A web engine built
like an operating system

BeamReactor is not an assembly of scripts. It is a system built around a centralised kernel — the XDP engine — inspired by the internal structure of an operating system.

Every HTTP request enters through a single point. The kernel handles routing, security enforcement, session management, plugin loading and output rendering. No PHP script can execute without passing through it. This is not a convention — it is a structural impossibility enforced by the architecture itself.

This centralisation guarantees uniform application of security protocols across the entire system, from user authentication to the final rendered page. Plugins cannot bypass sanitization, cannot issue raw SQL, and cannot terminate execution (exit / die are structurally forbidden). The kernel always retains control for proper session closure and coherent error handling.

Every feature in BeamReactor lives as an autonomous plugin. The core routes, secures and orchestrates — nothing more. This means the attack surface of any given installation is exactly proportional to what you activate. An inactive plugin is zero lines of exposed code.

When a plugin is called, the engine automatically handles configuration loading, library injection, locale selection based on the user's language, and route registration. Multiple plugins coexist on the same page without collision — each operates in its own namespace with its own CSS and JavaScript resources.

Each plugin carries its own documentation (/doc/), its own test suite (/tests/), its own moderation cartography for GDPR compliance (.moderation.json), and its own sitemap declaration (.sitemap.json) for the search engine. Install is a folder drop. Removal is a folder delete.

Security in BeamReactor is not a layer bolted on top. It is the architecture itself. Every piece of data entering or leaving the system passes through Sanitizer\Parser, which validates against strict types: primitives (bool, int, float, string with length constraints), structured types (email, URL, UUID, IP, date, JSON), rich types (HTML with tag whitelists, Markdown, prepared-statement-only SQL), and business types (files with MIME/size/extension validation, images, tokens).

Database interactions use exclusively prepared statements. Direct parameter concatenation is structurally impossible through the SQL abstraction layer (BDAL). The system detects and prevents SQL injection, XSS, string overflow attacks, shell command injection, path traversal and NaN/Infinity manipulation.

Sessions are protected by permanent IP tracking, User-Agent fingerprinting, adaptive request rate limiting, and time-bounded expiration. Authentication uses Argon2id server-side and PBKDF2 client-side with per-user salting, 2FA, and single-use anti-CSRF tokens. Active honeypots — hidden form fields, trap URLs, request timing analysis — identify and quarantine attackers before they reach your data.

BeamReactor manages privilege levels dynamically. The defaults are defined in configuration, but can be overridden at runtime from the database or from an include — based on server load, threat level, or plugin performance.

Under heavy load, resource-intensive plugins are automatically restricted to higher-privilege users. Under attack, the system can lock down to admin-only access without redeployment. A plugin that exceeds one second of generation time is automatically quarantined — disabled for regular users while administrators retain access for diagnosis.

This is application-level load balancing based on the privilege hierarchy. The system measures generation time per plugin, evaluates current load against connection count and capacity, decides whether to restrict access, and preserves admin access for diagnostics. No human intervention required. A buggy or attacked plugin does not bring down the site — it isolates itself.

BeamReactor was built on a simple principle: user data belongs to the user. Minimal collection, encrypted sensitive data, no third-party tracking, real deletion (not a soft flag), and full data export. These principles were in place since 2003 — twelve years before the GDPR was drafted.

Each plugin includes a .moderation.json file that maps exactly which user data it stores and how that data should be handled during anonymisation, erasure, or complaint processing. When a GDPR request is made, the engine walks through every installed plugin's moderation cartography and executes the appropriate action — anonymise, delete, or export — without manual intervention per plugin.

Similarly, each plugin declares a .sitemap.json that maps its public-facing content for the internal search engine and sitemap generator. This ensures that content indexing is always accurate, always up to date, and always under the control of the plugin author rather than a fragile global crawler.

Even the document formats are engineered for performance. The .dta and .err formats are zero-parse, zero-DB, zero-function-at-runtime: one directive per line, key-value separated by whitespace, loaded once at bootstrap into pure PHP constants cached by opcache. Parsing takes under 0.01µs. A full error page weighs under 2KB.

The WYSIWYG editor, the multilingual system, the analytics engine, the bot catalogue — none of these depend on external services. No Google Analytics, no CDN dependency, no external scripts phoning home. Everything runs on your server, under your control.

BeamReactor has been designed, developed and maintained by the same architect since 2003. There have been no handovers, no rewrites, no committee decisions. Every line of code follows the same security-first, performance-first philosophy that was set on day one.

The result is architectural consistency that no community-driven CMS can match. The code is 100% auditable. The security record is public: zero known CVEs in 22 years. The system runs with zero third-party dependencies — no Composer, no Node, no build step. Upload via FTP, configure, run.

Popular CMS platforms are massive targets. A vulnerability discovered in WordPress affects millions of sites simultaneously. BeamReactor's unique architecture and confidential install base make it structurally uninteresting to automated attackers — security through architectural originality, complementing real technical security.