Troubleshooting

“Cannot write to the data/ folder”

The game stores JSON files in data/. Make it writable:

chmod 755 data
chmod -R 755 data

Some hosts need 775 or 777. Also confirm the path in POKER_DATA_DIR points to the real folder.

“Invalid CSRF” when registering / sitting / betting

• Cookies are blocked or the session cookie is not being stored. Allow cookies for the site and reload.
• If you run the game behind a proxy/load balancer, make sure the session cookie is forwarded.
• Confirm index.php and api.php use the same POKER_SESSION_NAME (both read it from config.php).
• As a last resort set POKER_CSRF_ENABLED = false to confirm the cause — then fix the cookie issue.

“Bots are not playing”

• Check POKER_BOTS_ALLOWED = true in config.php.
• Bots need a writable data/ folder (they store their state in the table file).
• Only logged-in players can add bots; spectators cannot.

Setup shows the control panel instead of the install form

setup.php shows the install form only when there is no config.php and no data/.installed marker. If the game is already installed it shows the control panel instead (with a Delete setup.php now button and an Uninstall everything button). To reinstall from scratch, open setup.php, type UNINSTALL in the confirmation box and press Uninstall — this wipes all player data and config.php. Leave “Also delete setup.php” unchecked if you want to reinstall right away. Or delete both by hand:

config.php
data/.installed

Chat is not showing

Set POKER_CHAT_ENABLED = true in config.php. When disabled, the chat tab is hidden and the server rejects messages.

“Stacks are not saving”

• Check data/logs/php-errors.log (with POKER_DEBUG = false).
• Make sure data/ is writable and that no other process locks the JSON files.
• Temporarily set POKER_DEBUG = true to see the error in the browser.

“users.json is publicly accessible!”

The bundled data/.htaccess must be uploaded and Apache must allow .htaccess overrides (AllowOverride All). Verify by opening https://your-site.com/data/users.json — it must return 403. If you use Nginx, block access with a location ~ ^/data/ { deny all; } rule instead.

404 on a theme stylesheet

Themes are auto-discovered from sub-folders of assets/themes/, each containing a theme.css. If a player picked a theme whose folder is missing, the game falls back to the default. Re-upload the assets/themes// folder.

“Lots of rl_*.json files in data/”

These are per-IP rate-limit counters. They are tiny and harmless; you can delete old ones any time. A periodic cleanup is safe:

find /path/to/data -name 'rl_*.json' -mtime +1 -delete

Session expired after a long idle

Normal. Reload the page: a fresh CSRF token is issued with the new session and play resumes.

“One bot plays badly / the bots all seem the same”

Both are expected. Each bot draws a personality when it sits down: TAG (40%), Rock (25%), LAG (25%) and Station (10%). A Station calls too much and a Rock folds too often on purpose — that is the style, not a bug. If you would rather have identical opponents, set POKER_BOT_STYLES_ENABLED = false in config.php or use the Bots tab of admin.php?cfg=1; every bot then plays the baseline engine again with the fixed wait. Details: User Guide → Bot personalities.

“Can the cards be predicted? Is the deal fair?”

No. Every hand is shuffled on the server with PHP's cryptographic generator random_int() (Fisher–Yates) — never rand(), mt_rand() or shuffle(). The entropy comes from the operating system, so nothing about the previous hands says anything about the next one; the deck stays server-side and each card is removed once dealt, so duplicates are impossible. A 200,000-shuffle uniformity run returned 0 invalid decks and passed every chi-square test.

The functions involved, the measured numbers and how to re-run the check are in the User Guide → Fair deal & card randomness.