Benign WordPress cleanup laboratory — observed 25 October 2026

This is an actual isolated WordPress exercise using deliberately introduced,
harmless content changes. No vulnerability was exploited and no real malware,
customer data, production site, external scanning service or Google result was used.

The registered sequence contains four HTTP GET observations in each stage:
before, partial cleanup and complete cleanup. The partial cleanup sends the
foreign post to trash but deliberately leaves an altered legitimate title and a
conditional-content fixture. Complete cleanup restores the original legitimate
title and removes that exact known fixture. The original legitimate body and the
control post are compared against retained SHA-256 fingerprints. Two final desktop
Chromium contexts verify the restored service with and without the synthetic header.

X-Lab-Condition: example-variant is an invented exercise condition, not a real
visitor, device, authenticated session, Googlebot or CDN condition. wp:8080 is the
internal container hostname; the placeholder link uses a reserved .invalid domain.
No external redirect is followed. The network has no published ports and is internal.
The three containers, network and generated credential files were removed afterwards.

A successful known-fixture cleanup does not establish absence of other malware,
a real entry vector, removal from Google, recovered traffic, sales or a repair SLA.
The recorded HTTP series exclude preliminary setup and one failed browser-launch
verification attempt. The package contains data and this explanation; no executable
fixture, configuration, credentials, customer record or infection payload is included.
