Already implemented
- Pair two WordPress sites by a one-time code valid for 15 minutes.
- Establish a time-limited HTTPS transport session and verify test data using SHA-256.
- Opt-in, read-only transfer check for eligible files from
uploads; transferred test files are discarded and not published.

