Official Technical Documentation & User Manual
Installation
Verified Guide • Updated 17 Oct 2026
Installation Verified Guide

#I-03: Post-Install Hardening: Removing /install, License Key Activation, The 6-Step Setup Wizard & Cron Automation Setup

Updated 8 hours ago 5 min read 2 views
Installation Category · Part 3 of 4 Mandatory /install Lockout Guard Cron Scheduler & 6-Step Setup Wizard

Post-Install Hardening: Removing /install, License Key Activation, The 6-Step Setup Wizard & Cron Automation Setup

Once the Web Installer completes, Keystone X enforces four post-installation security and operational milestones before live production use: (1) validating your cryptographic License Key, (2) removing or renaming the /install directory to unlock the login form, (3) completing the 6-Step Post-Install Setup Wizard, and (4) scheduling the background Cron Automation Orchestrator.

1. Cryptographic License Key Activation (license_check.php)

On your first visit after installation (or if /app/config/license.key is missing or expired), license_check.php renders the Action Required — Enter License Key activation screen.

📸 SCREENSHOT PLACEHOLDER: install-license-activation-screen.png
  1. Temporarily clear or rename app/config/license.key and cache/license.json, then load the site in your browser.
  2. Capture the centered Action Required — Enter License Key card (APP-XXXX-XXXX-XXXX) showing the Validate & Activate button.
  3. Paste your valid license key and click Validate & Activate to restore normal access.
  • Where the Key Is Stored: Submitting your key writes it to app/config/license.key and caches the signed verification payload from https://keystonex.co.za inside cache/license.json.
  • Automatic Tier & Module Provisioning: The license payload automatically unlocks your subscribed tier (Starter, Professional, Enterprise), user/bank account limits, and active add-on modules via ModuleManager::init().

2. Unlocking Login: The /install Directory Security Guard (user/login)

Leaving an /install folder exposed on a live production web server is one of the most common security risks in web applications. To protect your business, Keystone X automatically disables the Login form (fieldset disabled) whenever the /install directory is detected in the project root!

📸 SCREENSHOT PLACEHOLDER: install-login-security-guard-prompt.png
  1. Create an empty folder named install in the project root (d:\AMPPS\www\keystonex.local\install) and open user/login in an incognito browser window.
  2. Capture the red Security Warning: /install Directory Detected card showing the disabled login form and the two buttons: Yes, Delete /install Now and No, I'll Rename It.
  3. Click Yes, Delete /install Now and also capture the green Security Hardening Complete confirmation banner!
Method 1: 1-Click Automated Deletion (Recommended)

On the Login screen, click the red Yes, Delete /install Now button. Keystone X invokes UserController::deleteInstallDir() via AJAX, verifies the strict path boundary (PROJECT_ROOT/install), recursively deletes all installer files, displays the green Security Hardening Complete alert, and immediately unlocks the Email & Password fields without even reloading the page!

Method 2: Manual Rename/Delete in cPanel File Manager

If your hosting server restricts PHP from deleting directories, click No, I'll Rename It to reveal step-by-step cPanel instructions. Open cPanel → File Manager, navigate to public_html, rename /install (e.g., to install_backup_do_not_use) or delete it, and click I've Renamed It in cPanel — Verify Now (UserController::checkInstallStatus) to unlock login immediately.

3. Completing the 6-Step In-App Setup Wizard (AdminController)

Upon your first administrator login, Keystone X launches the interactive 6-Step System Setup Readiness Wizard (which tracks your readiness percentage across 6 foundational pillars):

  1. Step 1 — Company Identity (company): Confirm your Legal Company Name, CIPC Registration Number, Email, Telephone, and Physical Address (admin/settings#general).
  2. Step 2 — Corporate Branding (branding): Upload your Company Logo, Favicon, and Primary Brand Color (admin/settings#branding).
  3. Step 3 — Financial & SARS VAT Profile (financial): Confirm your Base Currency (ZAR), VAT Registered status, 10-Digit SARS VAT Number, and Fiscal Year Start Month (admin/settings#financial).
  4. Step 4 — Primary Bank Vault (bank): Add your primary operating bank account and universal branch code (BankAccount/add).
  5. Step 5 — Document Numbering & Legal Terms (document): Confirm your Quote (QUO-), Tax Invoice (INV-), Credit Note (CRN-), Purchase Order (PO-), GRN (GRN-), and Job Card (JC-) prefixes and starting numbers (admin/settings#document).
  6. Step 6 — Outbound SMTP Email (smtp): Configure and test your outgoing SMTP server (admin/settings#email).

Tip: You can dismiss the wizard for your current session (admin/dismissSetupWizard), mark it permanently complete (admin/completeSetupWizard), or re-enable it anytime under Site Settings → System → Setup Wizard (admin/enableSetupWizard).

4. Configuring Scheduled Cron Jobs (cPanel, Linux Crontab & Windows Task Scheduler)

To automate Recurring Invoice generation, Overdue Invoice Dunning PDFs, Expired Quote cleanup, Low-Stock & Serial Warranty Watchdogs, Morning Staff Task Briefings, and the Outbound SMTP Email Queue, configure a scheduled task that runs every 5 to 15 minutes (or once hourly).

Navigate to System Administration → Automation & Cron Jobs → 5. CLI & Webhook Setup (admin/cron?mode=setup) to copy your server's exact pre-built command strings:

📸 SCREENSHOT PLACEHOLDER: install-cron-cli-and-webhook-setup-tab.png
  1. Navigate to admin/cron?mode=setup inside Keystone X.
  2. Capture the CLI & Webhook Setup screen showing the auto-detected cron_runner.php CLI command, the cron.php?key=SECRET HTTPS Webhook URL, and the Rotate Cryptographic Key button.
Hosting Environment Recommended Frequency Exact Command / Configuration to Paste
Option A: Native PHP CLI Runner
(cPanel Cron Jobs / Linux Crontab)
Recommended		 Every 15 Minutes
*/15 * * * *		 Uses cron_runner.php to execute all 8 pipelines natively via PHP CLI without HTTP timeout limits:
/usr/local/bin/php "/home/cpaneluser/public_html/cron_runner.php" > /dev/null 2>&1
Option B: Authenticated HTTPS Webhook
(cPanel / External Cron Monitor)		 Every 15 Minutes
*/15 * * * *		 Uses cron.php authenticated with your 32-character cron_secret_key:
curl -s "https://billing.yourdomain.co.za/cron.php?key=YOUR_CRON_SECRET_KEY" > /dev/null 2>&1
Option C: Windows Server / AMPPS / XAMPP
(Windows Task Scheduler)		 Every 15 Minutes Create a Basic Task in Windows Task Scheduler:
• Program/script: d:\AMPPS\php82\php.exe
• Add arguments: "d:\AMPPS\www\keystonex.local\cron_runner.php"
• Start in: d:\AMPPS\www\keystonex.local
© 2026 Keystone X — Official Technical Documentation https://keystonex.co.za/docs/installation/i-03-post-install-hardening-removing-install-license-key-activation-the-6-step-setup-wizard-cron-automation-setup
Was this technical guide helpful?
Back to top