CoolZone WebRadio — website

Background

CoolZone WebRadio is an online radio station hosted by Tom Palmer that streams music 24 hours a day. In 2026 I redesigned and built its website, coolzonewebradio.it, from scratch in PHP and JavaScript; Tom Palmer provided the art direction, logo and colour palette, and I wrote the code with the help of AI coding agents.

The CoolZone WebRadio website has three kinds of users. Listeners want to hear the live stream, often on their phones. Tom Palmer curates a music chart by hand every week and needs to update it without touching any code. And the CoolZone WebRadio mobile app needs to get the track currently on air from the website.

Goal

The goal was a lightweight, secure website the station can run on its own: the player front and centre, a chart with cover art and audio previews, an admin panel and a stable API for the app.

What I built

Player and streaming

The live player is IskRadioPlayer, a player I built as a separate project, which the website embeds in an iframe. The audio stream comes from an external streaming server.

How does the weekly chart work?

The "International Music Chart" shows the top ten tracks picked by Tom Palmer, with the top three on a podium. The data lives in a JSON file rather than a database: for about ten entries updated once a week, MySQL would have been unnecessary overhead. If the custom chart is empty, the website automatically shows the Billboard Hot 100 from a public JSON feed, cached for one hour.

Cover art comes from the iTunes Search API and is cached locally in high resolution. Each track can have a 30-second iTunes preview: only one plays at a time, and the live stream pauses so the two don't overlap.

The admin panel

The admin panel lets Tom Palmer add, remove and reorder tracks, including by drag and drop. Adding a track only takes an Apple Music link. The panel extracts the track ID and country from the link, queries the iTunes Lookup API and fills in the title, artist, cover art and preview. The same panel controls the site copy, app store links and Google Analytics ID.

Security and privacy

Passwords hashed with bcrypt, a lockout after too many failed logins, sessions that expire after a period of inactivity.
CSRF tokens on every form and every AJAX call in the admin panel.
A Content Security Policy with a fresh nonce on every request, plus HSTS.
Google Analytics loads only after explicit cookie consent, with IP anonymisation.

Mobile

The layout is responsive, with dedicated rules for phones in portrait and landscape and reduced animations for users who turn them off in their system settings. On iOS and Android, a banner offers the right app for the operating system.

The hardest part

The hardest part was getting the Android app to read the track on air. The app called the player's endpoint directly and got a 403 error, while browsers and curl got a normal response. The cause was a security filter in front of the server, which blocked requests from Android's native HTTP client.

How does the mobile app get the track on air?

The mobile app reads the track on air from a public, versioned endpoint, /api/v1/nowplaying, which I wrote in PHP. The endpoint queries the player on the server side with cURL, so the request that reaches the filter no longer comes from the Android client. I verified the fix on a real Android device.

Cover art had the same problem, so I added a proxy for images too. It only accepts file names in a fixed format, which stops it from being used to send arbitrary requests to other servers. The v1 in the API path is deliberate: an installed app doesn't update right away, so any breaking change will go into a v2.

Outcome

The CoolZone WebRadio website is live at coolzonewebradio.it. Tom Palmer updates the chart every week from the admin panel without technical help, and the mobile app reads the track on air from the /api/v1/nowplaying API.

The CoolZone WebRadio mobile app has its own case study: CoolZone WebRadio — mobile app.