One row per line, columns separated by Tab: xmlrpc_url login password notes app_password. Notes and App Password columns are optional.

Header row required: xmlrpc_url,login,password[,app_password,notes]. Duplicates (same xmlrpc_url) are silently skipped.

Runs XML-RPC access check against all donors — including offline and blocked ones. Donors that pass are re-activated; those that fail are marked inactive. When XML-RPC fails and no App Password is stored yet, we try to bootstrap one via the wp-admin session flow. Batches of 100 (50 parallel sockets).

For every donor that does not yet have an App Password, tries to mint one via the wp-admin session flow (/wp-json/wp/v2/users/me/application-passwords). Donors with JS anti-bot pages (Cloudflare, DDoS-Guard) will fail — paste those app-passes manually.

Verifies the stored App Password still works for REST publishing (GET /wp-json/wp/v2/users/me?context=edit, requirespublish_posts capability). Runs only for donors that already have an App Password.