VisitoraSelf-Hosted Visitor Sign-In & Evacuation List
Self-hosted visitor sign-in: a kiosk your visitors use themselves, and one page that answers who is still inside when the alarm goes off — offline if it has to.
No sign-up, no password — the demo opens already signed in, on sample data.
- Full PHP source included
- Instant download + licence key
- It never phones home
- Compare vs SaaS pricing →
The problem it solves
Most visitor sign-in systems for reception are cloud SaaS billed monthly per location — Envoy being the best-known — and the visitor log lives on their servers. Visitora is the self-hosted version: $79 one-time, full PHP source, a front-desk sign-in screen any tablet browser can run, and a visitor log that stays on your own server.
A paper sign-in book fails at exactly one moment: the one it exists for. Somebody carries it outside, half the names are illegible, and nobody can say whether the contractor who arrived at eleven has left.
The cloud products that replace it charge per site, per month, and put the name of every person who visited you on somebody else's server. Then the wifi goes down during the fire drill and the tablet shows a spinner.
- A book that cannot be searched, cannot be counted, and cannot survive the walk to the car park
- Per-site monthly fees for what is a list of names and two timestamps
- Visitor personal data, including who they came to see, sitting in a jurisdiction you did not pick
What you get
Newest arrival first, with their host and their host phone number. One tap marks a person accounted for, and the tally reads on site / accounted for / still missing. It is the screen you open in the car park.
The evacuation page is kept on the device. If the network is gone it still shows the list as of the last load — because the fire alarm and the router failing are not independent events.
A print muster sheet with a tick box per row, and a CSV, are one click each. When the tablet is at 2% the sheet is already printed.
On site is not a column that could go stale — it is derived from the sign-in and sign-out entries themselves. There is no second source of truth to drift.
A full-screen page for a tablet at reception: big targets, no admin chrome, and nothing a visitor can wander into. They sign themselves in, their host is notified, and a badge prints.
Numbers are handed out lowest-first from however many badges you own, and returned to the pool on sign-out. Sign out by badge number or by name, with a disambiguation step when more than one person matches.
Optional text a visitor accepts before signing in — safety rules, an NDA, a site induction — and a pre-registration link so an expected visitor arrives already on the list.
The 3.1 wave gave the catalogue a way to reach the other side of the transaction: counterparty email through your own SMTP server, calendar feeds your own calendar subscribes to, attachments filed where the paperwork belongs, and export presets other people's software imports. Every outbound path ships switched off, runs on your own credentials, and can never break the thing that triggered it. This app gained no new outbound path in 3.1 — its pass rewrote the honest-limitations list against the shipped code instead, which is the more useful change when the product was already complete.
See it running — right now, on sample data
No sign-up, no password — it opens already signed in, and resets itself. Click around freely.
Open the live demoIs Visitora right for you?
Before the price, not after it: what Visitora deliberately does not do. We publish this on every product because the wrong purchase costs you more than the price.
- A sign-in book, not a security system. It records what people tell it — no ID scan, no passport read
- No door access, no turnstiles, no badge encoding — it does not unlock anything
- No photo capture, no ID upload — deliberate: neither is needed to answer "who is inside", and both are data you then have to protect
- Single-tenant: one site per installation
- Email only — no SMS, no push — through your own SMTP server, off until you switch it on twice
- The visitor is never emailed a copy of their visit — only the host arrival notice and the pre-registration link
- Not legal advice — the right retention period, and whether your site rules are adequate, are your decisions
Still the right fit? See the price → · Not sure — see who should stay with the SaaS →
Pricing — one-time, yours forever
- ✔ Full source included — PHP you can read and change
- ✔ No subscription. One payment, yours forever
- ✔ It never phones home
- ✔ Your data stays on your server
- ✔ 14-day refunds — we’d rather refund than argue
- ✔ Offline test suite in the box — run it before you rely on it
- ✔ If we ever stop: after 1 year the domain limit lifts, after 3 years your copy relicenses to MIT — it’s in the licence
Not ready to own it? Ownware Cloud runs selected apps from $12/month — and after 12 paid months the perpetual self-host licence is yours.
AlternativeTo 
SaaSHub 
Uneed 
SourceForge Read before you buy — what the zip looks like inside
visitora/
README.md · QUICKSTART.txt · LICENSE.txt
app/
index.php · router.php · config.sample.php · Dockerfile
src/ the classes — plain PHP 8, no framework, no Composer
controllers/ every route handler
views/ every screen
tests/ the offline test suite — run it yourself: php tests/run.php
bin/ packaging · seeding · maintenance scripts
API.md the REST + webhook + MCP reference
Nothing is obfuscated or encoded. What you read is what runs.
What the same job costs rented
Every figure is read from the vendor’s own pricing page and carries the date it was read.
Visitors Premium $362 per location/month billed annually (Basic free with limited features; Enterprise custom)
1 month of Envoy equals the one-time $79.00.
Source, read 2026-08-22 →The full table — every competitor, what each does better than us, and who should stay with them: Visitora vs renting →
Which licence do I need?
It comes down to how many installations you need. Running your own business on one site is the Single licence. Building or running sites for other people — a second domain of your own, or an installation a client keeps — is the Extended licence.
Single licence
One (1) domain or subdomain
One business, running it on one site.
- Install it on one domain or subdomain you own or operate
- Change the source however you like for that installation
- Run your own business on it commercially, client work included
- Re-download the current build any time from your buyer portal
- A second site, or an installation you hand to a client as theirs, needs the Extended licence
- No reselling, redistributing or sublicensing the source
- Not for offering it to other people as a hosted service
Extended licence
Unlimited sites you own or operate
Agencies, and anyone running it on more than one site.
- Everything the Single licence grants
- Install it on as many domains as you own or operate — no cap on the number
- Build and hand over one installation per client project
- Still no reselling or redistributing the source itself
- Running it as a multi-tenant service others sign up for needs a SaaS agreement
Every download carries the full terms as LICENSE.txt, and the licence you bought is
named on your order and in your buyer portal. The complete wording lives on the
terms page, and the live demo is free for as long
as it takes to decide.
No reviews yet — so here is what we offer instead. Every competitor price on our comparison pages is source-linked and dated, and when a vendor’s price won’t load we say so rather than guess. See the sources for yourself →
After you buy
The four things people ask right before they decide.
Your download link always serves the current build at the time you fetch it — re-download any time from your order page or the buyer portal. No renewal fee to keep what you bought.
Email support for installation and for defects in the code as delivered — a person answers, usually within a day or two. It does not cover custom development or server administration. What support covers →
Refunds are handled by Lemon Squeezy as Merchant of Record, case by case — if something is broken and we can’t fix it, we’d rather refund than argue. EU consumers additionally hold the statutory 14-day right until delivery starts. Refund terms →
Nothing stops. You hold the full PHP source, it runs on your own server, and the software does not phone home — there is no licence check that can fail and no cloud that can be switched off. LICENSE.txt ships inside the zip, so your right to keep running it never depended on this site existing.
Covered in these guides
Visitor management is one of the smallest systems a building runs: a name, a host, two timestamps, and a list you can carry outside. It is also sold per site per year, forever. Two vendors' own published prices, the three-year arithmetic, and what the meter is actually counting.
Questions about Visitora
Does it unlock doors or print encoded badges?
No. It is a sign-in book, not a security system: no door access, no turnstiles, no badge encoding. It prints a paper badge with a number on it and records who holds it.
Does it verify identity?
No, and deliberately. No ID scan, no passport read, no photo capture, no ID upload. None of that is needed to answer who is inside, and all of it is data you then have to protect.
What happens when the wifi drops during an evacuation?
The evacuation page is kept on the device and still shows the list as of its last load. There is also a one-click print muster sheet, because paper beats every screen at 2% battery.
Can it text a host instead of emailing?
No — email only, through your own SMTP server, and off until you switch it on twice. There is no SMS and no push.
Can one install cover several sites?
No. Single-tenant, one site per installation. Staff get their own accounts, roles and 2FA within it.