Questions before the first spark?

Luster is a modern PHP fanlisting management script. It lets you manage owned fanlistings, members, affiliates, codes, joined listings, email templates, imports, and collective features all from one admin panel. It was built for hobby site owners who want something newer and actively maintained while keeping a familiar workflow.

Luster requires:

• PHP 8.1 or later, with:
• PDO and PDO MySQL extension
• MySQL 5.7+ or MariaDB 10.3+

That's it. Everything else Luster needs comes bundled in the download.

They are both built-in PHP extensions. PDO is how PHP talks to your database safely. PDO MySQL is the same thing, but specifically wired up to talk MySQL/MariaDB.

Both have been bundled and enabled by default in PHP since version 7.x, and virtually all shared hosting providers have them switched on. If for some reason they're not, the easiest way to enable them is through your host's control panel:

• cPanel: Go to Software → Select PHP Version (sometimes called PHP Selector or MultiPHP Manager depending on your host). You'll see a list of extensions with checkboxes. Tick pdo_mysql then click Save.
• Other control panels (Plesk, DirectAdmin, etc.) have a similar PHP extensions page under their PHP settings area.
• No control panel / self-managed server: Add or uncomment this line in your php.ini and restart your web server:

  extension=pdo_mysql
  

If you can't find the option or aren't sure where to look, contact your host's support or contact me and I'll try my best to help guide you.

Security is a priority for Luster. When Luster began development (early Dec 2025), 8.1 was the latest PHP version that was still receiving security updates from the developers of PHP (as of today, it has reached end of life). Older PHP versions are even more outdated and can expose your server and members' data to known exploits. Requiring 8.1 minimum means Luster can keep you and your members as safe as possible.

Citation: PHP urges users to "upgrade to a current version, as using older versions may expose you to security vulnerabilities and bugs" (PHP.net)

Yes! As long as your host supports PHP 8.1+, MySQL or MariaDB, and the required extensions (PDO and PDO MySQL), you're good to go. Most shared hosting plans from providers like DreamHost, NearlyFreeSpeech, Hostinger, or similar will work fine. You'll also need normal file write permissions for uploaded images and generated files.

Yes! Luster is an open-source script and all of its features are completely free.

Yes! Luster's public embeds work as PHP code snippets that you can copy and paste into your existing site pages. You can also customize every component of these public embeds to match your site's layout and needs.

No, it can be used however it can meet your needs! Luster was specifically designed for collective management - whether that's fanlistings, shrines, cliques, webrings, or other hobby sites. Get creative and let me know what you build! I'd love to hear about other ways Luster is being used.

No. Luster is an independent script. It can help you run approved fanlistings by The Fanlistings Network (TFL)/The Anime Fanlistings Network (TAFL), but it has no official affiliation with them or any other directory.

No. Luster helps you manage your fanlisting. You still need to apply through TFL, TAFL, or whichever directory/network applies, follow their rules, and wait to be approved.

Yes! Luster receives regular updates covering new features, bug fixes, and security improvements. You can follow releases at the download page or github.com/starceress/luster.

There are a couple ways you can reach out:

• (Recommended) Click Send a Report in your Luster admin panel's navigation sidebar. This will give you the most personalized help.
• Use the contact form on this website.
• Email support [at] luster.nu directly.

Yes! You can run a single listing or manage a whole collective, all from the same login and central admin panel. Each listing gets its own member table, forms, templates, settings, affiliates, codes, and email configuration.

Yes! Luster includes public join forms, member update forms, and a password reset flow. Submissions go straight into your admin panel for review. You can set individual listings to auto-approve new members or queue them for manual approval. Members can update their details or remove themselves at any time, and Luster sends the confirmation emails automatically. If you run a collective, members can also update their details or remove their membership across your whole collective from a single connected form, instead of doing it fanlisting by fanlisting.

Yes! Luster supports five listing statuses: Current, Upcoming, Pending, Closed, and Adopted Out. Archiving a listing as Closed or Adopted Out stops its public join, update, password reset, and contact forms from accepting submissions. All your member, code, and affiliate data stays intact and manageable from the admin panel. Adopted Out listings can optionally record the successor's name and URL. You can reopen a listing at any time and it returns exactly to how it was before.

Yes! Luster supports collective-level affiliates and per-listing affiliates. You get an affiliate application form, a pending queue for review in your admin panel, and the ability to email one affiliate, selected affiliates, or your entire affiliate list directly from the admin panel.

Yes! Luster includes a full code management system: it auto-detects code sizes, organises codes by size, and lets you reorder them with drag-and-drop (the order your visitors see matches what you set). It also has a code donation form so fans can submit codes, with an approval queue for you to review before they go live.

Luster ships with five add-ons, all installed and enabled by default:

• Adoptions - lets fans apply to adopt fanlistings you're offering up.
• Join Rules - adds a per-listing rules page that visitors must agree to before the join form appears.
• Keep In Mind (KIM) - a separate sign-up list for things you want to fanlisting about but haven't yet.
• News Feed - a blog-style update feed for your collective or individual listings.
• Wishlist - a public wishlist of fanlistings you'd like to own or join.

You can enable or disable any add-on from the admin panel without losing its data. They can be managed under Manage Add-Ons in your admin navigation panel.

Yes! Luster supports multiple admin accounts, each with their own username, email address, password, and display name. You can manage admin accounts under Settings → Admin Users.

Note:

Yes! The joined listings tracker lets you keep a list of fanlistings you're a member of, with categories, images, join dates, and status. You can display them on your site using the joined listings embed, and filter them by category.

Yes! When a new version is released, a banner appears on your dashboard. The update process happens entirely in your browser: Luster downloads the release from GitHub, verifies it with a SHA-256 checksum, prompts you to download a backup, and then applies the files. Your config/app.php is never touched, so your database credentials and settings stay exactly as they are. After the files update, you're sent to the migration runner to apply any database changes the new version needs.

Yes. The Link Checker scans affiliate URLs and joined listing URLs across your whole collective. It reports on each URL's status (active, redirected, dead, etc.). Affiliates also get a reciprocal check to confirm they're still linking back to your site. Redirected URLs can be updated in one click from the results. You can find it under Link Checker.

Yes. When you set a listing's Approved By field to TFL or TAFL, an Approval Page URL field appears with a Look up button. Clicking it searches TFL or TAFL's approved listings index for your listing's subject and returns candidates for you to pick from. Results are cached for 24 hours so repeated lookups don't re-fetch the page. You always confirm before anything is saved. Once saved, the URL is available as a token in your stats embed template.

Yes. Luster ships with five built-in color themes for the admin panel (including both dark and light mode variants). You can switch themes from the toggle in the top-right corner of any admin page, and choose a skin under Settings → Appearance. Community-made skins support is also nearly finished, so that'll be released soon!

This feature is in the final stages of development and should be out soon! Check back later.

Yes. Tick the Remember me checkbox on the login page and Luster will keep you logged in for up to 30 days. You can have up to 10 remembered devices at once — for example your laptop and your phone. Each device shows up individually under Settings → Remembered Devices where you can revoke any or all of them.

The activity log is a full audit trail of every significant action taken in the admin panel — who approved a member, which affiliate was deleted, when a template was changed, and so on. It's useful for keeping track of changes, especially if you have multiple admin accounts. You can find it at Admin → Logs → Activity Log.

Yes. Luster sends automatic emails for join confirmations, member approvals, password resets, affiliate application updates, code approval notifications, and admin password resets. By default it uses PHP's built-in mail() function, but you can configure SMTP for more reliable delivery. You can also compose and send emails to members or affiliates directly from the admin panel: to one person, a selection of people, or everyone at once.

Go to Settings → SMTP & Email and enter your SMTP server details: host, port, username, and password. You can choose STARTTLS (typically port 587) or SSL (typically port 465). Once saved, use the Send Test Email button to confirm it's working. If your hosting provider gives you SMTP credentials for your email address, those work here. Gmail, Outlook, and other similar services all work too.

Yes. Luster ships with default email bodies for every system email (join confirmation, approval, password reset, and so on) that you can customize per-listing or at the collective level. You can also create and your own customizable email templates. Templates support tokens like {fan_name}, {listing_title}, and {reset_url} that get filled in automatically when the email is sent.

Yes. In the Affiliates section you can compose and send a bulk email to all affiliates of a specific listing or your entire collective at once. Each email is sent individually with the affiliate's own details substituted in via tokens like {aff_name} and {aff_email}.

Yes. Luster includes a guided import wizard that covers all of those. Data that can be imported includes listings, members, categories, affiliates, codes, templates, joined listings, and more depending on the source. You can find it under Import Data.

Start with a full backup of your original database and files. Then install the latest version of Luster, log in, and go to Import Data. The wizard will walk you through connecting to your old database, previewing what it finds, and running the import. You don't have to delete your old install first; Luster can read from a separate database on the same server.

Yes, always. The import wizard shows you a preview before writing anything, but a database backup is still the safest thing to do. If your old script and Luster share the same database, a backup is especially important before you start.

Hashed passwords are preserved exactly as they are in your old database. If you're coming from a script that stored passwords as MD5 hashes, Luster detects those automatically and upgrades them to Argon2id the next time each member logs in. Members don't need to reset their passwords; their existing password keeps working and gets silently upgraded in the background.

Skip Existing should be the default and the recommended choice for virtually everyone, including first-time users.

Use Overwrite only in edge cases, like if your first import attempt went wrong somehow and you haven't touched anything in the Luster admin panel yet. Re-running with Overwrite lets you correct the botched data from the source again without manually deleting everything first. This replaces matching records with the source data again; any changes made in Luster since your last import will be lost.

Rule of Thumb:

• First time importing? Use Skip Existing. (There's nothing to overwrite yet anyway).
• Re-importing because your last attempt was broken and you haven't touched anything in Luster since? Use Overwrite to redo it correctly.
• Not sure? Use Skip Existing. It's safe to re-run and never overwrites anything you've already edited in Luster.

Yes. Using the Skip Existing option, the import is safe to run again as many times as you need. Records that already exist are left untouched and only genuinely new data is added. If you want to write over existing data instead, use the Overwrite option, which replaces matching records with the source data again meaning any changes made in Luster since your last import will be lost.

No. Luster doesn't add any standalone pages to your site. Instead, you drop PHP snippets into pages you already have, and Luster renders its output there. Your site keeps full control of its layout, navigation, and design - Luster just fills in the bits you tell it to.

The Embed Wizard generates ready-to-copy PHP snippets for every embed Luster offers, including but not limited to: join forms, member lists, stats, codes, affiliates, and more, for both individual listings and your collective. It walks you through the available options so you can quickly get the right snippet without needing to look up variables manually. You can find it at Embed Wizard.

Almost everything that displays on your site is template-driven. At the collective level: owned listings, joined listings, random and latest listing widgets, statistics, affiliates, affiliate application form, codes, code donation form, news feed, KIM list, join rules, wishlist, and more. At the per-listing level: member list, affiliates, statistics, join form, join rules, adoption form, codes, code donation form, affiliate application form, and email templates. Templates can be customized at the per-listing, global (shared across all listings), or collective level, and the admin panel shows which level each template is currently inheriting from.

Yes. Every template editor in the admin panel has a live preview that renders with real or sample data so you can see how the output will look before saving. The Embed Wizard also offers customisation options that generate a pre-configured snippet for you.

Yes. Luster keeps the last five saved versions of each template. You can restore any of them directly from the template editor without needing a database restore or FTP access.

Yes. Every element Luster outputs uses a consistent set of fl- prefixed CSS classes (for example fl-form, fl-field, fl-member, fl-pagination). You write the CSS in your own stylesheet and Luster respects it. The CSS Class Migration guide exists for this very reason and is a comprehensive resource on all the classes available to you, as well as the equivalents for Enthusiast, Listing Admin, and Fanatically.

Admin passwords are hashed with Argon2id, which is the strongest password hashing algorithm currently available in PHP. Member passwords set through Luster are also hashed with Argon2id. If you're importing from an older script that used MD5 hashes, those are detected automatically and upgraded to Argon2id the next time the member logs in. Plaintext passwords are never stored anywhere.

Luster was built with security as its primary focus. Every database query uses prepared statements (so SQL injection is not possible), every value echoed to the browser is escaped (preventing XSS), and every state-changing form is protected with a CSRF token. File uploads are validated by MIME type rather than file extension. Outgoing HTTP requests from Luster (like the link checker) are protected against server-side request forgery (SSRF) and always verify TLS certificates. The Security guide provides more information on these measures.

No. Luster provides software tools, not legal advice. You are responsible for your own privacy policy, copyright choices, email practices, uploaded content, imported content, and any laws that apply to your site and your visitors.

The only external requests Luster makes are ones you explicitly trigger: checking for updates (fetches release metadata from GitHub), the link checker (fetches URLs you tell it to check), and the TFL/TAFL lookup (fetches the network's approved listings index). None of these send your site data anywhere and they only fetch remote content for your own use. Update checks can be seen in Settings → System & Updates.