Rilato Redirect Manager

$97.00 Version 20 · PHP + MariaDB · one file

One PHP file that decides where every visitor goes, and then tells you which of those decisions made money. Seventeen ways to match a visitor, rotation and weighted splits, click caps, and a full tracking layer with conversion postbacks.

You are already redirecting traffic. You just cannot see it.

Anyone running paid traffic, affiliate offers or more than one landing page ends up with a pile of redirects. A PHP file here with a hardcoded header() call, a .htaccess rule there, a link in an email pointing at a page that points at another page. It works, more or less, until you need to change an offer and cannot remember which of six files sends traffic to it.

The bigger problem is that none of it tells you anything. You split traffic between two offers because you wanted to know which one converts better — and then you have no way to find out, because the split happened in a file that does not write anything down. You are running an experiment and never reading the result.

Distributing traffic is the easy half.
Measuring it is the half that pays.

What it does

Every visitor that reaches the script runs through your rules in priority order, lowest number first, first match wins. A rule matches on something about that visitor — where they are, what they are using, where they came from, what time it is — and sends them to a destination you chose.

From version 18 every hit also mints an unguessable click ID before any rule is evaluated. That ID goes into the outgoing URL and into the log row, so when a conversion comes back from a network hours later, it joins up with the exact click, rule, country, device and traffic source that produced it. That is what turns a rotation into a test you can actually read.

What you get out of it

• One place for every redirect. Rules live in a database with a dashboard, not scattered through files. Change an offer once.
• Splits you can read. Round-robin or weighted A/B, with conversion rate and EPC per destination, per country, per traffic source.
• Sticky tests that stay honest. A returning visitor gets the same bucket, keyed to the destination URL itself — so reordering or editing your list does not silently re-bucket everyone mid-test.
• Caps that fall through. When an offer hits its daily click limit the traffic moves to your next rule instead of being wasted.
• It runs on your server. No third-party tracker in the path, no monthly click allowance, no outage in somebody else's data centre taking your campaigns down.

Seventeen ways to match a visitor

An IP denylist is checked before any rule runs, so blocked addresses never reach the engine at all.

The tracking layer

• Click IDs. Sixteen hex characters from random_bytes(), minted before rule evaluation so the same ID reaches the destination and the log whichever rule fires.
• Destination macros. A destination is a template. {clickid} {campaign} {rule} {country} {region} {city} {device} {os} {lang} {referrer} {sub1}…{sub5} {date} {ts} and more are substituted per click and URL-encoded. An unknown macro is left in place rather than blanked, so typos are visible instead of silent.
• Conversion postbacks. An endpoint your network calls when a sale lands. Idempotent on click ID and transaction ID, because networks retry constantly and a retry must not double-count. Handles approved, pending, rejected and chargeback, and a reversal subtracts what it paid.
• Reports. Clicks, uniques, conversions, conversion rate, payout and EPC, grouped by day, hour, campaign, rule, destination, country, region, city, device, OS, language, referrer, sub1–sub5 or action, over any date range, with bots excluded by default.
• Unique clicks without cookies. A per-day visitor hash: an HMAC of IP, user agent, date and your secret. It cannot be reversed into an address and it does not follow anybody past midnight.
• Retention that does not run away. Finished days roll into a one-row-per-day summary and their raw click rows are deleted, so headline history survives but the log cannot grow without bound.

Four ways to fire it

The engine is the same in every mode; only the delivery changes. If no rule matches, the visitor is left alone and your page renders normally.

• PHP include. One line at the top of any PHP page gives a real HTTP 302 and a genuine first-party cookie.
  <?php include '/home/you/public_html/go/redirect-manager.php'; ?>
• JavaScript — ?mode=js, for pages you cannot put PHP into.
• SSI — ?mode=ssi, for .shtml pages.
• Remote resolve — ?mode=resolve. A small helper on any of your other servers forwards the visitor's real signals, gets the routing decision back as data, and does the redirect itself. One rule set governing sites on different hosts.

What a click actually costs

Four SQL statements, measured with the MariaDB general log: the denylist check, the rule select, one batched counter update, and the log insert. Geo readers are built once per request and reused rather than reopening database files on every lookup, and region and city are only resolved when a destination asks for them by macro. Version 17 was a correctness and performance release on purpose — round-robin advances in a single atomic statement so two simultaneous clicks cannot be handed the same slot.

Security

• The dashboard sits behind a private gate token of your choosing, compared in constant time. Unauthorised hits get a plain 404 rather than a login form advertising that there is something here.
• Every query is a PDO prepared statement. Report grouping comes from a fixed whitelist, because an identifier cannot be bound and no caller string should ever reach the SQL.
• Destination URLs are stripped of control characters on save, validated as absolute http or https, and re-checked at redirect time — so a stray newline can never be smuggled into a Location: header.
• Proxy headers are ignored unless you explicitly say you sit behind a proxy you control.

System requirements

• PHP 8.1 or newer, with PDO and the MySQL driver.
• MariaDB or MySQL. Three tables, created automatically on first load.
• Apache or Nginx. No mod_rewrite needed unless you want pretty URLs.
• Optional: MaxMind GeoLite2 or IP2Location databases for country, region, city and ASN matching. Without them the geo rules simply never match and everything else keeps working.

It is genuinely one file. No Composer, no build step, no framework. Upload it, fill in the config block at the top, open the dashboard once and the tables create themselves.