Contain the risk immediately.
Restore customer service component by component.
The Castle's previous online ticketing shop was built over 15 years ago on outdated software that stores customer passwords without modern encryption and suffers from duplicate customer records. Rather than attempting a risky repair of obsolete code, we have immediately protected the estate by shielding the old system inside our secure private network and launching a modern replacement in carefully planned stages.
The legacy highclerecastleshop.co.uk application runs on end-of-life PHP 7.4 and
CodeIgniter 3 with 118 unindexed/MyISAM database tables and plaintext customer passwords.
Rather than attempting a risky in-place upgrade of unmaintainable legacy code, we are isolating the legacy
environment behind our NetBird VPN immediately and launching a clean, modern replacement in
revenue-prioritised stages.
- End-of-Life Software Exposure: The old website ran on discontinued server software with known security vulnerabilities that cannot be safely left exposed to the public internet.
- Unencrypted Customer Passwords: The old system stored customer and coach passwords in plain text without modern encryption, creating an urgent security and data protection risk.
- Duplicate Accounts & Fragile Database: The legacy database lacked basic integrity checks, allowing hundreds of customers to have duplicate accounts under the same email and causing frequent login failures.
- Silent Calculation Flaws: Flaws in the old code silently zeroed out commercial cancellation penalties on coach bookings, leaking revenue.
- End-of-Life Runtime Exposure: PHP 7.4 and CodeIgniter 3 are exposed to active public CVE exploitation and lack modern request validation or CSRF/SQLi guardrails.
- Plaintext Customer Passwords: Despite a December 2018 code comment intending to hash
passwords,
Customers_model::getUserLogin()andCoachvisitsstill store and compare passwords in plaintext acrossusers(~498k rows) andcoach_companies. - Zero Database Transactions (MyISAM): Core commercial tables (
users,orders,order_item,user_info) use the legacyMyISAMstorage engine - meaning no ACID transactions, no foreign-key integrity, and duplicate customer accounts sharing the same email address. - Silent Logic Bugs in Legacy Code: For example,
Coachvisits::_calculate_penalty()(line 2257) contains an assignment bug (if ($order_id = 3649) { $penalty = 0; }) that silently zeroes out cancellation penalties for every coach booking.
Protecting the Castle Without Disrupting Daily Operations
Taking the vulnerable old public shop offline does not stop office staff or Castle gate teams from doing their jobs. By separating visitor access from internal office tools, we eliminated external risk on Day 1 while keeping daily operations fully functional.
External Access Closed
All public internet access to the outdated server was removed immediately, preventing outside security threats.
Office Systems Protected
Office staff continue accessing their daily administration portal securely through an encrypted private connection to answer customer calls, move booking dates, and prepare gate admission lists for scanners.
New Customer Portal Launched
Visitors now access a fast, modern system where they can view bookings and print admission tickets, with any office updates mirrored automatically every 60 seconds.
Operational Continuity via NetBird VPN Containment
Taking the vulnerable public website offline does not mean blinding office staff or Castle gate operations. By decoupling public customer access from internal back-office access, we eliminate public risk on Day 1 without disrupting daily operations.
Remove Public PHP Routing
Drop all public internet routing to the PHP 7.4 / Apache web server immediately. Restrict outbound traffic from the legacy VM so only required internal services remain reachable.
Keep Legacy /admin Internal
Office staff continue accessing the legacy /admin portal exclusively over the private
NetBird VPN to answer customer queries, process date transfers, void tickets, and export daily
Gate Lists for admission scanners.
Deploy Component 1 + ETL Sync
Point public highclerecastleshop.co.uk traffic to the new Astro SSR + Node.js
application backed by a clean PostgreSQL database, kept in sync with staff changes in legacy
MariaDB via an idempotent 1–2 minute ETL pipeline.
Revenue-Ordered Component Rollout
Instead of a "big bang" rewrite that delays launch for months, we ship one self-contained capability at a time, ordered strictly by customer urgency and commercial revenue impact:
| Stage | Component | Audience | Operational Purpose | Status |
|---|---|---|---|---|
| Phase 0 | Secure Office Connection & Data Pipeline | Office Staff & IT | Protected office administration inside private network; established automated background pipeline synchronising over 1.17 million historical customer and ticket records. | Built & Verified |
| Component 1 | Customer Portal & Ticket Retrieval | Existing Ticket Holders | Secure email sign-in without passwords, unified booking history, active gift voucher balances, gate-scannable admission tickets, and printable VAT receipts. | Built & Verified · Ready for Staging |
| Component 2 | Public Admission & Event Ticket Sales | New Castle Visitors | Live event booking calendar, timed admission slots, dietary options for afternoon teas, gift voucher redemption, and instant email ticket delivery. | Priority 2 |
| Component 3 | Staff Administration Portal | Office & Gate Teams | Modern back-office screen for ticket changes, date moves, cancellations, and gate scanner list downloads, replacing the old administration screen. | Priority 3 |
| Component 4 | Coach Tours Portal & Management | Group Tour Operators & Staff | Self-service booking portal for coach operators with automated deposit tracking, accurate cancellation rules, and complete retirement of legacy systems. | Priority 4 |
| Component 5 | Gift Shop Merchandise & Castle Lodges | Shoppers & Lodge Guests | Online estate gift shop orders and London Lodge overnight stays. | Deferred |
| Stage | Component | Primary Audience | Business Goal & Scope | Status |
|---|---|---|---|---|
| Phase 0 | NetBird Isolation & DB Sync (ETL) | IT / Office Staff |
Remove public routing to PHP 7.4; restrict legacy /admin to NetBird VPN; stand up clean
PostgreSQL database and idempotent MariaDB → Postgres ETL sync (1,177,622 records synced).
| Built & Verified |
| Component 1 | Customer Portal & Ticket Retrieval | Existing Ticket Holders | Branded maintenance/holding page, Passwordless Email 6-Digit OTP & Magic Link login (via Postmark), consolidated Order History, Gift Voucher breakdown, dynamic SVG Code 128B Ticket barcodes, and printable VAT Invoices. | Built & Verified · Ready for Staging |
| Component 2 | Public Admission & Event Ticket Sales | New Visitors | Public event & timed-entry catalogue, live capacity calendar with PostgreSQL row-level locking, dietary menu selection, Gift Voucher redemption, gateway-agnostic checkout, and automated Postmark ticket dispatch. | Priority 2 |
| Component 3 | Staff Back-Office (/admin) | Office & Gate Staff | Order lookup, date transfers, ticket voiding, and direct Gate List scanner exports in the new app. Retires the MariaDB customer/order ETL sync. | Priority 3 |
| Component 4 | Coach Visits Portal & Coach Admin | Coach Companies & Group Staff |
Full vertical slice cutover of coach_* tables to PostgreSQL. Modernised Coach Company login,
per-season policy acceptance, slot requests, staff approval/rejection UI, deposit/balance payments,
corrected cancellation penalty logic, and final legacy PHP 7.4 decommission.
| Priority 4 |
| Component 5 | Gift Shop Merchandise & Lodge Bookings | Shoppers & Overnight Guests | Physical gift shop catalogue/shipping calculation and London/Grotto Lodge reservation calendars (lowest revenue share, safely deferred until core ticketing and back-office are complete). | Deferred |