A spa and salon site with a real booking system, on your own server.

Salon SPA Script is a complete website and admin panel for massage studios, spas, beauty salons and wellness retreats. Services with prices and durations, therapists with photo galleries, a booking flow, retreats, a news section and a product page — plus an admin panel to run all of it.

Plain PHP 8. No framework, no build step, no npm, no license key. Upload the folder, open the installer, and it runs.

Install it in one pass, with or without MySQL

The browser installer checks the server, sets up the database, loads the demo content and creates your administrator account. No SSH, no editing PHP files.

• SQLite — nothing to set up. Everything lives in one file. Right for a single salon on ordinary shared hosting.
• MySQL / MariaDB — use the database your host already gave you.

You pick at install time; the rest of the script does not care which you chose. Both schemas ship separately and are maintained in step, so you get the same 19 tables either way.

Once installed, the installer locks itself. Re-running it against a live site would destroy data, so it refuses until you deliberately remove the config file.

Public site

• Home page with editable content blocks — no code needed to change the front page
• Services with categories, durations, prices and their own pages
• Therapists with photo galleries, specialities and a location
• Booking flow with available time slots
• News section with its own editor, published per language
• Retreats with dated sessions and capacity
• Guest reviews with a moderation queue
• Products page
• Two studio locations, with map links built from the address
• About, contacts, privacy policy and cookie policy pages
• GDPR cookie consent banner

Admin panel

• Dashboard
• Bookings — confirm, reschedule, cancel, filter by status or studio
• Clients — notes, ban, history
• Services and categories
• Therapists and their photo galleries
• Home page blocks
• News editor, with a tab per language
• Gallery with drag-to-reorder upload
• Newsletters to your client list
• Settings — tabbed sections, described below

Take payment online

Stripe and PayPal are both built in, in test mode or live, and switched on per gateway. After a guest books, they are offered the gateways you enabled; every attempt is recorded whether or not they finish.

Whether the money arrived is decided on your server, never in the guest's browser. Stripe is believed only through a webhook whose signature is verified against your signing secret, with a five-minute freshness window; PayPal only after your server has called capture and been told the order is complete. A guest who reloads the "thank you" page cannot mark anything as paid.

Chat widget, with an optional AI assistant

A chat bubble with your greeting, phone, email and a booking link — no third-party account needed. Prefer Tawk.to, Crisp or Intercom? Paste their embed code instead and the built-in widget stands aside.

Switch on the assistant and the widget answers questions too. Choose OpenAI, Anthropic or xAI, enter your own API key, and requests go from your server straight to that provider on your account. The assistant is given your salon's real services, durations and prices so it does not invent treatments, and the endpoint is rate limited per address so nobody can run up your bill. Off until you turn it on.

Every key lives in the admin panel

Nothing secret sits in a PHP file. API keys, SEO fields, notification targets and feature switches are all stored in the database and edited in Settings, across tabbed sections: Site, SEO, Payments, Chat, AI assistant, Notifications and Security.

Saved secrets are never printed back into the page. The field shows that a key is stored and stays blank — so a screenshot, a shared screen or a page source never reveals it.

Security, on by default

• Security headers on every response — X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, and X-Powered-By stripped
• HSTS added automatically when the site runs over HTTPS, and only then
• Content-Security-Policy shipped in report-only mode, with a switch to enforce it once you have read the reports
• Session cookies set HttpOnly, SameSite=Lax, and Secure on HTTPS; session ids accepted from cookies only
• CSRF tokens on every form that changes anything
• Admin login throttled — eight failed attempts from an address and it closes for fifteen minutes
• Prepared statements everywhere; the settings form only accepts keys the script defines
• Passwords stored with password_hash(), never anything reversible
• No administrator account is seeded. A shipped password hash would be identical in every copy of the script, so the installer asks you to create the first account instead

Four languages

English, Lithuanian, Russian and Ukrainian on the public site, each with its own URL prefix and hreflang. Page content is translated per language in the database; interface strings are plain PHP arrays in lang/ — copy one file to add your own. A string you have not translated yet falls back to your main language rather than showing a raw key. The admin panel itself is in Russian.

SEO

• Schema.org JSON-LD for the business, its services and its people
• hreflang across all four languages, canonical URLs, a generated sitemap.xml including news articles, and robots.txt
• Per-page titles and descriptions, with site-wide defaults in Settings

Tech

• PHP 8.0+, no framework — a small custom router, readable throughout
• SQLite or MySQL through PDO, prepared statements everywhere
• Plain CSS and JavaScript — nothing to compile
• No Composer packages at runtime; the payment and AI integrations talk to the REST APIs directly, through cURL or the stream wrapper if cURL is missing
• Apache .htaccess included

What you get

• Full source, unencrypted, no callbacks to any licence server
• Browser installer with demo content, so the site is not blank on the first visit
• Demo services, therapists, retreats, products, news articles and photos

Requirements

PHP 8.0 or newer with PDO and mbstring. SQLite needs nothing else. For MySQL you need pdo_mysql and a database. Apache with mod_rewrite, or the nginx equivalent. Writable config/, database/ and uploads/. Online payment and the AI assistant need outbound HTTPS from your server.

Third-party services

The script contacts nothing on its own. Every integration — Stripe, PayPal, the AI assistant, reCAPTCHA, Telegram notifications, a pasted chat widget — stays off until you enter your own credentials and switch it on, and then requests go straight from your server to that provider using your account. You pay those providers directly; nothing is routed through us.

Trademarks

Any product names or brands mentioned are property of their respective owners and are used for identification only. This script is independent and not affiliated with, sponsored by, or endorsed by any of them.