Fresh-domain acceptance test

Use this checklist on an empty domain or subfolder before publishing a core release. Keep the completed record with the release verification report.

Test record

• Domain or subfolder:
• Date and tester:
• Core version:
• Release ZIP filename:
• Release ZIP SHA-256:
• PHP version:
• Web server and hosting plan:
• Result: PASS / FAIL
• Notes or follow-up issue:

1. Verify the artifact before upload

• Download the ZIP and its .verification.json report from Home Base.
• Confirm the calculated SHA-256 matches the release record.
• Confirm the verification report passed its inventory, clean-data, Home Base exclusion, and private-content gates.
• Inspect the ZIP root: it should contain one free-rotator-script/ folder.
• Confirm the package contains config.example.php, install.php, includes/Installer.php, keys/mod-signing-public.pem, admin/mods.php, mod-public.php, and this checklist.
• Confirm it contains no docs/ directory and does not contain config.php, homebase/, tests/, scripts/, releases/, private keys, SQLite files, mail logs, leads, orders, or purchased MOD packages.

2. Install on an empty location

• Extract the ZIP into a new document root or subfolder.
• Immediately visit /install.php before any other visitor.
• Confirm every server-readiness check passes.
• Enter the site name, detected HTTPS URL, contact/sender emails, giveaway filename, and a unique Admin username/password.
• Create the configuration and confirm the success screen opens Admin.
• Confirm generated config.php uses a password hash, mail_mode => log, the chosen values, and enable_install => false.
• Upload the configured giveaway ZIP beside install.php.

3. Verify one-time installer security

• Confirm /install.php returns 404 after successful setup.
• Confirm a second installation attempt cannot overwrite config.php.
• For the optional read-only recheck, add a temporary private setup_token, enable installation, use the exact token URL, then disable it and remove the token.

4. Verify public and Admin flows

• / loads the canonical lead homepage over HTTPS and visibly renders the installed site name.
• /landing.php permanently redirects to /.
• /demo/ loads the rotator; View Rotator in Admin opens this path.
• /privacy.php, unsubscribe, resend, and confirmation error states are readable.\n- /guide.php lists every shipped instruction and license; Admin Guide links open styled pages with the intended section anchors.
• Admin rejects incorrect credentials and accepts the configured username and password.
• Add two destinations with weights 20 and 10; preview both and note any iframe-blocking headers.
• Add or intentionally skip a banner.
• Submit a test lead at /, use the logged confirmation URL, and confirm the lead.
• Verify a confirmed session can download the configured ZIP and an unconfirmed session cannot.
• Verify unsubscribe adds suppression and prevents an unsafe resend.
• Export confirmed leads and download a core backup.
• Restore only into a disposable copy if you test restore behavior.

5. Verify server protections

The following direct requests must fail without revealing content:

• /config.php
• /storage/leads.json
• /storage/mail.log
• any /storage/mods/*.sqlite path
• an executable extension placed under /uploads/

Also confirm directory listing is disabled, cookies are secure over HTTPS, and production error display does not expose paths or secrets. Confirm generated robots.txt and sitemap.xml use the installed domain or subfolder and do not reference Home Base.

6. Verify the MOD marketplace

• Open https://freerotatorscript.com/mods/account.php, generate a connection code, and enter it in Admin’s MOD Manager.
• Refresh the Home Base verification key and entitlements.
• Confirm the connection uses HTTPS and reports the expected installation hostname.
• Claim the free Pro Captcha MOD and verify it appears as owned.
• Download, install, and activate the compatible signed version.
• Enable in-house CAPTCHA on the main form, submit a correct challenge, and reject an incorrect challenge.
• If Funnel Maker is installed, verify CAPTCHA can protect a created form.
• Deactivate and reactivate the MOD; confirm the free core continues to work.
• For paid-provider testing, use Stripe and PayPal sandbox/test accounts first. Confirm one successful purchase grants exactly one entitlement and repeated provider events do not duplicate it.
• Do not use a real charge until webhook secrets, return URLs, currency, refund handling, and operator alerts are verified.

7. Prepare production email

• Replace log delivery only after the entire local flow passes.
• Confirm SPF, DKIM, and DMARC for the sender domain.
• Test at more than one mailbox provider.
• Confirm the message links use the exact production HTTPS base URL.
• Confirm unsubscribe remains functional after switching delivery mode.

Sign-off rule

A release is ready for public distribution only when repository CI and release verification pass and this fresh-domain test has no unresolved security, install, lead-delivery, download, or MOD-signature failure. Record non-blocking host quirks separately and update TROUBLESHOOTING.md when they are repeatable.