4 payment methods
Mercado Pago (PIX, credit and debit), Stripe, PayPal and Binance Pay.
L2JOne web services
L2JOne Website System
A complete platform for Lineage II servers: player accounts, donations with automatic in-game delivery, an administrative dashboard with reports, and a security layer built for real operation.
- Security
- Automation
- Performance
- Easy administration
Servidor Lineage II
Projeto L2Zax
Visitar l2zax.com
Automatic in-game delivery
From confirmed payment to the item on the character, with no manual step.
4 languages and multiple layouts
Portuguese, English, Spanish and Russian, with theme switching from the panel.
One licence per website
Each installation gets its own licence, bound to the contracted domain.
00
INSIDE THE SYSTEM
What the administrator and the player see.
01
PLAYER FEATURES
Everything a player can handle alone.
Account, balance, characters and access recovery are in the player's own hands — support stops being the bottleneck.
Account registration
- Account creation straight from the website
- Game database integration
- Server-side data validation
- Optional email verification
- Google reCAPTCHA protection
Secure login
- Protected sessions
- Automatic session ID regeneration
- Session fixation protection
- Social login with Google and Facebook
- Telegram login with validated signature
- Secure logout
Player control panel
- Ticket balance
- Purchase history
- Transfer history
- Character selection
- Automatic item delivery
- Start Packs by package tier
Account recovery
- Email-based recovery
- WhatsApp confirmation through the Meta API
- Single-use temporary tokens
- Automatic expiration
- Resend and attempt limits
02
DONATION SYSTEM
Payment confirmed, item delivered.
Four gateways, an internal ticket currency, coupons and automatic in-game delivery — with no manual step.
Supported gateways
- Mercado Pago — PIX, credit and debit card
- Stripe — international cards
- PayPal — worldwide payments
- Binance Pay — cryptocurrency
Coupon system
- Percentage discount
- Fixed value discount
- Usage limits
- Expiration date
- Minimum purchase amount
Ticket system
- Internal virtual currency
- Ticket-to-item conversion
- Manual adjustment by the administrator
- Full transaction history
- Atomic transfer to the character
From confirmation to the item on the character
- The gateway validates the transaction.
- The webhook signature is verified.
- The order is marked as completed.
- Credits are added to the player balance.
- The player transfers credits to a character.
- Items are delivered automatically in-game.
03
ADMINISTRATIVE DASHBOARD
The whole operation on one screen.
Revenue, players, content and configuration in one place, with real-time charts and exportable reports.
Real-time statistics
- Total and daily revenue
- New registrations
- Total purchases
- Pending and approved payments
- Conversion rate and average ticket
Charts and reports
- Revenue growth
- Daily and monthly earnings
- Visitors by country
- Distribution by payment method
- Sales, financial and activity reports
Visitor analytics
- Visitor country
- Browser and operating system
- Device type
- Access history
- Registrations and visits by country
Player and finance management
- Create, edit and suspend accounts
- Adjust balance with concurrency locking
- Approve or cancel transactions
- Review financial history
- Search players by name or email
04
CONTENT AND OUTREACH
The server storefront, editable without code.
News, streams, countdown, downloads and social networks are configured in the panel — without touching a single file.
News and gallery
- Unlimited posts
- Featured image
- HTML-capable editor
- Homepage highlight
Videos and streaming
- YouTube
- Twitch
- Kick
- Custom stream embeds
Countdown
- Launch countdown timer
- Configurable date and time
- Timezone support
- Homepage integration
Download center
- Game client
- Official patch
- Mirror downloads
- Torrent
- External links
Social networks
- Discord
- Telegram
- YouTube
Layouts and languages
- Layout switching from the panel, no deploy
- Multiple ready-made templates
- Portuguese, English, Spanish and Russian
- Synchronized language system
05
SECURITY LAYER
Protection at every layer.
A server website handles money and credentials. These protections ship enabled, with no extra configuration.
Session and authentication
- HttpOnly, Secure and SameSite cookies
- Session ID regeneration
- Authentication state validation
- Session timeout
- Session theft and fixation protection
Brute force and credential stuffing
- Attempt limits on login, registration and recovery
- Limits on email and WhatsApp resends
- Limits on checkout access
- Independent counters per IP and per account
- Resistant to attacks using rotating proxies and VPNs
Tokens and account verification
- Tokens generated with cryptographic randomness
- WhatsApp codes stored hashed
- Automatic expiration and single use
- Attempt counter and resend cooldown
- Account stays restricted until verification is complete
Payments and fraud prevention
- HMAC-SHA256 signature on payment callbacks
- Constant-time signature comparison
- Signed timestamp and freshness window
- One-time validation against replay
- Idempotency control and unique reference
- Database transactions with rollback
- Verification of already-completed orders
Item delivery and balance
- Conditional balance debit before delivery
- Delivery recorded before contacting the game database
- Failed deliveries stay pending for reprocessing
- Balance adjustment with transaction and row locking
- Prevents free items, inconsistent balances and duplicate delivery
Database, input and output
- PDO with prepared statements and parameter binding
- Controlled internal allowlists for dynamic identifiers
- No SQL concatenation with user values
- HTML and attribute escaping on output
- Input filtering against XSS
Uploads, files and directories
- Real MIME type and image content inspection
- Size limit and extension allowlist
- Server-generated filename, never the user's
- Blocks .sql, .sqlite, .log, .pem and .key
- Direct access denied to config, private, storage, cli and database
- Automatic warning if the private directory becomes exposed
Requests, headers and errors
- Mandatory CSRF token on sensitive forms
- Google reCAPTCHA v3 on public forms
- X-Frame-Options, X-Content-Type-Options, Referrer-Policy and HSTS
- Random OAuth state validated in constant time
- Telegram validated by HMAC with freshness check
- Theme names restricted to valid slugs, against path traversal
- Sanitized redirects, external ones over HTTPS only
- Internal errors go to a protected log; the visitor sees a clean message
Passwords
- Modern hashing for player panel accounts
- bcrypt with configurable cost for game server accounts
- Compatibility with the $2a$ prefix some emulators require
- Support for aCis 409, L2jMobius and Lucera2
Licensing and anti-cloning
- One licence per website, bound to the contracted domain
- Licence key and secret key unique to each installation
- Signed licence response with cached validation
- Temporary grace period when validation is unavailable
- Use on an unauthorized domain can be blocked
Built on a familiar foundation.
PHP 8+MySQL 9+ / MariaDB 11+PDOBootstrap 5.3.8AdminLTE 4.0.2Mercado Pago SDKStripe SDKPayPal APIBinance Pay APIGoogle OAuthFacebook LoginTelegram LoginWhatsApp Meta APIGoogle reCAPTCHA v3
06
EVOLUTION
What landed in recent versions.
Advanced security
- Rate limiting per IP and per account identity
- HTTP security headers across the whole site
- Error handling without exposing paths, SQL or stack traces
- Private storage exposure monitoring
- OAuth request protection and Telegram login validation
- Atomic ticket transfer and concurrent balance locking
Integrations and languages
- Google OAuth API
- WhatsApp API through Meta
- Synchronized language system
- Support for L2jMobius and Lucera2
- bcrypt encryption for aCis 409
- Multiple layout templates
Dashboards and infrastructure
- Graphical website visits dashboard
- Graphical donations dashboard
- Registration and visit charts by country
- DDoS attack redirection
- Email delivered to the Hotmail inbox instead of spam
- Confirmation resend limits
DELIVERED PROJECTS
Websites I built for clients.
Each logo opens the customer project. No commercial data, contract or infrastructure detail of these servers is published here.
L2JOne Website System
Professional website and control panel for Lineage II servers.
Site avulso com licença comercial por domínio. O preço configurado aparece no checkout e a compra exige a leitura e a assinatura eletrônica do contrato antes do pagamento.
R$ 600.00
BRL · site avulso
Ask about standalone website