I built a zero-dependency forum in pure PHP

A few months ago I got tired of how complicated modern forum software has become.

Want a simple place for people to discuss something?

Most options expect Docker, Redis, a proper VPS, Composer, and a non-trivial amount of setup.

I believe everyone should be able to install a forum easily, even on very cheap or free shared hosting. No root access, no containers, no complex stack.

Classic forum software is often still the easiest to install, but the default look and feel usually shows its age. Modern alternatives look better, yet they tend to come with heavier requirements. I wanted something in between: easy to deploy, simple at the core, and reasonably modern (and easy to theme).

So I built bulletinbored.

What it is

bulletinbored is a minimal, extensible forum written in plain PHP.

Zero external dependencies — no Composer, no npm, no Docker
Works with PHP 8.1+ and PDO (SQLite or MySQL)
Upload the files → run the 3-step installer → done
Clean URLs, moderation, roles & permissions, plugins, themes, localization
Built-in update system for core, plugins and themes

You can see the forum in action here:

https://www.bulletinbored.net/forum/

The core stays small on purpose. Extra features (rich editor, private messages, notifications, etc.) live in optional plugins.

Why zero dependencies?

The main reason is accessibility.

A lot of people still use cheap or free shared hosting. On those environments Composer is often unavailable or painful, Docker is impossible, and you rarely have root. I wanted the software to work in that reality.

There are secondary benefits too: the entire codebase is easy to audit, there is no dependency tree to monitor for supply-chain issues, and fewer moving parts that can break when the hosting environment changes. Of course this comes with trade-offs — you reimplement things that mature libraries already solve well. For a focused project of this size, it felt like the right compromise.

Technical choices

Some decisions that shaped the project:

Architecture

Simple front controller + focused src/ core. No full framework. Managers for plugins, themes and updates live in lib/.

Authorization

Centralized AuthZ service with permission checks (threads.create, posts.edit_own, etc.).

Security

CSRF tokens that rotate after every successful validation
Content Security Policy with nonces
Real MIME detection + structural checks for uploads
Server-side enforcement of bans/suspensions on every request
Zip Slip protection when installing plugins/themes

Database

File-based migrations. SQLite works well for small communities; MySQL is supported too.

Extensibility

Plugins can register hooks and routes. Themes are basically a folder with CSS (and optional templates).

About the license

The project uses the BSD Zero Clause License (0BSD).

I deliberately chose the most permissive license available. Part of the code was written with AI assistance, and there is no established community around the project yet. I wanted to maximize the chances that the code remains usable and can be adopted, forked, or continued by others, even if I eventually stop maintaining it.

0BSD places almost no restrictions on use, modification, or redistribution. If a real community forms around the project in the future, any decision about changing the license can be made together.

Current status

The project is at 0.8.x and moving toward 1.0.

The architecture has been cleaned up a lot recently (modular helpers, proper Response objects, middleware router, better tests). There are still bugs and rough edges — this is not production-perfect yet.

What I'd love feedback on

Does the “upload and run on cheap/free hosting” goal still make sense?
Is the security model (trusted admin + HTTPS + integrity checks) reasonable for this kind of software?
What do you consider must-have before calling a forum “1.0”?

Thanks for reading.

If you try it, I’d be happy to hear what breaks.

Cheers!