Back to Blogs
Almost every small business client asks me the same thing near the end of a project: "Can I change this myself later?" They mean small things. A new price, a new photo for a service, a holiday notice, a fresh blog post. If the answer is no, every one of those changes turns into a message to me, a wait, and sometimes a small invoice. That is not a good deal for them, and honestly it is not great for me either.
So on most custom PHP sites I build, I add a simple admin panel. Not a full CMS like WordPress, just a private area where the owner can edit the parts of the site that actually change. This is how I decide what goes in it, how I build it, and the mistakes I try to avoid.
Why not just use WordPress?
Sometimes WordPress is the right answer, and I say so when it is. If a client wants to run a big blog, install plugins and manage everything themselves, a CMS makes sense.
But many small business sites are mostly fixed pages with a few parts that change. For those, a full CMS brings things the owner never asked for: plugin updates, theme updates, security patches and a dashboard with fifty menu items they will never use. A small custom admin panel only shows what they need, so it is faster to learn and there is less to break.
Start by listing what the owner will actually edit
Before I write any admin code, I go through the site with the client and ask one question for each section: "Will you want to change this in the next year?" Most of the time the answer is no. The About text, the layout, the footer and the main headings usually stay the same for a long time.
The things that do change are usually a short list:
- Services or products, with a title, short description, price and photo
- Portfolio or gallery items
- Blog posts or news
- Opening hours, phone number and address
- Testimonials or reviews
- Enquiries that came in through the contact form
Only those go into the admin. If I made every sentence on the site editable, the panel would turn into a confusing page builder, and the client would be scared to touch it.
How I structure it
One database table per type of content
Each editable thing gets its own MySQL table: services, portfolio_items, blog_posts, enquiries, and a small settings table for one-off values like the phone number. The public pages read from these tables, so when the owner saves something in the admin, the live page updates right away.
The same screens for every section
Every section follows the same pattern: a list page with search, an edit form, and a delete button that asks for confirmation. Once the owner has learned how to edit one service, they already know how to edit a portfolio item or a blog post. Keeping it predictable matters more than making it clever.
Plain labels, not developer words
The fields say things like "Short description (shows on the homepage card)" instead of "excerpt". The slug field fills itself from the title. Image fields show a preview and say what size works best. Small hints like these save a lot of "what does this box do?" messages.
Security is not optional
An admin panel is a door into the website, so I treat it carefully even on a small site.
- Passwords are hashed with PHP's
password_hash()and checked withpassword_verify(). I never store them in plain text. - Login attempts are limited, so nobody can try thousands of passwords.
- Every form has a CSRF token, so another site cannot trick a logged-in owner into saving or deleting something.
- Every query uses prepared statements, which blocks SQL injection.
- Uploads are checked for real image types and size, and files are renamed, so nobody can upload a PHP file disguised as a photo.
- Database and email passwords live in a config file outside the public folder, and that file never goes into Git.
Here is the kind of check that sits at the top of every admin page:
session_start();
if (empty($_SESSION['admin_id'])) {
header('Location: /admin/login.php');
exit;
}
if ($_SERVER['REQUEST_METHOD'] === 'POST'
&& !hash_equals($_SESSION['csrf'], $_POST['_csrf'] ?? '')) {
http_response_code(403);
exit('Session expired. Please reload the page.');
}It is not complicated, but skipping any of these is how small sites get hacked.
Small things that make it pleasant to use
It has to work on a phone
Most of my clients will open the admin on their phone, often in a shop or between jobs. So the admin is responsive too: big buttons, full-width fields and no tables that scroll sideways. If adding a new photo takes two minutes on a phone, they will actually keep the site up to date.
Images are resized automatically
Owners upload photos straight from their phone camera, often 4 or 5 MB each. The admin resizes them and saves a WebP version, so the public site stays fast without the owner having to learn anything about image sizes.
Clear messages after saving
After every save there is a plain message like "Service updated" and a link to view it on the site. If something fails, the message says what to fix, not a technical error.
Drafts for blog posts
For blog posts I add a draft status, so the owner can write something over a few days and publish it when it is ready.
Mistakes I try not to repeat
- Giving them a rich text editor with every option. They end up pasting text from Word with strange fonts and colours. I keep the editor simple: headings, bold, links and lists.
- Letting them change the layout. Owners edit content, not the design. That keeps the site looking consistent after a year of edits.
- Forgetting backups. If the owner deletes something by accident, it should be possible to get it back. Regular database backups are part of the setup.
- No handover. I record a short screen video showing how to edit each section. People forget, and a two-minute video answers most questions later.
How long does it take?
For a typical small business site with services, a gallery, a blog and an enquiries list, the admin usually adds a few days to the build. It depends on how many sections there are and how much each one needs, so I scope it with the client before I start. In my experience it pays for itself quickly, because the owner stops waiting on a developer for every small change.
I built the same kind of panel for this site. I add portfolio items and blog posts from it, and I check enquiries there too, so I use the thing I build for clients every day.
If you have a site you can't edit yourself and you would like a simple admin added to it, send me a message with what you want to be able to change, and I'll tell you honestly whether it is worth doing.
