Official Production Distribution

Download Encrypt CMS

Get the authoritative release package of Encrypt CMS. Completely decoupled from proprietary cloud services and ready for immediate deployment on any standard PHP 8.2+ environment.

Encrypt CMS v1.3.6

Published on November 14, 2026 • Archive package: Encrypt-CMS-v1.3.6.zip

Package size: 671 KB (671,187 bytes) • Native Core Architecture • 100% License-Free Core

Download ZIP Package

Cryptographic Integrity Verification (SHA-256) View authoritative hash signature →

4ba400fdbe6b1cfcc3d88b7c67a0ac6a5cda5e168f096583796774552c15b587

Verifying Package Integrity

We strongly advise calculating the SHA-256 checksum locally prior to server extraction to guarantee authenticity:

# Linux / macOS (bash) sha256sum Encrypt-CMS-v1.3.6.zip

# Windows (PowerShell) Get-FileHash Encrypt-CMS-v1.3.6.zip -Algorithm SHA256

Runtime & Hosting Requirements

PHP Runtime

• PHP 8.2.0 or higher (8.2 / 8.3)
• memory_limit = 128M minimum
• upload_max_filesize = 32M
• Zero production Node.js needed

Database Engine

• MySQL 5.7+ / MariaDB 10.4+ (InnoDB, utf8mb4)
• InnoDB storage engine
• utf8mb4 character set
• Strict prepared statements (PDO)

Required Extensions

• pdo, pdo_mysql, curl
• mbstring, json, fileinfo
• openssl, zip, gd
• Apache mod_rewrite or Nginx

Release Summary — v1.3.6

Full changelog history →

Extension Updater Authorization Fix, HTTP 403 Resolution & Packaging

Resolves commercial extension update authorization by aligning the updater with the Central License Infrastructure authenticated package delivery protocol, adding granular token diagnostics and enforcing pre-extraction integrity.

Key Fixes:

Commercial Plugin & Theme Update Authorization: Aligned ExtensionUpdateService with the Central License Infrastructure authenticated package authorization workflow (POST /api/v1/packages/{slug}/download).
Resolved HTTP 403 Forbidden when updating commercial ecosystem extensions (such as encrypt-stackcache from v1.0.4 to v1.0.5).
Installation-Token Bearer Authentication: Enforced Bearer tokens and domain binding validation for single-use signed download tokens.
Enhanced Download Error Diagnostics: Granular handling for token lifecycle states (DOWNLOAD_TOKEN_EXPIRED, DOWNLOAD_TOKEN_ALREADY_USED, NOT_ENTITLED) without credential leakage.

Security Hardening:

Strict Decoupling: Core CMS updates remain strictly managed by CoreUpdateService and decoupled from commercial licensing.
Pre-Extraction SHA-256 Validation: Downloaded archives are verified against the authoritative 64-character checksum before directory replacement.
Zip Slip Defenses: Archive member path normalization prevents directory traversal sequences, with atomic pre-update backup and automatic rollback.

Quick 3-Step Guided Installation

Step 1

Extract Encrypt-CMS-v1.3.6.zip to your web server document root (e.g. public_html).

Step 2

Navigate to /install in your web browser to launch the automated requirements and migration wizard.

Step 3

Enter your database credentials, register your administrator user, and log in at /admin/login.