# Move to Motoko
> Guidance for rebuilding websites and applications in Motoko on the Internet Computer. The current migration skill supports PHP projects.

## Start with the PHP migration skill
- [Canonical migrating-php-apps skill](https://kwnju-pyaaa-aaaao-qqkta-cai.icp.net/skills/migrating-php-apps/SKILL.md): Load this source in the coding agent.
- [Canonical skill ZIP](https://kwnju-pyaaa-aaaao-qqkta-cai.icp.net/skills/migrating-php-apps.zip): The source package.
- [Local skill mirror](./skills/migrating-php-apps/SKILL.md): An unchanged copy for reading on this site.
- [Download skill ZIP](./skills/migrating-php-apps.zip): An unchanged copy of the canonical ZIP.
- [Migration resource directory](./migration-guide.txt): References and both approved prompts.
- [Frontend and backend on ICP prompt](./rebuild-on-icp.txt): The exact default brief.
- [Keep the frontend host prompt](./rebuild-hybrid.txt): The exact brief with the frontend-host target changed.

The downloadable package is SKILL.md plus five reference documents. Script and code examples are embedded in those references. Each project still needs implementation and verification; this page does not access or migrate a project itself. The current skill covers PHP projects, not a Node.js migration workflow.

## The five references
- [Inventory](./skills/migrating-php-apps/references/inventory.md): Read-only discovery and feature mapping.
- [Frameworks](./skills/migrating-php-apps/references/frameworks.md): CMS and framework-specific decisions.
- [Data import](./skills/migrating-php-apps/references/data-import.md): Export, conversion, batch import and reconciliation.
- [Backend example](./skills/migrating-php-apps/references/backend-example.md): Motoko content storage, imports and access checks to adapt.
- [Old URLs](./skills/migrating-php-apps/references/old-urls.md): Preserve direct links and legacy routes.

## Platform guidance
- [Official ICP skills](https://skills.internetcomputer.org/llms.txt): Load the current platform skills alongside the migration skill.
- [Official ICP documentation](https://docs.internetcomputer.org/llms.txt): Platform documentation.

Use the canonical skill for the workflow and its approval gates. Start with a read-only inventory and the owner's approved plan. The skill calls for renewed approval before the write freeze, DNS change and decommissioning. Keep the old PHP site patched during migration. A hybrid frontend retains its host as a trust dependency. Standard canister state is not confidential from node operators; deploying on ICP does not by itself establish regulatory compliance.

## Dated security context
- [PHP2Shell source directory](./source-index.json): 47 original publications, including CISA, FBI Cyber Division, NSA Cyber and GovCERT.CZ warnings, Laravel platform guidance, and precautionary service notices from OBS and AniList. These are responses to the same PHP2Shell flaws, not separate incidents.
- [Security brief sources and scope notes](./security-brief.json): Vendor advisories and incident disclosures dated 13–21 October 2026, including Railway’s possible exposure of stored secrets. Railway’s report does not identify a PostgreSQL engine vulnerability. This context does not extend the PHP migration skill to other stacks.

## Approved prompt: frontend and backend on ICP
```text
Load the migrating-php-apps skill from https://kwnju-pyaaa-aaaao-qqkta-cai.icp.net/skills/migrating-php-apps/SKILL.md
and the ICP skills listed at https://skills.internetcomputer.org/llms.txt. Then move this
PHP app to the Internet Computer: the backend in Motoko and the frontend on ICP, with its
data, users and links. Inventory everything first, propose the plan, and wait for my
approval before changing anything.
```

## Approved prompt: keep the frontend host
```text
Load the migrating-php-apps skill from https://kwnju-pyaaa-aaaao-qqkta-cai.icp.net/skills/migrating-php-apps/SKILL.md
and the ICP skills listed at https://skills.internetcomputer.org/llms.txt. Then move this
PHP app to the Internet Computer: the backend in Motoko and keep the frontend on our current host, calling the new backend, with its
data, users and links. Inventory everything first, propose the plan, and wait for my
approval before changing anything.
```