Unplug the database

# mirror everything reachable from the homepage
wget \
  --mirror \
  --page-requisites \
  --no-parent \
  --restrict-file-names=windows \
  --reject-regex '(wp-admin|wp-login|xmlrpc|\?replytocom)' \
  --user-agent='StaticMigration/1.0' \
  --wait=0.25 --random-wait \
  --directory-prefix=./snapshot \
  https://example.com/

# macOS/BSD sed shown; on GNU sed drop the empty '' after -i
grep -rl 'https://example.com' ./snapshot \
  | xargs sed -i '' 's|https://example\.com||g'

# drop the emoji loader, the generator meta and the API discovery tags
grep -rl 'wp-emoji-release' ./snapshot \
  | xargs sed -i '' -E '/wp-emoji-release\.min\.js/d'

grep -rl 'name="generator"' ./snapshot \
  | xargs sed -i '' '/<meta name="generator"/d'

# then verify by hand. regex is a blunt instrument on HTML.
grep -rn 'wp-json\|xmlrpc\|admin-ajax' ./snapshot | head -50

# legacy path shapes
/index.php/*        /:splat                301
/feed               /feed/index.xml        301

# tell scanners and crawlers to stop asking, permanently
/wp-admin/*         /                      410
/wp-login.php       /                      410
/wp-json/*          /                      410
/xmlrpc.php         /                      410
/comments/feed/*    /                      410

# ?p=ID permalinks — one line per post, generated from the DB
/                   p=42    /notes/first-post/       301!
/                   p=87    /notes/on-static-sites/  301!

# and the catch-all, last
/*                  /404.html              404

# run against the archived dump, not production
mysql -N -B wordpress_archive -e "
  SELECT CONCAT('/', CHAR(9), 'p=', ID, CHAR(9),
                REPLACE(guid,'https://example.com',''), CHAR(9), '301!')
  FROM wp_posts
  WHERE post_status = 'publish' AND post_type IN ('post','page');
" >> _redirects

server {
  root /var/www/example.com;

  # serve pretty permalinks straight from the folder tree
  location / {
    try_files $uri $uri/ $uri/index.html =404;
  }

  location = /feed          { return 301 /feed/index.xml; }
  location ^~ /wp-admin/    { return 410; }
  location ^~ /wp-json/     { return 410; }
  location = /xmlrpc.php    { return 410; }

  # hashed assets are immutable; html is not
  location ~* \.(css|js|woff2|png|jpg|svg)$ {
    add_header Cache-Control "public, max-age=31536000, immutable";
  }
  location ~* \.html$ {
    add_header Cache-Control "public, max-age=0, must-revalidate";
  }
}

/*
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'

/assets/*
  Cache-Control: public, max-age=31536000, immutable

/*.html
  Cache-Control: public, max-age=0, must-revalidate

# urls.txt: one path per line, from step 01 of the playbook
while read -r path; do
  old=$(curl -o /dev/null -sL -w '%{http_code}' "https://example.com$path")
  new=$(curl -o /dev/null -sL -w '%{http_code}' "https://staging.example.com$path")
  [ "$old" = "$new" ] || printf '%s\t%s -> %s\n' "$path" "$old" "$new"
done < urls.txt | tee status-diff.tsv

# then the same loop comparing <title> and <h1>, not just status codes