Public methodology
How we test WordPress recovery before asking anyone to trust it
Automated tests prove code paths. They do not prove recovery on a real compromised site. WP Freedom and WP Web Manager remain pilot products until the controlled tests below pass and the findings are reviewed.
Run against clean WordPress controls so ordinary core, theme and plugin files are not mislabeled.
Run against isolated, disposable sites containing documented malicious fixtures and known file changes.
Preserve hashes, paths, timestamps and a copy of evidence before any repair is permitted.
Require an administrator to approve destructive recovery actions; automatic recovery stays off by default.
Restore only from verified sources, then rescan the filesystem, database and relevant WordPress state.
Test rollback and interrupted recovery so a failed repair does not leave the site in a worse state.
Record every detected indicator, action, skipped item and unresolved warning in the incident report.
Never translate one successful rescan into a guarantee that the entire website is clean.
What a passing result means
It means the identified test indicators were detected, the approved recovery completed, the expected evidence was preserved and those indicators were absent on rescan. It does not mean every possible compromise was found, and it is never described as a guarantee that a site is completely clean.
Current release gate
Both recovery plugins are built and covered by automated tests. Unrestricted checkout remains disabled until controlled fixtures, clean-site controls, rollback tests and purchase-to-activation tests pass.