Imperial Hackers Online – Readme.md

As this repo is currently private, I wanted to share the thinking and logic I put in the game below. Remember I did a fork from my Imperial Barons Online game to create this one with a different level of game play. While some of this is similar, there are also many differences in this game. Both Imperial Barons and Imperial Hackers has been inspired by an old 1990's game called Trade Wars 2002, but after 35+ years since I last played that game, much of my memory of that game is not present. I had to re-imagine this game with inspiration using old BBS Turn Based style game play. See the disclaimers below.

# Imperial Hackers Online

**A turn-based hacking, data-trading and conquest game for WordPress.**

The Imperium Hackers Group has opened its frontier to novice hackers on the colony planet

Cryptara Prime. The planet's systems are networked through hubs and routes, and every system holds

a wealth of information. Hack it, sell it, build a criminal empire of buildings full of scammers,

and climb from humble Vagrant to Imperial Hacker.

> **Please note:** Imperial Hackers Online is a fictional computer game built around the themes of

> trading and hacking. No real hacking takes place: every system, network, tool and piece of data in

> it is made up, and nothing in the game touches any real computer or account.

Imperial Hackers Online is played entirely in the web browser through ordinary WordPress pages.

There is nothing to download and no terminal emulator to configure: players sign in to your

WordPress site and play.

---

## Inspiration and attribution

Imperial Hackers Online is a sister game to **Imperial Barons Online**, the space trading game by

the same author, and runs on the same engine: the same turns, trading, haggling, exploring,

empire-building and combat, retold as a hacker game on one networked planet. Where a Baron flew a

ship between ports in sectors, a hacker routes a computer between systems in subnets.

Both games draw their inspiration from **Trade Wars 2002**, the classic BBS "door" game, but each is

a **completely new game** with its own setting, names, rules and code. Neither contains code, text or

artwork from Trade Wars 2002, and neither is affiliated with or endorsed by its creators or rights

holders. *Trade Wars* is a trademark of its respective owner.  

**This game is totally new!**

Similar to trading games, it has new style of play and rules.  A modernized approach using

Cyber Security Engineering terms for Red Team offensives, and Blue Team type defenses.

This is a turn based game, so a player only gets so many turns a day to decide

to build up their player skills,  hack on a subnet for data bounty, or hack another player

to get some of their wealth.      A Team Play allows players to team up and go after other teams

as a group.

---

## Disclaimer: install and run at your own risk

**You install and run this plugin entirely at your own risk. The author accepts no responsibility

or liability for any loss, damage or compromise that results from using it.**

Every effort has been made to write it safely: player actions are checked on the server, forms are

protected against cross-site request forgery, database queries are prepared, output is escaped, and

administrative functions require WordPress administrator rights. Even so, new vulnerabilities are

discovered in software of every kind every day, and no website can be guaranteed secure. This

software is provided **as is, without warranty of any kind**, as set out in the

[GNU General Public License v2](LICENSE), under which it is released.

Before installing it on a site you care about:

- **Test it first** on a staging or local site rather than a live one.

- **Back up your database and files**, and keep doing so. Network Founding and the Reset tool

  both erase game data permanently, and that cannot be undone.

- **Keep WordPress, PHP, your theme and every plugin up to date**, and serve the site over HTTPS.

- **Protect player accounts.** The game relies on WordPress for registration, login and passwords,

  so secure those as you would on any site, for example with an anti-bot plugin on the registration form.

- **Read the code.** It is open source precisely so you can audit it, and change it, before trusting it.

If you find a security problem, please report it privately by email to

**sysop@maddogproductions.online** rather than opening a public issue. See [SECURITY.md](SECURITY.md)

for what to include and what happens next.

---

## The goal

You start as a **Vagrant** in Aurelia (subnet 001) with one meagre computer, a Scrapdeck 386 with

30 datacrons of storage, and a few thousand credits. Your aim is to rise through the ranks to

**Imperial Hacker** and become the most powerful hacker on the planet.

### Objectives

- **Build a fortune:** follow the routes between subnets, hack data out of DataHouses and sell it

  to Syndicates. **Net worth**, which counts your credits, vaults, computer, data, Room and

  buildings, is the main measure of success.

- **Earn your title:** gain experience by hacking, selling, haggling, exploring and fighting, and

  climb the ranks: Vagrant, Script Kiddie, Zapper, Lurker, Phreaker, Packet Rat, System Cracker, PC Baron,

  Netrunner, Root Knight, Shadow Count, Cipher Lord, Duke, Grand Duke of Data, Archon of the Net,

  and finally Imperial Hacker. Selling data earns the most.

- **Explore the Cryptara Prime net:** chart subnets, systems and routes to find the most valuable

  data and the best places to sell it.

- **Build a hacked empire:** claim buildings or set up Shell Companies, staff them with scammers who earn credits,

  and fortify them with a Security Stack, security bots and honeypots.

- **Command your empire:** assign security bots to defend your buildings, carry honeypots to protect your computer, and defeat Colonial Counter Hack Team defences,

  Federal Security Forces raids and rival hackers.

The **Rankings** page shows who leads the net in net worth, experience and combat. Each hacker

receives **75 turns a day** (configurable), so the best hackers plan carefully and make every turn

count. Team play is not part of this game.

---

## Requirements

- WordPress 5.8 or later

- PHP 7.4 or later

- MySQL 5.7+ / 8.x or MariaDB 10.3+ (the standard WordPress database)

Works with both classic and block themes (tested with Twenty Twenty-Five).

---

## Installation

> Standing up a whole board rather than adding one game to an existing site?

> [Setting up WordPress for a BBS Experience](docs/setup-bbs-on-wordpress.md) covers it end to end.

1. **Install the plugin.** Copy the `imperial-hackers-online` folder into your site's

   `wp-content/plugins/` directory, or zip the folder and upload it under

   **Plugins → Add New → Upload Plugin**. Installing straight from a clone of this repository

   works too, but read [Installing from the repository](#installing-from-the-repository) first:

   a clone carries a `.git` directory that does not belong on a web server.

2. **Activate it.** In **Plugins**, activate **Imperial Hackers Online**. Activation creates the

   game's database tables (`wp_ib_*`) and schedules the hourly and daily maintenance jobs.

3. **Found the network.** Go to **Imperial Hackers Online → Network Founding**. Review the

   options (the defaults of 500 subnets, 40% systems and 12% buildings suit 75 turns a day), tick the

   warning box, type `FOUND`, and click **Found the network**. Then click **Validate network**; every

   line should report OK.

   > Founding a network erases any existing network **and all hacker data**. Only do this to start

   > a new game.

4. **Create the game pages.** Go to **Imperial Hackers Online → Dashboard** and click

   **Create pages & menu**. This creates the game pages below, each containing its shortcode,

   and a site menu holding a single **Imperial Hackers Online** link to the home page. Players move

   between game pages with the in-game navigation bar, so the menu never lists the other pages.

   **Assign menu to theme location** decides where that link appears: *Don't assign* (the default),

   one of your theme's menu locations, or, on block themes such as Twenty Twenty-Five, *Theme header*,

   which creates a matching block navigation menu.

5. **Let players in.** The home page is public: visitors who are not signed in see an introduction,

   the full How to play guide (the goal, objectives and rules) and the current standings, with

   buttons to sign in or create an account. The **How to Play** page is public too, and its

   shortcode `

` can be dropped into any post or page of your own, as can Imperial Hacker

   News's `

`. The other game pages

   stay private.

6. **Accounts.** Only logged-in WordPress users can play, and each account gets one hacker.

   Other players see only the hacker name, never the WordPress username. Either create user

   accounts yourself, or enable **Settings → General → Anyone can register** (with the new-user role

   left as *Subscriber*). If registration is open, protect the registration form from bots with an

   anti-bot plugin such as *Simple Cloudflare Turnstile*. Players sign in, open

   the **Imperial Hackers** page, and create a hacker.

7. **Set up cron** so the hourly and daily game jobs run on time. See

   [Scheduled maintenance (cron)](#scheduled-maintenance-cron) below.

8. **Optional: tune the game** under **Imperial Hackers Online → Settings**: turns per day, turn

   costs, starting credits and storage, prices, system regeneration, raid chance and more.

### Game pages

Pages are listed in the in-game navigation order. Titles carry an "Imperial Hackers - " prefix so the game's

pages stand out in the WordPress Pages list.

| Imperial Hackers - How to Play | `imperial-hackers-online-how-to-play` | `

` |

| Imperial Hackers - FAQ | `imperial-hackers-online-faq` | `

` |

If you create pages by hand, keep these slugs; the plugin finds pages by slug.

### Widgets: putting the news in a sidebar

Every shortcode above also works in a **widget**, a **post** or any page of your own, which makes

Imperial Hacker News a good advertisement for the game: visitors see a net in motion, and it needs no

account to read. Add a **Shortcode** block (or a page builder's Shortcode element) to a sidebar or

footer and paste:

```

```

`limit` sets how many dispatches to show (60 on a page, 20 when compact, 200 at most), and `compact`

renders a plain list sized for a narrow column, with no game title, status bar, navigation or footer.

The rankings work the same way for a sidebar, and are public in compact form:

```

```

`by` is `networth` (the default), `experience`, `kills` or `crews`; `limit` is 10 by default, 50 at

most. Compact shows a table (#, Hacker, Rank, Crew, Computer, Experience, Alignment, Kills, Net

worth; or the crew columns for `crews`), with a horizontal scroll in a narrow column. Without

`compact` the shortcode is the full, signed-in Rankings page.

`

` is a public FAQ page answering the questions hackers ask most (defending, attacking,

honeypots, security bots, scammers, a new hacker's strategy); add questions in

`includes/frontend/views/faq.php`. `

` is the other useful public shortcode, for a "how to play" post or landing page.

### Scheduled maintenance (cron)

The game relies on two scheduled jobs:

| Job | When | Does |

|---|---|---|

| Hourly | every hour | systems restock, scammers pay into vaults and recruit security bots and set up honeypots, the Colonial Counter Hack Team regenerates and roams |

| Daily | midnight (site timezone) | turns reset, scammer crews grow, old news and read mail are purged |

#### Why a real cron job is needed

On activation the plugin schedules both jobs with **WP-Cron**, WordPress's built-in scheduler.

WP-Cron is not a real clock: it only runs when someone visits the site. On a quiet site, systems may

not restock and buildings may not earn for hours at a time. For a live game, add a **real cron job**

on your server, from your hosting control panel or the server itself.

**Running WP-Cron and a real cron job together is safe.** Each job takes a database lock before it

does anything, so only one run of a kind happens at a time no matter what started it, and a run that

arrives while another is working stands down rather than repeating it. Each job also refuses to run

twice in the same period. You do not need to set `DISABLE_WP_CRON`, which many shared hosts do not

allow anyway.

Two more safeguards:

- **Turns** reset the first time each hacker visits on a new day, even if cron never runs.

- **You can run either job at any time** from **Imperial Hackers Online → Maintenance**, which also

  shows each job's last and next run.

> **Tip:** the Maintenance screen prints all of the commands below with your site's real URL and

> paths filled in, ready to copy into cPanel or a crontab.

#### Recommended: trigger WordPress's scheduler every 5 minutes

This runs *all* of your site's scheduled tasks on time, including this game's jobs, update checks and

scheduled posts, and WordPress works out the site timezone itself. Schedule this every 5 minutes,

replacing `https://example.com` with your site's address:

```bash

curl -s "https://example.com/wp-cron.php?doing_wp_cron" > /dev/null 2>&1

```

Use `wget -q -O - "https://example.com/wp-cron.php?doing_wp_cron" > /dev/null 2>&1` if the host has no

`curl`, or, where WP-CLI is installed, `cd /path/to/wordpress && wp cron event run --due-now`.

#### Alternative: run the game's scripts directly

Use this if your host blocks cron from making web requests, or you want the game's jobs on their own

schedule. Run the first hourly and the second once a day at your site's midnight:

```bash

php /path/to/wordpress/wp-content/plugins/imperial-hackers-online/maintenance/hourly_maintenance.php

```

```bash

php /path/to/wordpress/wp-content/plugins/imperial-hackers-online/maintenance/daily_maintenance.php

```

These run only the game's jobs, so keep the 5-minute job as well where you can, to keep WordPress's

own tasks running.

> **Server time vs. site time:** cron schedules use the *server's* clock, which is often UTC, while

> the game uses the timezone in **Settings → General**. For the daily script, set the hour that matches

> your site's midnight: a US Eastern site on a UTC server would use 05:00 (04:00 in daylight saving

> time). The 5-minute job needs no such adjustment.

#### Setting it up on common hosts

**cPanel** (most shared hosting):

1. Log in to cPanel and open **Advanced → Cron Jobs**.

2. Under **Add New Cron Job**, choose **Once Per Five Minutes** from *Common Settings*

   (for the game's own scripts choose **Once Per Hour** and **Once Per Day** instead).

3. Paste the command into **Command** and click **Add New Cron Job**.

4. Paths in cPanel usually look like `/home/YOUR-CPANEL-USER/public_html/...`, and command-line PHP

   is usually `/usr/local/bin/php`. The Maintenance screen prints both filled in for your site.

**Plesk:**

1. Open **Websites & Domains → Scheduled Tasks → Add Task**.

2. Choose **Fetch a URL** and enter `https://example.com/wp-cron.php?doing_wp_cron`, or choose

   **Run a PHP script** and select one of the game's maintenance scripts.

3. Set the schedule (every 5 minutes, hourly or daily) and click **OK**.

**Linux server or VPS (crontab):**

1. Run `crontab -e` as the user that owns the WordPress files (often `www-data`:

   `sudo crontab -u www-data -e`).

2. Add the lines you need, then save:

   ```

   # every 5 minutes: runs everything WordPress has scheduled

   */5 * * * * curl -s "https://example.com/wp-cron.php?doing_wp_cron" >/dev/null 2>&1

   # optional: the game's own jobs, hourly at minute 0 and daily at 05:00 server time

   0 * * * * /usr/bin/php /var/www/html/wp-content/plugins/imperial-hackers-online/maintenance/hourly_maintenance.php >/dev/null 2>&1

   0 5 * * * /usr/bin/php /var/www/html/wp-content/plugins/imperial-hackers-online/maintenance/daily_maintenance.php >/dev/null 2>&1

   ```

3. Find the PHP path with `which php` and adjust the WordPress path to your install.

**Windows server (Task Scheduler):**

1. Open **Task Scheduler → Create Basic Task**.

2. Set the trigger to **Daily**. In the task's properties, under **Triggers → Edit**, tick

   **Repeat task every** and choose 5 minutes (or 1 hour for the game's hourly script).

3. For the action choose **Start a program**: either `curl.exe` with arguments

   `-s "https://example.com/wp-cron.php?doing_wp_cron"`, or `C:\path\to\php.exe` with the full path

   to a maintenance script as the argument.

**Managed WordPress hosts** (WP Engine, Kinsta, SiteGround and others) often already run a real

cron for WordPress, or offer a switch for it. Check your host's documentation before adding your own.

**Local development** (e.g. Local by Flywheel): no setup is needed. WP-Cron runs as you browse,

and you can use the **Run now** buttons on the Maintenance screen.

#### Checking that it works

Open **Imperial Hackers Online → Maintenance**. After an hour or so, **Last run** for the hourly

job should keep advancing. Running a maintenance script by hand in a terminal prints what it did,

or *"skipped: it already ran…"* if the job already ran this period, or *"already running elsewhere"*

if another run currently holds the lock.

The same screen keeps a **Cron Maintenance Log**: one line per job per day for the last ten days,

showing the time the job ran, what started it (WP-Cron, *Run now by* whoever pressed the button, or

Server cron), what it did, and how many times it was started that day. Starts that found the work

already done are counted but never replace the run that did it, so a busy 5-minute cron shows a high

count beside the one run that mattered. The log is kept in the `ih_cron_log` option and is removed

when the plugin is deleted.

### Installing from the repository

The released zip and the repository hold the same plugin, so a clone or a GitHub **Download ZIP**

runs the game perfectly well. Two things are worth knowing before you put one on a live site.

**The folder gets a different name.** GitHub's zip unpacks as `Imperial-Hackers-Online-main`, and

WordPress installs the plugin under that name. Nothing in the game depends on the folder name, so it

works — but WordPress treats `Imperial-Hackers-Online-main/imperial-hackers-online.php` and

`imperial-hackers-online/imperial-hackers-online.php` as two different plugins, and installing the

other one later gives you two copies, two sets of scheduled jobs and one shared set of tables.

Rename the folder to `imperial-hackers-online` before you activate it, and stay with that name.

**A clone carries files a web server should not serve.** Chiefly `.git`, which holds the project's

entire history: on a public site anyone who knows the path can walk it. (GitHub's **Download ZIP**

is an export rather than a clone, so it has no `.git` in it; this applies to a working copy you

cloned or copied from your own machine.) The plugin ships an

`.htaccess` that refuses `.git`, `*.sql`, `*.md`, logs and editor leftovers, and every directory has

an `index.php` so nothing can be listed — but `.htaccess` is read by Apache only. On nginx, put this

in the server block:

```nginx

location ~ /wp-content/plugins/.*/\.(git|svn)(/|$) { deny all; }

location ~ /wp-content/plugins/.*\.(sql|md|log|ya?ml|lock)$ { deny all; }

```

The surest fix is not to deploy `.git` at all: build a zip from the repository as below, or run

`git archive` straight onto the server. The plugin also checks itself: **Imperial Hackers Online →

Dashboard** has an *Install health* panel, and an administrator sees a notice on the Plugins screen,

if the folder is misnamed, if a `.git` directory is present (it tests whether your server actually

serves it), if a second copy of the plugin is installed, or if any file or directory is present that

this version does not ship. That last check works from a manifest of what a release contains rather

than a list of known rubbish, so it catches whatever is actually there: the rest of the `.git`

family, `.github`, `node_modules`, a `.bak` someone made in place, a file left behind by an older

version that the new one no longer has, or a script that has no business being there at all. The

build script compares the manifest against what it packs and refuses to build if the two have

drifted, so the list cannot quietly go stale. Nothing else in the tree is sensitive — the PHP files all

refuse to run unless WordPress loaded them, the scripts in `maintenance/` refuse to run over the web

at all, and the table schema lives in a PHP file for the same reason, so it cannot be fetched either.

### Building a release zip

There is no build step: no compiler, no bundler, no dependencies to install. The plugin is the

source, and there are three ways to package it.

#### Building it with git

To produce the same zip that is published for a release, from a clone of the repository:

```bash

git archive --format=zip --prefix=imperial-hackers-online/ -o imperial-hackers-online.zip HEAD

```

That gives a zip whose single top-level folder is `imperial-hackers-online`, which is what

**Plugins → Add New → Upload Plugin** expects. It takes the files from the last commit, not the

working tree, so uncommitted edits are left out, and `.gitattributes` keeps development-only files

(`.gitignore`, `.gitattributes`, `.github`) out of the archive. On Windows, the same command works in

Git Bash or PowerShell wherever `git` is on the path.

#### Building it with PHP, without git

If git is not installed, or you are on Windows without a `zip` command, `tools/build-zip.php` does

the same job with nothing but PHP:

```bash

php tools/build-zip.php

```

That writes `imperial-hackers-online-<version>.zip` next to the plugin folder, taking the version

from the plugin header, and prints the path, the file count and the size. Pass a path to put it

somewhere else:

```bash

php tools/build-zip.php /path/to/imperial-hackers-online.zip

```

It needs PHP's `zip` extension, which is standard on hosting but is sometimes switched off in a

command-line PHP on Windows; the script says so plainly and stops if it is missing. It packs the

**working tree**, uncommitted edits included, which is the difference from `git archive` — useful

while testing a change, and worth remembering when cutting a release. It skips `.git`, `.github`,

`.gitignore`, `.gitattributes`, `tools/`, `node_modules`, `vendor`, editor leftovers and any zips

or logs lying about, and it produces the same file list as the `git archive` command above.

The script refuses to run over the web, as do the maintenance scripts, and `tools/` is left out of

both builds, so it never reaches an installed site.

#### Zipping the folder by hand

```bash

cd .. && zip -r imperial-hackers-online.zip imperial-hackers-online -x '*/.git/*'

```

Whichever you use, the zip should contain one top-level folder named `imperial-hackers-online` with

`imperial-hackers-online.php` directly inside it, and no `.git` directory.

### Updating and uninstalling

- **Updating:** replace the plugin folder with the new version. Database changes are applied

  automatically on the next page load.

- **Deactivating** stops the scheduled jobs but keeps all game data.

- **Deleting** the plugin from the Plugins screen removes all game tables and settings.

---

## How to play

*This is a fictional game about trading and hacking; no real hacking is involved.*

- **Turns.** Only three actions cost turns: following a route to another subnet (1 a hop),

  connecting to a system (1, charged once, after which spending, selling and haggling are free until

  you leave) and attacking (1). Entering buildings, Assign and Remove, Security Stack levels, Shell Companies, the

  Scanner, the Map and messages are all free. Turns reset at midnight (site time) and do not carry

  over; every game page shows a bar with the turns you have left.

- **Data classes.** Data is the commerce, and it takes up storage. From lowest to highest value:

  **Class 1, Private Data**; **Class 2, Consortium Secrets**; **Class 3, Imperial Data**.

  **Crypto Vaults** are the rare find, worth several times Imperial Data, with small stocks; they are

  scarce near Aurelia and more common on the frontier.

- **Systems: DataHouses and Syndicates.** A system's class is three letters for Data Classes 1, 2

  and 3: **S** where it sells (you *Connect and Hack*, spending credits to load the data into

  storage) and **B** where it buys (you *Connect and Sell*). A system that mostly sells is a

  **DataHouse**, one that mostly buys is a **Syndicate**, and a **+R** after the letters means it

  also deals in Crypto Vaults, as in *System Salted Hash Exchange BSB +R*. Every system has a

  random cyber-security in-joke for a name. Prices follow stock, several Syndicates may compete for

  the same data, and systems restock every hour.

- **DataHouses do not trade.** A DataHouse's S classes are **Available**: data waiting to be

  stolen. It never buys anything, so the classes it does not have show as a dash (`SS-`).

  Buying and selling data happen only at Syndicates. You **Take** it for a fixed **cost effort** in credits (the market price less 65% by default, an admin setting), with no haggling, as much as your

  hacking tool allows. Syndicates are the real market, where data is bought, sold and haggled over.

- **Two ways to build wealth.** Trading stolen data between Syndicates pays if you buy low from one

  and sell high to another. Taking the data straight from a DataHouse makes even more profit, since

  you pay only the cost effort and then sell it to a Syndicate.

- **Haggling.** Only Syndicates haggle. Offer a better price than the system lists. The sysop may accept (bonus

  experience), counter-offer, or refuse to haggle with you for an hour if you push too hard.

- **Aurelia and the shops.** The **Imperial Store** in Aurelia (subnet 001) sells storage, security

  forces, honeypots and network charts, and recruits scammers (so does **Aurelia Prime**, the Crown

  building in the same subnet, if you enter it). The **Imperial Network Building** also sells seven

  computer system types, from the Scrapdeck 386 to the Quantum Throne, and Shell Companies; Imperial

  Hacker News gives its location.

- **Your Room.** Every hacker has a Room at Aurelia Prime. Scammers, security bots, honeypots

  and Shell Companies wait there until they are dropped in a building: they take no storage, but they

  cost credits, count toward net worth at their price, and losing them takes that value away. Inside

  a building you own, **Assign** sends them from the Room to the building and **Remove** sends them

  back; a computer has no transport, so the assignment is made from the Room. Your computer runs up

  to its type's limit of security bots and honeypots from the Room to defend itself.

- **Exploits and heat.** Each DataHouse connection names the exploit you used to get in ("Zero found

  an exploit, Pivoting Gateway, and was able to hack into Hunter2 Data Vault"). Connect to the same

  DataHouse more than twice in 24 hours and each extra visit adds 15% to the chance of being caught

  and kicked off with no datacrons, even in the Imperial Core. Both numbers are admin settings.

- **Hacking tools.** Each time you connect to a DataHouse, a tool is rolled: the

  **System Scanner** (most often) lets you fill half your storage on that connection, the **MD

  Exploit Tool** three quarters, and the rare **RE Shell** all of it, plus bonus experience. Storage

  is measured in **datacrons**: one datacron holds one unit of data.

- **Exploring.** Your computer scans every neighbouring subnet as you arrive. First visits beyond the

  Imperial Core earn experience and may turn up an unsecured data dump, a forgotten crypto wallet,

  abandoned security bots or an old network map, or cost you: an intrusion detection system wipes

  data, an Imperial auditor takes the Imperium's cut, and a juicy-looking server can be a Colonial Counter Hack Team

  honeypot. Network charts reveal whole zones of the net.

- **Running data.** On the Systems page, **Where to sell this data** lists the charted systems that

  buy what is in storage, best payout first, with the turns the trip costs; **Route & Connect** routes

  you there and connects when you arrive. The subnet number does the same wherever a system is listed.

- **The Scanner.** The planning page: route to any subnet and see the path and its risk before you

  commit, Auto-Route there, use the System finder to see where to hack or sell each data class, and

  check where your security bots are deployed.

- **Buildings.** Claim unowned buildings or set up new ones with Shell Companies. Scammers earn credits

  every hour, paid into the building's vault, turn up the three data classes from their exploits

  (stored in the building until you Download them into storage, as Barons planets stockpiled goods),

  and recruit security bots and honeypots (1 honeypot a day per 1,000 scammers); a crew grows 2% a day (a setting) up

  to the building's capacity. Output is quoted per 1,000 scammers a day and scaled by the **Building

  output** setting, 120% by default, plus 10% for every Security Stack level. Your scammers build up a

  **Security Stack** (levels 1 to 6): the first adds a **Firewall & Vault** you can deposit your own credits in, and

  level 3 adds a hack-back system. Credits in vaults are safe if your computer is lost.

- **Two kinds of security.** The Colonial Counter Hack Team is private security, hired to guard the

  systems; the Federal Security Forces are the law, and they come to seize your computer.

- **Colonial Counter Hack Team detection.** Outside the Imperial Core, a Colonial Counter Hack Team defensive tool (an

  Intrusion Detection Sentinel, a Packet Sniffer, a Canary Token and others) can spot you on any

  connection or route hop. You are kicked off at once: the turn is lost, nothing is gained, and a

  fine of a few percent of your credits on hand is taken (5% chance and 3% fine by default), and

  one honeypot is burned (never the last one).

- **Federal Security Forces raids.** You are the raider now. Outside the Imperial Core, any route hop

  or connection can draw a raid, more often the further you are from Aurelia. Honeypots are decoys

  that send the raid after fake computers, so the more you carry, the better your chance to slip away

  untouched. If they find you, the raid has to burn through your remaining honeypots; if it gets

  past them, your computer is seized. Security bots never defend a computer in a subnet: they

  are assigned to buildings only.

- **Crews (team play):** hackers form or join a crew with a password. Crewmates share buildings

  (they can add to each other's, but only the owner takes anything out) and honeypot fields, cannot attack each other, chat on a crew channel and rank together by

  combined net worth and pwns (rival computers taken down). The leader can remove members, hand over the lead or disband.

  Safeguard: crews open once 12 hackers have played in the last 7 days, and a crew holds at most a

  third of the active hackers (up to the max crew size), so there is always a rival crew.

- **Vending machines:** every 1,000 scammers need a stocked vending machine (500 credits at the

  Imperial Store or Network Building, 100 a day to restock plus 10% per Security Stack level, paid from the building's

  supply fund only by default; a setting lets the vault pay too). Owners are warned when a fund covers

  fewer than 3 days.

  Crews only grow as far as their machines can feed. A building short of machines stops growing, and after a 3-day grace its unfed scammers walk

  out, 5% a day. All of it is in Settings.

- **Building wealth:** with the data fence on (the default), a building sells the data its scammers

  turn up every hour at 50% of base price, straight into its vault. Vaults can be drawn on from

  anywhere on the My Computer page, and owners get a daily

  earnings message.

- **Sieges:** another hacker's building can't be taken in one sitting. The first attack starts a

  siege; the building can only be claimed after the siege window (24 hours by default) and never on

  the same day, so the owner has time to reinforce it.

- **Holding subnets:** hackers deploy honeypots, not security bots, to hold a subnet. A defensive

  field claims it; an offensive field also springs on rival computers routing in. Rivals clear a

  field by attacking it with security bots.

- **Hacker against hacker.** Outside the Imperial Core you can attack a rival's computer or

  building. Taking down a computer loots a share (25% by default) of the credits they carry and of

  the data in their storage, as far as your storage allows; vaults are out of reach. That goes

  further than Barons, where destroying a ship paid nothing. Breaking a building's defences lets you

  claim it with its vault, scammers, data and Security Stack.

- **Danger.** The Imperial Core (subnets 001–010) is safe. Beyond it roam six Colonial Counter Hack Team divisions (the Cobalt

  Wardens, Aegis Watch, Sentinel Corps, Script Sentinels, White Hat Institute and Bug Bounty League)

  as well as rival hackers. If your computer is destroyed or seized you return to Aurelia on a fresh

  Scrapdeck 386 and cannot hack until tomorrow, exactly like a ship loss in Imperial Barons: the

  computer, its data and your Room are lost; credits, rank, buildings and vaults are kept.

- **Imperial Hacker News.** A public news page, readable without an account: DataHouse hacks (who found which exploit and broke into where) and hackers caught in the act, hackers joining,

  buildings claimed and fortified, big scores, computers bought and lost, raids fought off, the Colonial Counter Hack Team

  broken, promotions, and what befalls hackers on the frontier. Its masthead is the `IH_GAZETTE_NAME`

  constant in the plugin's main file. The feed can go anywhere with its shortcode:

  ```

 

                        the full page: a "Today on the net" summary and 60 dispatches by day

 

 a plain list for a sidebar widget; 200 dispatches at most

  ```

The full guide is under **How to play** on the Imperial Hackers home page.

---

## Administration

**Imperial Hackers Online** menu in wp-admin (administrators only):

Dashboard · Network Founding · Settings · Hackers · Systems · Buildings · Maintenance · Logs

Administrators can message every hacker at once: **Send to all hackers** on the in-game Messages page

(when the administrator has a hacker) or on the **Hackers** admin screen. It arrives in every inbox as a

"Sysop announcement".

Destructive actions (founding or resetting the network) require a warning checkbox, a typed

confirmation and administrator rights, and every admin action is recorded in the audit log.

See the `docs/` folder for details.

---

## License

Copyright (C) 2026 Bill Mantz, <https://maddogproductions.online/>

Imperial Hackers Online is released under the **GNU General Public License, version 2 or later**

(GPLv2+), the same license as WordPress itself. The full text is in [LICENSE](LICENSE).

You are free to use, modify and redistribute it, including commercially, provided derivative

works are distributed under the same license and keep the copyright notice. The software comes

with no warranty.

---

## Code layout

```

imperial-hackers-online.php    plugin bootstrap and hooks

uninstall.php                 removes tables and options when the plugin is deleted

.htaccess                     Apache: refuses .git, the schema, docs and logs over the web

index.php                     one per directory, so nothing can be listed or opened directly

SECURITY.md                   how to report a vulnerability, and what is in scope

sql/install-schema.php        database schema (applied with dbDelta and the site's table prefix)

includes/class-ih-core.php    settings, table names, logging, data classes, ranks

includes/class-ih-health.php  warns if the install came from a clone or a branch-named zip

includes/data/                computer system catalogue

includes/services/            game rules: hackers, systems, buildings, combat and raids, discovery,

                              messages, network founding, pathfinder, the Colonial Counter Hack Team, maintenance

includes/frontend/            shortcodes, form action dispatcher, UI helpers, page views

admin/                        wp-admin screens

assets/                       stylesheet and JavaScript (confirmations, network map pan and zoom)

maintenance/                  optional CLI scripts for a system cron

tools/build-zip.php           builds an installable zip with PHP alone (not shipped in releases)

docs/                         admin, database, page and network founding reference

```

### Engine vocabulary

The game shares its engine with Imperial Barons Online, and the code, database columns and page keys

keep the engine's names so the two stay easy to compare. Everything players and administrators see

uses the hacker names.

| In the code | In the game |

|---|---|

| sector, `sector_id` | subnet (shown as three digits, 001) |

| warp | route |

| port, `port_class` 1-8 | system: DataHouse or Syndicate |

| port class 0 / 9 (`ARMORY` / `SHIPYARD`) | Imperial Store / Imperial Network Building |

| dock / undock | connect / disconnect |

| ship, `ship_type`, `IH_Ships` | computer system type |

| `cargo_holds` | storage |

| `ore`, `organics`, `equipment`, `isotopes` | Private Data, Consortium Secrets, Imperial Data, Crypto Vaults |

| planet, `IH_Planets` | building |

| `colonists` | scammers |

| `fighters` (player, planet, fleet) | security bots |

| `shield_points` | honeypots |

| `worldseeds` | Shell Companies |

| nebula | zone of the net (network charts) |

| faction, fleet with owner 0 | Colonial Counter Hack Team defence group |

| Universe Forge, `IH_Universe_Forge` | network founding |

| Gazette | Imperial Hacker News |

| land / leave planet | enter / leave a building |

| autopilot, fly | Auto-Route, Route & Connect / Route & Enter |