Link-in-bio page unzipped into a PHP web root
LinkStack is a self-hosted stand-in for Linktree: the one URL a social profile lets you post leads to a page on a server you run. The release archive is a Laravel app that you copy into the root of a PHP 8 site, and a setup wizard opens on the first visit. Data sits in an SQLite file by default; switching to MySQL means seeding the database again.
Many users per install, contact cards and JSON export
- Zip file or Docker image: plain web hosting only needs the archive. The official image, on Docker Hub and ghcr.io, runs Apache and PHP 8.3 on Alpine for amd64, arm64 and 32-bit ARM.
- A page for every registered user, plus an admin panel that manages accounts and their links. Sign-ups are closed in the shipped configuration.
- Blocks beyond links: headings, text, spacers, email, phone and a downloadable vCard contact card. The user panel also shows a QR code for the page.
- Themes as zip files: download one from the community catalog on linkstack.org, then upload it in the admin panel.
- Per-user JSON export of profile, links and avatar, in a file that can be imported again.
- One-click updates from the admin panel, with an automatic backup beforehand.
End-of-life Laravel and a project-run mail relay
Shared PHP hosting is the target. The README pitches a drag-and-drop install with no terminal and no code, and the website's FAQ asks only for a web server running PHP 8. Yet an open issue (#1008) describes profile pages that never finish loading on OVH shared hosting, where the redis PHP extension is installed but no Redis server is reachable.
The released code runs on Laravel 9, which has had no security fixes since February 6, 2024, according to Laravel's support policy. The 4.8.8 composer.lock pins laravel/framework at 9.52.21. The move to Laravel 12, which requires PHP 8.2, is under way on the beta branch, last committed to on October 26, 2026.
Latest release: 4.8.8, October 22, 2026. It rolls back 4.8.7, published the day before, which left upgraded instances returning HTTP 500 errors (issue #1014). In that thread the maintainer defers one of the security fixes to the 4.9 beta. Before that, no release came out between 4.8.4 on December 10, 2024 and the 4.8.5 pre-release on January 26, 2026.
Mail goes through a project relay by default. The built-in mailer in the shipped .env is not a local server: config/mail.php sends through mail.llc.ovh, with the credentials in plain text in the public repository. Address verification and password reset emails travel through it until an SMTP server or sendmail is configured.
The shipped .env is tuned for installation, not production. It turns APP_DEBUG on, and its own comment suggests switching that off once setup is done. Users can put HTML in their descriptions, and "V2" themes can inject custom code, a setting the file says you may want to disable for security reasons.
Update backups leave MySQL out. The updater keeps two backups at most and does not include a MySQL database. The README also warns that it can fail without an error and stay on the current version when a PHP extension does not match the PHP version it expects.
AGPL-3.0 since version 4.0.0. The README points out that network use counts as distribution, so a modified public instance has to publish its source code.