Introduction

Features

Complete feature matrix and capabilities of GO Shortener.

GO Shortener provides a comprehensive set of features divided into visitor tiers, security mechanisms, and administrative tooling.

Visitor Tiers & Quota Comparison

Feature	Anonymous Visitors	Registered Users	Administrators
Account Required	No	Yes	Yes (Super Admin / Moderator)
Link Creation Quota	15 links / 24 hours	100 links / calendar month	Unlimited
Max Expiration Period	7 days	Up to 1 year	Unlimited / Permanent
Available Expiration Options	1h, 1d, 3d, 7d	1h, 1d, 7d, 30d, 3m, 6m, 1y	Custom / Permanent
Personal Dashboard	❌	✅	✅
Link Search & Pagination	❌	✅	✅
Renew Expired Links	❌	✅ (Preserves Short Code)	✅
Permanent Link Request	❌	✅ (Submitted for Review)	✅ (Direct Approval)
Aggregate Click Analytics	❌	✅	✅
Soft Delete Links	❌	✅	✅

Random Identifiers: Generates cryptographically secure 6-character random tokens using alphanumeric characters.
SSRF & Recursion Shield: Actively inspects submitted target URLs to prevent server-side request forgery (blocks 127.0.0.1, RFC1918 subnets, cloud metadata 169.254.169.254, self-domain loops, and hazardous protocols like javascript:, file:, data:).
HTTP 302 Redirection: Rapid non-caching redirects ensuring real-time click counting.
HTTP 410 Gone on Expiry: When a link expires, it returns a styled 410 Gone page rather than a generic 404, with instructions for the original owner to renew it.

Local Credentials: Strong password hashing using bcrypt at computational work cost 12.
Google OAuth Integration: Native Google sign-in using Firebase Authentication tokens with automatic email linking to avoid account duplication.
Session Security: Session tokens issued as encrypted cookies configured with HttpOnly, SameSite=Lax, and Secure attributes.
Zero Hardcoded Admin: First user to register automatically claims the super_admin role.

Aggregated Telemetry: Total clicks, daily/weekly/monthly trends, device type (Desktop, Mobile, Tablet), browser distribution, OS distribution, and top referring domains.
Zero Raw IP Storage: Visitor IP addresses are immediately hashed with SHA-256 and a secret salt before write operations.

Cloudflare Turnstile: Drop-in CAPTCHA verification for registration and anonymous link creation. Fully configurable and toggleable via environment variables.
Public Abuse Reporting: Visitors can submit abuse, phishing, or malware reports against any short link via /report.

System Metrics: Real-time counter metrics for total links, active users, total clicks, and pending queues.
User Moderation: Filter users, promote/demote roles, apply timed suspensions (30 seconds up to 7 days), or issue permanent bans with automatic bulk deactivation of the user's links.
Super Admin Immutability: Built-in guardrails strictly prevent moderators from modifying or banning super_admin accounts.
Audit Logging: Logs authorization failures, admin route access attempts, and authentication anomalies with hashed IP and User-Agent telemetry.

What is GO?

An overview of GO Shortener, its core philosophy, and design architecture.

Installation

Install GO Shortener on an Ubuntu VPS or standalone Linux host.