The recovery environment should be tested at its future hostname so URLs, cookies, TLS, cache and redirects behave like production. A temporary public domain can leak the rebuilt site or send real mail/payment actions.
Use a local hosts mapping, provider preview or protected staging route with tightly controlled integrations.
Keep the recovery site private
Restrict access by network, authenticated proxy or hosting controls. Block indexing and direct-origin exposure, but do not rely on robots.txt as security.
Disable production SMTP, payment capture, webhooks and scheduled external callbacks. Use sandbox credentials and controlled recipients.
Do not upload the infected archive to a public test hostname.
Map the production hostname locally
An authorised tester can map the canonical domain to the new server in the local hosts file while public DNS remains unchanged. This lets WordPress see the real hostname.
Record and remove the mapping after testing. Verify which IP responds before entering administrator credentials.
Coordinate IPv4/IPv6 so the browser does not bypass the intended mapping.
Verify TLS and virtual-host routing
Ensure the new server presents a valid certificate and the correct site for the Host/SNI name. A default virtual host can show another customer or redirect unexpectedly.
Do not disable TLS verification as a test shortcut. Use a provider-supported validation route or controlled certificate issuance.
Check www/non-www and HTTP-to-HTTPS canonical redirects.
Check WordPress URLs and cookies
Verify site/home URLs, admin/login, REST/AJAX, uploads and serialized content use the intended domain. Test login/logout and password reset with safe mail routing.
Ensure cookies have correct secure/domain/path attributes and no staging hostname remains in page source or redirects.
Avoid broad search-and-replace without a database backup.
Test security indicators
Reproduce original redirect/referrer/mobile conditions and search for known file/database/account indicators. Exercise cron cycles, cache warm-up and administrator login to reveal persistence.
Review users, application passwords, scheduled tasks, outbound domains and file changes during tests.
No scanner result alone proves recovery.
Verify cache and CDN behaviour
Test once with origin cache cold and after normal warm-up. Confirm cache keys do not mix staging/production users, languages or checkout state.
Review planned Cloudflare/WAF rules against form, REST, login and webhook paths. Do not enable a blanket cache that can serve authenticated or nonce-bearing pages.
Capture cache-status headers without exposing cookies.
Test business functions safely
Use synthetic forms, sandbox checkout/payment, test webhooks and controlled email recipients. Verify order status, stock behaviour, administrator/customer notifications and uploads.
Do not place real card data or send test leads to sales. Label and remove test records.
Test language/mobile variants and consent/CAPTCHA paths.
Validate performance and infrastructure
Check PHP errors, resource limits, cron runner, database/cache separation, filesystem permissions and backups. Confirm CDN/WAF rules planned for production do not hide origin problems.
Review DNS records/TTL/rollback without switching them yet. Keep old production contained and evidence isolated.
Do not copy production secrets merely to make integrations pass.
Capture an acceptance record
For every critical path, record tester, time, synthetic ID, expected result and evidence. Include security indicators, business owner approval and unresolved low-risk items.
Do not attach customer data, passwords or payment tokens. A concise matrix makes post-DNS differences easier to identify.
Prepare the cutover
Define exact DNS/document-root changes, TTL, verification owner, rollback and maintenance communication. Record current authoritative DNS and export the zone.
Schedule reconciliation for orders/leads created during the transition. Avoid two writable production databases accepting traffic simultaneously.
Have a rapid containment route if original indicators reappear.
Verify after DNS propagation
Test from public resolvers/networks without hosts overrides. Confirm certificate, correct server, login, forms, checkout, mail and original security conditions.
Monitor DNS/CDN, file/database changes, privileged accounts and outbound activity. Remove test mappings and temporary allow rules.
Request urgent pre-cutover validation when recovery crosses hosting or payment systems. Share the test matrix and managed access—never hosts-file screenshots with secrets, credentials or customer data.