# EZOS.Hosting HostBill Branding Report

Date: 2026-05-28
Scope: EZOS.Hosting brand experience on the public support and billing portal.

## Summary

The EZOS.Hosting HostBill brand now follows the Phase-1 website design language: dark premium-tech shell, green/cyan/amber accents, direct 2003-inspired offer paths, strong cards, clear CTAs, and the line “Easy Open Source Hosting since 2002”. The implementation is brand-scoped to the EZOS template and does not change product, price, invoice, payment, ticket, customer, registrar, DNS, provisioning, cron, webhook, or automation logic.

No credential file was read. No admin-user, product, pricing, tax, invoice, payment, registrar, DNS, API, webhook, cron, customer, ticket, or provisioning setting was changed.

## Changed Public Files

- `.htaccess`
- `templates/ezoshosting/.htaccess`
- `templates/ezoshosting/header.shared.tpl`
- `templates/ezoshosting/header.tpl`
- `templates/ezoshosting/footer.tpl`
- `root.tpl` under `templates/ezoshosting`
- `templates/ezoshosting/login.tpl`
- `templates/ezoshosting/signup.tpl`
- `templates/ezoshosting/knowledgebase.tpl`
- `templates/ezoshosting/support.tpl`
- `templates/ezoshosting/support/addticket.tpl`
- `templates/ezoshosting/affiliates.tpl`
- `templates/ezoshosting/404.tpl`
- `templates/ezoshosting/badbrowser.tpl`
- `templates/ezoshosting/overrides/products.tpl`
- `templates/ezoshosting/overrides/cart1.tpl`
- `templates/ezoshosting/components/cart/cart.nav.tpl`
- `templates/ezoshosting/menus/menu.top.notlogged.tpl`
- `templates/ezoshosting/menus/menu.top.logged.tpl`
- `templates/ezoshosting/menus/menu-sub.top.tpl`
- `templates/ezoshosting/components/ezos-phase2-context.tpl`
- `templates/ezoshosting/dist/css/ezos-phase2.css`
- `templates/ezoshosting/dist/js/ezos-phase2.js`
- `templates/ezoshosting/dist/images/ezos-phase2-structure.svg`
- `docs/hostbill-branding-report.md`

## Backup And Rollback

A private backup package was created outside `public_html` with timestamp `hostbill-phase2-20260528T144259Z`. It contains the original touched files, file lists, checksums, and the private rollback document `docs/hostbill-theme-rollback.md`.

Public rollback summary:

1. Restore the private backup package over the public tree.
2. Remove Phase-2-only EZOS files if doing a full visual rollback.
3. Restore template file modes if reverting the `.tpl` hardening.
4. Smoke test `/`, `/clientarea/`, and `/cart/shared-hosting-plans/` after rollback.

## Design Tokens

- Backgrounds: `#071014`, `#0b171d`
- Text: `#f5f7f3`, `#eaf0e8`, `#b8c3bf`
- Accents: `#55d22f`, `#2ea90e`, `#67d8ff`, `#f4b82d`
- Light-surface accessible green: `#1f7d0c`
- Radius: 7-8px cards and controls
- Tone: direct offer paths, open-source hosting language, no fake badges, no stock imagery, no team photos

## Implementation Notes

- Added an EZOS context panel above key HostBill views so visitors immediately see where they are, what action is safe, and how to return to the main site.
- Rebuilt the root portal cards around Hosting, Domains, Client Area, Support, Affiliates, and Managed Local AI request flow.
- Added an EZOS footer, wordmark navigation, dark sidebar, dark top bar, card styling, responsive mobile corrections, visible focus states, and reduced-motion support.
- Kept Managed Local AI as a request/ticket path because no dedicated HostBill product was introduced.
- Disabled the broken external form analytics behavior for this template and marked portal forms as not trackable by that script.
- Hardened EZOS Smarty template files so raw `.tpl` files are not directly readable over HTTP; public CSS, JS, and SVG assets remain readable.

## Tested Journeys

Curl smoke checks returned expected statuses with no PHP/Smarty error markers:

- `/` → 200
- `/products/` → 200
- `/clientarea/` → 200
- `/login/` → 200
- `/signup/` → 200
- `/knowledgebase/` → 200
- `/tickets/new/` → 200
- `/checkdomain/domains/` → 200
- `/cart/shared-hosting-plans/` → 200
- `/cart/checkout/` → 200 empty-cart safe stop
- `/affiliates/` → 200
- `/no-such-phase2-smoke` → 404

Internal browser smoke checks covered desktop and mobile home, login, register, password recovery, ticket opening, knowledgebase, domain search entry, cart, checkout safe stop, affiliates, and 404. No browser console errors were seen on normal pages after the template guard; the 404 page reports the expected 404 resource status. Signup and cart pages still emit an existing HostBill/Parsley deprecation warning.

Accessibility checks completed:

- Pinch zoom is allowed.
- Duplicate search input IDs were removed.
- Icon-only header links now have accessible labels.
- Dropdowns no longer render as initially expanded.
- Ticket guest name, email, and CAPTCHA fields have labels.
- Focus styles are visible.
- Green text on white HostBill cards was darkened for contrast.
- NoScript browser-help links were switched to HTTPS.

Security and leak checks completed:

- Direct HTTP reads of EZOS `.tpl` files now return 403 while the portal still renders normally.
- A sensitive root dotfile in the support webroot was made non-world-readable after confirming it was directly reachable; its content was not read.
- Targeted grep of changed files and rendered public routes found no supplier, source-cost, internal pricing, credential, token, admin-panel, absolute-path, or support-domain leak markers.
- Public assets remain limited to the EZOS overlay CSS, JS, and structural SVG.

## Known Risks

- Some raw server-side SEO title rows are shared across brands. They were not changed to avoid cross-brand impact. Browser titles are normalized for EZOS pages by the brand-scoped script; a future admin review should set brand-specific SEO titles if HostBill supports that safely.
- Broader server-wide direct-file exposure findings outside the EZOS brand were not remediated in this branding pass.
- Checkout was tested only to safe stop states. No real customer data, payment data, invoice action, order submission, or provisioning action was executed.
- Full Lighthouse scoring was not run because this is a dynamic HostBill portal with third-party scripts; visual, responsive, console, and route smoke checks were completed instead.

## Confirmation

This Phase-2 pass changed presentation, template accessibility, template hardening, and public copy only. It did not change customer records, tickets, invoices, payment logic, tax logic, products, prices, affiliate payout logic, registrar provisioning, DNS, cronjobs, automations, API keys, webhooks, or admin users.