I've been kinda busy in the past 2 days, couldn't work on the site much. But all in all, I have some good news and some bad news.
---
Captcha on registration form
This is an older issue, where I tried to add a captcha on the registration form. I failed. I decided to let it go because the site has like a custom registration form, so maybe we don't get those spam registrations like we would on a wordpress default registration form. But if we do, I guess I'll hire someone to put a captcha on the registration form.
---
Set the "Add funds" page to only be available for logged in users
I managed to do this. Just because I don't want it available to everyone to view. I also removed it from the sitemap and added a "noindex" tag to it.
Here is how I made it available only for logged in users -
https://www.blackhatworld.com/seo/wordpress-page-show-only-to-logged-in-users.1435210/
Big thank you to
@SirLouen for pretty much doing it for me
I didn't manage to make the redirect back to the "Add funds" page after a successful login, but never mind, not too important.
Like with the recaptcha above, if I ever have money to burn for perfection, I'll hire someone to do it all the way.
---
Check to make sure the downloadables on the site aren't publicly visible/accessible
I spent hours at this, and ultimately I failed. Here we go -
https://www.blackhatworld.com/seo/wordpress-how-to-prevent-downloads-by-direct-url.1435215/
All I wanted was for people to not be able to download zip files from the site using the direct link, but to be able to download them if they receive them in a private message or order page on the site.
On the bright side, I don't think somebody can easily find all the downloadable URLs on the site, so it's unlikely someone can just go in and download everything. And then even if they did, it's not like there's some super important information there or anything like that. Even if that one wizard hacker weirdo finds and downloads all the zip files from the site using direct URLs, not really an issue.
But again, like with the recaptcha and the add funds page, if I ever have money to burn, I'll hire someone to close this too.
---
Not gonna lie, it bothers me to leave these 3 loose ends. But none of them makes or breaks anything, so I'm just gonna put my head down a little bit and try to live with it. And most importantly move the fuck on, because I wasted too many hours on this shit and I just can't get it done.
Stuff left to do:
Check sitemap/webmaster tools (google, bing, yandex)
Delete the other sites from the other domain, and the database/user
Save the files for the new site theme in the appropriate folder
Do a final backup for the new site (site+database)
Save the final backup for the old live site int he appropriate folder
Clean up all the residual crap and cum stains that were left all over the place on my lap top during this entire process (unnecessary screenshots, and databases, and files, etc)
Hopefully in a day or two I can complete all of these and consider the site completed, done and done.