing as a separate copy-and-paste tool. AI can assist with writing, content improvement, SEO analysis, metadata, document processing, translation, and other publishing tasks.

Longer AI operations use resumable processing so a large translation or SEO job does not have to complete inside one enormous web request. The objective is to make AI part of the application workflow instead of treating it like a chatbot sitting beside the CMS.

Multilingual Publishing

The site supports English, Russian, Chinese, and Arabic content with dedicated language URLs. Pages, publications, categories, and other supported content can have translated versions while preserving the site's URL structure, SEO metadata, and language relationships.

The translation workflow can use AI assistance, and internal content markers such as reusable banner tags and paywall markers are preserved so translating an article does not accidentally translate the application logic along with it.

Reusable Content Banners

The CMS includes reusable banner variations that can be inserted into pages and publications using simple tags such as {*banner1*} or {*banner2*}. Banner content can be managed centrally without manually copying the same HTML into multiple articles.

This makes it easy to change a promotional message, announcement, or call to action in one place instead of hunting through dozens of old posts trying to remember where I pasted it six months ago.

Media and Featured Images

Images uploaded through the CMS are validated and processed before being used by the site. Publication featured images use a square format so the full artwork can remain visible instead of being aggressively center-cropped into a shape it was never designed for.

The CMS can also rename media files for cleaner URLs and update content references when a managed media filename changes.

Paid Comments

Publications and quick posts can accept comments through Stripe-powered payment workflows. Quick-post comments use their own separate one-dollar category, while publication comments can use their independently configured pricing.

A successful payment does not automatically throw the comment onto the public website. Paid comments still enter moderation first, because charging someone a dollar does not automatically make everything they typed a good idea.

Paid Contact Form

The contact system uses Stripe before an inquiry is considered delivered. Visitors can submit their information and message, but they are informed that the inquiry remains locked until payment is confirmed.

Internally, pending inquiries can still be reviewed from the administration panel. This allows me to see what someone attempted to send without changing the public rule that the inquiry is not considered delivered until Stripe confirms payment.

Security Center

The CMS includes a dedicated Security Center that records suspicious activity, authentication failures, blocked requests, administrative actions, WordPress probes, Stripe webhook problems, and other security-related events. Logs can include the source IP, requested path, user agent, authenticated administrator, severity, timestamp, and repeated hit counts.

Sensitive information such as passwords, cookies, authorization headers, API keys, Stripe secrets, and CSRF tokens is deliberately excluded or redacted. A security log should help investigate an attacker, not provide him with a neatly indexed collection of everything he was trying to steal.

IP and Network Blocking

Individual IPv4 and IPv6 addresses can be blocked, and CIDR ranges can be restricted when necessary. The system can enforce blocks inside the CMS and can also generate Apache-level rules for denying requests earlier in the request lifecycle.

Blocked visitors receive a custom security page rather than useful details about which rule they triggered. If someone is scanning the website looking for vulnerabilities, I do not feel obligated to provide complimentary technical support explaining exactly how I noticed them.

WordPress Honeypot

AlexanderMirvis.com does not run WordPress, but automated scanners have not received the memo. Requests for common WordPress login locations can therefore be routed into a fake WordPress login screen designed specifically as a honeypot.

The honeypot records useful information about the attempt while intentionally refusing to store the password entered by the visitor. Someone can spend as much time as they want attempting to log into WordPress. There is just one small problem: there is no WordPress installation behind the login screen.

It is essentially a digital door painted onto a brick wall.

Protected Configuration and Secret Files

The server configuration rejects requests for environment files, source-control directories, database dumps, backups, configuration files, hidden files, temporary files, and other resources that should never be publicly downloadable.

Automated scanners still request things such as /.env, /.git/config, /backup.sql, and similar paths every day. They are welcome to continue. It gives the security logs something to do.

Secure Administrative Sessions

Administrative authentication uses stronger password requirements, modern password hashing where supported, session regeneration, secure cookie settings, login throttling, inactivity limits, absolute session expiration, CSRF protection, and server-side authorization checks.

Sensitive administrative functions are not protected merely by hiding buttons. The server verifies permissions independently because removing a button with CSS is generally considered a poor substitute for access control.

Upload Security

Uploaded files are inspected rather than blindly trusting the filename or MIME type supplied by the browser. Images can be decoded and re-encoded into fresh WebP files, executable extensions are rejected, and upload directories are configured so files cannot unexpectedly become executable PHP.

In other words, uploading a file called totally-a-photo.php does not automatically convince the server that it came from a camera.

Security Headers and Server Hardening

The site uses HTTP security headers for HTTPS enforcement, content-type protection, framing restrictions, referrer behavior, permissions, and Content Security Policy controls. Directory listings are disabled, internal application directories are protected, and unnecessary public access to source files is restricted.

None of these controls makes the website magically invincible. The idea is defense in depth: multiple layers that make a successful mistake in one area less likely to become a successful compromise of everything else.

Custom 404 and Blocked-Access Pages

Error pages are part of the website rather than generic server screens. The 404 page uses a lightweight animated black-hole design, while blocked visitors receive a separate branded security page.

If a page disappears into the event horizon, at least the error message looks intentional.

Moving Stars, Shooting Stars, Sun and Moon

The public website includes a lightweight animated sky running behind the interface. Stars move slowly, shooting stars appear at randomized intervals, and the sun and moon follow a 24-hour cycle based on the visitor's local browser time.

The moon also changes its visible phase according to the lunar cycle, including crescent, quarter, gibbous, full, and new moon states. A small local-sky display can show the current time and lunar illumination without requesting the visitor's location.

Interactive Solar System

The homepage includes an animated solar system that can be repositioned using a mouse on desktop or a finger on mobile. Planetary orbits continue independently while the overall system is manipulated.

Mobile displays a simplified four-planet version to keep the animation cleaner and faster on smaller screens. The sun or moon can travel above the solar system depending on the visitor's local time.

Built for the Website Instead of Around It

The biggest feature is that the system is purpose-built. I can add functionality directly to the application rather than adapting the entire website around the limitations of a third-party CMS. Publishing, security, payments, AI, SEO, automation, and visual features all operate as parts of the same system.

Is building an entire CMS for one website slightly excessive? Probably. But at this point the website has lunar phases, Stripe paywalls, a WordPress honeypot, an interactive solar system, and its own security center, so I think that ship has already sailed.