diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..ea58397
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,24 @@
+name: Tests
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+
+jobs:
+  phpunit:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        php-version: [ '7.4', '8.1', '8.3' ]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-version }}
+          coverage: pcov
+
+      - run: composer update --prefer-dist --no-progress
+
+      - run: vendor/bin/phpunit --coverage-text
diff --git a/.gitignore b/.gitignore
index 5469669..a74cbe5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -45,4 +45,9 @@ wp-config.php
 #
 # Note: If you wish to whitelist themes,
 # uncomment the next line
-#/wp-content/themes
\ No newline at end of file
+#/wp-content/themes
+
+# Composer / PHPUnit
+/vendor/
+/composer.lock
+.phpunit.result.cache
diff --git a/README.md b/README.md
index dc62893..e53d36b 100644
--- a/README.md
+++ b/README.md
@@ -33,6 +33,14 @@ Paigaldus
 2. Aktiveeri WordPressi adminis (Plugins → DoneProject Plugin).
 3. Lisa lehele/ postitusele shortcode (näide eespool).
 
+Testid
+
+Unit-testid kasutavad PHPUnitit ja WordPressi funktsioonide asendajaid (`tests/wp-stubs.php`), seega WordPressi installatsiooni pole vaja.
+
+1. `composer install`
+2. `composer test` (või `vendor/bin/phpunit`)
+3. Kaetuse aruanne: `php -d pcov.enabled=1 vendor/bin/phpunit --coverage-text` (nõuab pcov või Xdebug laiendust)
+
 Piirangud ja tähelepanekud
 
 - Pages ja category: vaikimisi ei kasuta WordPress pages taksonoomiat "category"; kui kasutad post_type="page" ja sinu lehed ei ole category-ga seotud, shortcode ei tagasta tulemusi — kasuta post tüüpi või registreeri category ka lehtedele.
diff --git a/composer.json b/composer.json
index 0834318..7f149d8 100644
--- a/composer.json
+++ b/composer.json
@@ -7,7 +7,19 @@
   },
   "autoload": {
     "psr-4": {
-      "DoneProject\\\\": "src/"
+      "DoneProject\\": "src/"
     }
+  },
+  "autoload-dev": {
+    "psr-4": {
+      "DoneProject\\Tests\\": "tests/"
+    }
+  },
+  "scripts": {
+    "test": "phpunit",
+    "test:coverage": "phpunit --coverage-text"
+  },
+  "require-dev": {
+    "phpunit/phpunit": "^9.6"
   }
 }
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
new file mode 100644
index 0000000..46a1497
--- /dev/null
+++ b/phpunit.xml.dist
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
+         bootstrap="tests/bootstrap.php"
+         colors="true"
+         beStrictAboutTestsThatDoNotTestAnything="false"
+         convertDeprecationsToExceptions="true">
+    <testsuites>
+        <testsuite name="doneproject">
+            <directory suffix="Test.php">tests</directory>
+        </testsuite>
+    </testsuites>
+    <coverage>
+        <include>
+            <directory suffix=".php">src</directory>
+        </include>
+    </coverage>
+</phpunit>
diff --git a/tests/AdminTest.php b/tests/AdminTest.php
new file mode 100644
index 0000000..627b034
--- /dev/null
+++ b/tests/AdminTest.php
@@ -0,0 +1,106 @@
+<?php
+namespace DoneProject\Tests;
+
+use DoneProject\Admin;
+
+class AdminTest extends TestCase {
+    public function testConstructorHooksIntoAdminInitAndMenu(): void {
+        $admin = new Admin( $this->pluginStub() );
+
+        $hooks = array();
+        foreach ( WPStub::callsTo( 'add_action' ) as $call ) {
+            $hooks[ $call[0] ] = $call[1];
+        }
+
+        $this->assertSame( array( $admin, 'register_settings' ), $hooks['admin_init'] );
+        $this->assertSame( array( $admin, 'add_menu' ), $hooks['admin_menu'] );
+    }
+
+    public function testAddMenuRegistersOptionsPage(): void {
+        $admin = new Admin( $this->pluginStub() );
+
+        $admin->add_menu();
+
+        $this->assertSame(
+            array( 'DoneProject Settings', 'DoneProject', 'manage_options', 'doneproject-plugin', array( $admin, 'settings_page' ) ),
+            WPStub::firstCall( 'add_options_page' )
+        );
+    }
+
+    public function testRegisterSettingsRegistersOptionSectionAndField(): void {
+        $admin = new Admin( $this->pluginStub() );
+
+        $admin->register_settings();
+
+        $setting = WPStub::firstCall( 'register_setting' );
+        $this->assertSame( 'doneproject-plugin_group', $setting[0] );
+        $this->assertSame( 'doneproject-plugin_greeting', $setting[1] );
+        $this->assertSame(
+            array( 'type' => 'string', 'sanitize_callback' => 'sanitize_text_field', 'default' => 'Tere' ),
+            $setting[2]
+        );
+
+        $section = WPStub::firstCall( 'add_settings_section' );
+        $this->assertSame( 'doneproject-plugin_section', $section[0] );
+        $this->assertSame( 'doneproject-plugin', $section[3] );
+
+        $field = WPStub::firstCall( 'add_settings_field' );
+        $this->assertSame( 'doneproject-plugin_greeting_field', $field[0] );
+        $this->assertSame( array( $admin, 'field_html' ), $field[2] );
+        $this->assertSame( 'doneproject-plugin', $field[3] );
+        $this->assertSame( 'doneproject-plugin_section', $field[4] );
+    }
+
+    public function testFieldHtmlRendersStoredValue(): void {
+        WPStub::$options['doneproject-plugin_greeting'] = 'Hei';
+        $admin = new Admin( $this->pluginStub() );
+
+        ob_start();
+        $admin->field_html();
+        $html = ob_get_clean();
+
+        $this->assertSame(
+            '<input type="text" name="doneproject-plugin_greeting" value="Hei" class="regular-text" />',
+            $html
+        );
+    }
+
+    public function testFieldHtmlRendersDefaultAndEscapesValue(): void {
+        WPStub::$options['doneproject-plugin_greeting'] = 'Tere "sõber" & <b>';
+        $admin = new Admin( $this->pluginStub() );
+
+        ob_start();
+        $admin->field_html();
+        $html = ob_get_clean();
+
+        $this->assertStringContainsString( 'value="Tere &quot;s', $html );
+        $this->assertStringNotContainsString( '<b>', $html );
+    }
+
+    public function testSettingsPageRendersFormForPermittedUser(): void {
+        $admin = new Admin( $this->pluginStub() );
+
+        ob_start();
+        $admin->settings_page();
+        $html = ob_get_clean();
+
+        $this->assertStringContainsString( 'DoneProject seaded', $html );
+        $this->assertStringContainsString( '<form method="post" action="options.php">', $html );
+        $this->assertSame( array( 'doneproject-plugin_group' ), WPStub::firstCall( 'settings_fields' ) );
+        $this->assertSame( array( 'doneproject-plugin' ), WPStub::firstCall( 'do_settings_sections' ) );
+        $this->assertTrue( WPStub::called( 'submit_button' ) );
+    }
+
+    public function testSettingsPageRendersNothingWithoutCapability(): void {
+        WPStub::$current_user_can = false;
+        $admin = new Admin( $this->pluginStub() );
+
+        ob_start();
+        $admin->settings_page();
+        $html = ob_get_clean();
+
+        $this->assertSame( '', $html );
+        $this->assertFalse( WPStub::called( 'settings_fields' ) );
+        $this->assertSame( array( 'manage_options' ), WPStub::firstCall( 'current_user_can' ) );
+    }
+}
diff --git a/tests/FrontendTest.php b/tests/FrontendTest.php
new file mode 100644
index 0000000..a193349
--- /dev/null
+++ b/tests/FrontendTest.php
@@ -0,0 +1,306 @@
+<?php
+namespace DoneProject\Tests;
+
+use DoneProject\Frontend;
+
+class FrontendTest extends TestCase {
+    /** @var string */
+    private $basedir;
+
+    /** @var string */
+    private $baseurl = 'http://example.com/wp-content/uploads';
+
+    protected function setUp(): void {
+        parent::setUp();
+        $this->basedir = sys_get_temp_dir() . '/doneproject-tests-' . uniqid();
+        mkdir( $this->basedir . '/2024/01', 0777, true );
+        WPStub::$upload_dir = array( 'basedir' => $this->basedir, 'baseurl' => $this->baseurl );
+    }
+
+    protected function tearDown(): void {
+        $this->removeDir( $this->basedir );
+        parent::tearDown();
+    }
+
+    private function removeDir( string $dir ): void {
+        if ( ! is_dir( $dir ) ) {
+            return;
+        }
+        foreach ( scandir( $dir ) as $entry ) {
+            if ( '.' === $entry || '..' === $entry ) {
+                continue;
+            }
+            $path = $dir . '/' . $entry;
+            is_dir( $path ) ? $this->removeDir( $path ) : unlink( $path );
+        }
+        rmdir( $dir );
+    }
+
+    private function frontend(): Frontend {
+        return new Frontend( $this->pluginStub() );
+    }
+
+    private function localImage( string $relative = '/2024/01/photo.jpg' ): string {
+        file_put_contents( $this->basedir . $relative, 'image-bytes' );
+        return $this->baseurl . $relative;
+    }
+
+    public function testConstructorRegistersShortcodesAndAssetHook(): void {
+        $frontend = $this->frontend();
+
+        $shortcodes = array();
+        foreach ( WPStub::callsTo( 'add_shortcode' ) as $call ) {
+            $shortcodes[ $call[0] ] = $call[1];
+        }
+
+        $this->assertSame( array( $frontend, 'shortcode' ), $shortcodes['doneproject'] );
+        $this->assertSame( array( $frontend, 'pages_list_shortcode' ), $shortcodes['doneproject_pages'] );
+        $this->assertSame( array( $frontend, 'pages_list_shortcode' ), $shortcodes['doneproject_list'] );
+        $this->assertSame(
+            array( 'wp_enqueue_scripts', array( $frontend, 'enqueue_assets' ), 10 ),
+            WPStub::firstCall( 'add_action' )
+        );
+    }
+
+    public function testEnqueueAssetsRegistersStyleAndScriptWithPluginVersion(): void {
+        $this->frontend()->enqueue_assets();
+
+        $style = WPStub::firstCall( 'wp_register_style' );
+        $this->assertSame( 'doneproject-style', $style[0] );
+        $this->assertStringEndsWith( 'assets/css/style.css', $style[1] );
+        $this->assertSame( '0.1.0', $style[3] );
+
+        $script = WPStub::firstCall( 'wp_register_script' );
+        $this->assertSame( 'doneproject-script', $script[0] );
+        $this->assertStringEndsWith( 'assets/js/script.js', $script[1] );
+        $this->assertSame( '0.1.0', $script[3] );
+        $this->assertTrue( $script[4] );
+    }
+
+    public function testShortcodeUsesDefaultNameAndGreeting(): void {
+        $html = $this->frontend()->shortcode( array() );
+
+        $this->assertSame( '<div class="doneproject-greeting">Tere, maailm!</div>', $html );
+    }
+
+    public function testShortcodeUsesGivenNameAndStoredGreeting(): void {
+        WPStub::$options['doneproject-plugin_greeting'] = 'Hei';
+
+        $html = $this->frontend()->shortcode( array( 'name' => 'Tallinn' ) );
+
+        $this->assertSame( '<div class="doneproject-greeting">Hei, Tallinn!</div>', $html );
+    }
+
+    public function testShortcodeEscapesNameAndGreeting(): void {
+        WPStub::$options['doneproject-plugin_greeting'] = '<b>Tere</b>';
+
+        $html = $this->frontend()->shortcode( array( 'name' => '<script>alert(1)</script>' ) );
+
+        $this->assertStringNotContainsString( '<script>', $html );
+        $this->assertStringNotContainsString( '<b>', $html );
+        $this->assertStringContainsString( '&lt;b&gt;Tere&lt;/b&gt;', $html );
+    }
+
+    public function testShortcodeEnqueuesAssets(): void {
+        $this->frontend()->shortcode( array() );
+
+        $this->assertSame( array( 'doneproject-style' ), WPStub::firstCall( 'wp_enqueue_style' ) );
+        $this->assertSame( array( 'doneproject-script' ), WPStub::firstCall( 'wp_enqueue_script' ) );
+    }
+
+    public function testPagesListRequiresCategory(): void {
+        $html = $this->frontend()->pages_list_shortcode( array() );
+
+        $this->assertStringContainsString( 'Palun määra kategooria', $html );
+        $this->assertFalse( WPStub::called( 'WP_Query' ) );
+    }
+
+    public function testPagesListBuildsQueryFromAttributes(): void {
+        WPStub::$posts = array();
+
+        $this->frontend()->pages_list_shortcode( array(
+            'category' => 'Valminud Objektid',
+            'post_type' => 'post',
+            'count' => '4',
+        ) );
+
+        $args = WPStub::firstCall( 'WP_Query' )[0];
+        $this->assertSame( 'post', $args['post_type'] );
+        $this->assertSame( 4, $args['posts_per_page'] );
+        $this->assertSame( 'date', $args['orderby'] );
+        $this->assertSame( 'DESC', $args['order'] );
+        $this->assertSame(
+            array( array( 'taxonomy' => 'category', 'field' => 'slug', 'terms' => 'valminud-objektid' ) ),
+            $args['tax_query']
+        );
+    }
+
+    public function testPagesListQueriesByTermIdForNumericCategory(): void {
+        $this->frontend()->pages_list_shortcode( array( 'category' => '17' ) );
+
+        $this->assertSame(
+            array( array( 'taxonomy' => 'category', 'field' => 'term_id', 'terms' => 17 ) ),
+            WPStub::firstCall( 'WP_Query' )[0]['tax_query']
+        );
+    }
+
+    public function testPagesListReportsWhenNoPostsFound(): void {
+        WPStub::$posts = array();
+
+        $html = $this->frontend()->pages_list_shortcode( array( 'category' => 'tyhi' ) );
+
+        $this->assertStringContainsString( 'Ühtegi lehte selles kategoorias ei leitud.', $html );
+        $this->assertFalse( WPStub::called( 'wp_enqueue_style' ) );
+    }
+
+    public function testPagesListRendersTitlesAndLinks(): void {
+        WPStub::$posts = array(
+            array( 'ID' => 1, 'title' => 'Esimene', 'permalink' => 'http://example.com/esimene', 'post_content' => '<p>ei pilti</p>' ),
+            array( 'ID' => 2, 'title' => 'Teine & <b>', 'permalink' => 'http://example.com/teine', 'post_content' => '' ),
+        );
+
+        $html = $this->frontend()->pages_list_shortcode( array( 'category' => 'objektid' ) );
+
+        $this->assertStringContainsString( '<div class="doneproject-pages-list">', $html );
+        $this->assertSame( 2, substr_count( $html, 'class="doneproject-item"' ) );
+        $this->assertStringContainsString( '<a class="doneproject-title" href="http://example.com/esimene"><h3>Esimene</h3></a>', $html );
+        $this->assertStringContainsString( 'Teine &amp; &lt;b&gt;', $html );
+        $this->assertStringNotContainsString( 'doneproject-thumb-link', $html );
+        $this->assertTrue( WPStub::called( 'wp_reset_postdata' ) );
+    }
+
+    public function testPagesListRendersThumbnailFromContentImage(): void {
+        $src = $this->localImage();
+        WPStub::$image_editor = new \DoneProject_Fake_Image_Editor( array( 'path' => 'thumb', 'create' => true ) );
+        WPStub::$posts = array(
+            array( 'ID' => 5, 'title' => 'Pildiga', 'permalink' => 'http://example.com/pildiga', 'post_content' => '<p><img src="' . $src . '" /></p>' ),
+        );
+
+        $html = $this->frontend()->pages_list_shortcode( array(
+            'category' => 'objektid',
+            'image_width' => '180',
+            'image_height' => '120',
+        ) );
+
+        $expectedThumb = $this->baseurl . '/doneproject-thumbs/' . md5( 'image-bytes' ) . '-180x120.jpg';
+        $this->assertStringContainsString( 'src="' . $expectedThumb . '"', $html );
+        $this->assertStringContainsString( 'width="180" height="120"', $html );
+        $this->assertSame( array( array( 180, 120, true ) ), WPStub::$image_editor->resize_calls );
+    }
+
+    public function testPagesListRendersExcerptOnlyWhenRequested(): void {
+        WPStub::$posts = array(
+            array( 'ID' => 7, 'title' => 'Kokkuvõttega', 'permalink' => 'http://example.com/k', 'post_content' => '', 'excerpt' => 'Lühike tekst' ),
+        );
+        $frontend = $this->frontend();
+
+        $without = $frontend->pages_list_shortcode( array( 'category' => 'objektid' ) );
+        $with = $frontend->pages_list_shortcode( array( 'category' => 'objektid', 'show_excerpt' => '1' ) );
+
+        $this->assertStringNotContainsString( 'doneproject-excerpt', $without );
+        $this->assertStringContainsString( '<div class="doneproject-excerpt"><p>Lühike tekst</p></div>', $with );
+    }
+
+    public function testGetFirstImageSrcReturnsFalseWithoutImage(): void {
+        $frontend = $this->frontend();
+
+        $this->assertFalse( $this->callPrivate( $frontend, 'get_first_image_src_from_content', array( '' ) ) );
+        $this->assertFalse( $this->callPrivate( $frontend, 'get_first_image_src_from_content', array( '<p>tekst</p>' ) ) );
+    }
+
+    public function testGetFirstImageSrcReturnsFirstImageOfContent(): void {
+        $content = '<p>tekst</p><img class="x" src="http://example.com/a.jpg" alt="a" /><img src=\'http://example.com/b.jpg\'>';
+
+        $this->assertSame(
+            'http://example.com/a.jpg',
+            $this->callPrivate( $this->frontend(), 'get_first_image_src_from_content', array( $content ) )
+        );
+    }
+
+    public function testGetFirstImageSrcHandlesSingleQuotedSrc(): void {
+        $this->assertSame(
+            'http://example.com/b.jpg',
+            $this->callPrivate( $this->frontend(), 'get_first_image_src_from_content', array( "<img src='http://example.com/b.jpg'>" ) )
+        );
+    }
+
+    public function testThumbnailGenerationReturnsFalseForEmptySrc(): void {
+        $this->assertFalse( $this->callPrivate( $this->frontend(), 'generate_content_image_thumbnail', array( '' ) ) );
+    }
+
+    public function testThumbnailGenerationReturnsRemoteSrcUntouched(): void {
+        $src = 'http://cdn.example.org/photo.jpg';
+
+        $this->assertSame(
+            $src,
+            $this->callPrivate( $this->frontend(), 'generate_content_image_thumbnail', array( $src, 100, 100 ) )
+        );
+        $this->assertFalse( WPStub::called( 'wp_get_image_editor' ) );
+    }
+
+    public function testThumbnailGenerationReturnsSrcWhenLocalFileIsMissing(): void {
+        $src = $this->baseurl . '/2024/01/absent.jpg';
+
+        $this->assertSame(
+            $src,
+            $this->callPrivate( $this->frontend(), 'generate_content_image_thumbnail', array( $src, 100, 100 ) )
+        );
+    }
+
+    public function testThumbnailGenerationStripsQueryStringBeforeResolvingPath(): void {
+        $src = $this->localImage() . '?ver=2#frag';
+        WPStub::$image_editor = new \DoneProject_Fake_Image_Editor( array( 'path' => 'thumb', 'create' => true ) );
+
+        $url = $this->callPrivate( $this->frontend(), 'generate_content_image_thumbnail', array( $src, 60, 60 ) );
+
+        $this->assertSame(
+            $this->baseurl . '/doneproject-thumbs/' . md5( 'image-bytes' ) . '-60x60.jpg',
+            $url
+        );
+    }
+
+    public function testThumbnailGenerationReusesExistingThumbnail(): void {
+        $src = $this->localImage();
+        $thumbsDir = $this->basedir . '/doneproject-thumbs';
+        mkdir( $thumbsDir, 0777, true );
+        $filename = md5( 'image-bytes' ) . '-150x150.jpg';
+        file_put_contents( $thumbsDir . '/' . $filename, 'cached' );
+
+        $url = $this->callPrivate( $this->frontend(), 'generate_content_image_thumbnail', array( $src ) );
+
+        $this->assertSame( $this->baseurl . '/doneproject-thumbs/' . $filename, $url );
+        $this->assertFalse( WPStub::called( 'wp_get_image_editor' ) );
+    }
+
+    public function testThumbnailGenerationFallsBackWhenThumbsDirCannotBeCreated(): void {
+        $src = $this->localImage();
+        WPStub::$mkdir_p = false;
+
+        $this->assertSame(
+            $src,
+            $this->callPrivate( $this->frontend(), 'generate_content_image_thumbnail', array( $src ) )
+        );
+        $this->assertFalse( WPStub::called( 'wp_get_image_editor' ) );
+    }
+
+    public function testThumbnailGenerationFallsBackWhenEditorIsUnavailable(): void {
+        $src = $this->localImage();
+        WPStub::$image_editor = new \WP_Error( 'no_editor', 'No image editor' );
+
+        $this->assertSame(
+            $src,
+            $this->callPrivate( $this->frontend(), 'generate_content_image_thumbnail', array( $src ) )
+        );
+    }
+
+    public function testThumbnailGenerationFallsBackWhenSaveFails(): void {
+        $src = $this->localImage();
+        WPStub::$image_editor = new \DoneProject_Fake_Image_Editor( new \WP_Error( 'save_failed', 'Save failed' ) );
+
+        $this->assertSame(
+            $src,
+            $this->callPrivate( $this->frontend(), 'generate_content_image_thumbnail', array( $src ) )
+        );
+        $this->assertCount( 1, WPStub::$image_editor->save_calls );
+    }
+}
diff --git a/tests/PluginTest.php b/tests/PluginTest.php
new file mode 100644
index 0000000..7196f6b
--- /dev/null
+++ b/tests/PluginTest.php
@@ -0,0 +1,145 @@
+<?php
+namespace DoneProject\Tests;
+
+use DoneProject\Admin;
+use DoneProject\Frontend;
+use DoneProject\Plugin;
+use DoneProject\REST;
+
+class PluginTest extends TestCase {
+    protected function setUp(): void {
+        parent::setUp();
+        $this->resetSingleton();
+    }
+
+    protected function tearDown(): void {
+        $this->resetSingleton();
+        parent::tearDown();
+    }
+
+    private function resetSingleton(): void {
+        $property = new \ReflectionProperty( Plugin::class, 'instance' );
+        $property->setAccessible( true );
+        $property->setValue( null, null );
+    }
+
+    public function testInstanceReturnsTheSameObject(): void {
+        $first = Plugin::instance();
+        $second = Plugin::instance();
+
+        $this->assertSame( $first, $second );
+    }
+
+    public function testInstanceRunsSetupOnlyOnce(): void {
+        Plugin::instance();
+        Plugin::instance();
+
+        $this->assertCount( 1, WPStub::callsTo( 'register_activation_hook' ) );
+        $this->assertCount( 1, WPStub::callsTo( 'register_deactivation_hook' ) );
+    }
+
+    public function testSetupRegistersLifecycleHooks(): void {
+        $plugin = Plugin::instance();
+
+        $activation = WPStub::firstCall( 'register_activation_hook' );
+        $deactivation = WPStub::firstCall( 'register_deactivation_hook' );
+
+        $this->assertSame( array( $plugin, 'on_activate' ), $activation[1] );
+        $this->assertSame( array( $plugin, 'on_deactivate' ), $deactivation[1] );
+        $this->assertStringEndsWith( 'doneproject-plugin.php', $activation[0] );
+    }
+
+    public function testSetupRegistersInitActions(): void {
+        $plugin = Plugin::instance();
+
+        $hooks = array();
+        foreach ( WPStub::callsTo( 'add_action' ) as $call ) {
+            $hooks[ $call[0] ] = $call[1];
+        }
+
+        $this->assertSame( array( $plugin, 'init_admin' ), $hooks['admin_menu'] );
+        $this->assertSame( array( $plugin, 'init_frontend' ), $hooks['init'] );
+        $this->assertSame( array( $plugin, 'init_rest' ), $hooks['rest_api_init'] );
+    }
+
+    public function testDefaultsAreExposed(): void {
+        $plugin = Plugin::instance();
+
+        $this->assertSame( 'doneproject-plugin', $plugin->slug );
+        $this->assertSame( '0.1.0', $plugin->version );
+    }
+
+    public function testOnActivateSetsDefaultGreetingWhenOptionIsMissing(): void {
+        $plugin = Plugin::instance();
+
+        $plugin->on_activate();
+
+        $this->assertSame( 'Tere', WPStub::$options['doneproject-plugin_greeting'] );
+        $this->assertSame(
+            array( 'doneproject-plugin_greeting', 'Tere' ),
+            WPStub::firstCall( 'update_option' )
+        );
+    }
+
+    public function testOnActivateKeepsAnExistingGreeting(): void {
+        $plugin = Plugin::instance();
+        WPStub::$options['doneproject-plugin_greeting'] = 'Hei';
+
+        $plugin->on_activate();
+
+        $this->assertSame( 'Hei', WPStub::$options['doneproject-plugin_greeting'] );
+        $this->assertFalse( WPStub::called( 'update_option' ) );
+    }
+
+    public function testOnDeactivateDoesNothing(): void {
+        $plugin = Plugin::instance();
+
+        $plugin->on_deactivate();
+
+        $this->assertFalse( WPStub::called( 'update_option' ) );
+    }
+
+    public function testInitAdminCreatesAdminOnlyInAdminContext(): void {
+        $plugin = Plugin::instance();
+        WPStub::$is_admin = false;
+
+        $plugin->init_admin();
+
+        $this->assertFalse( WPStub::called( 'add_options_page' ) );
+        $this->assertSame(
+            array(),
+            array_filter( WPStub::callsTo( 'add_action' ), static function ( $call ) {
+                return 'admin_init' === $call[0];
+            } )
+        );
+
+        WPStub::$is_admin = true;
+        $plugin->init_admin();
+
+        $adminInitHooks = array_filter( WPStub::callsTo( 'add_action' ), static function ( $call ) {
+            return 'admin_init' === $call[0];
+        } );
+        $this->assertCount( 1, $adminInitHooks );
+        $this->assertInstanceOf( Admin::class, reset( $adminInitHooks )[1][0] );
+    }
+
+    public function testInitFrontendRegistersShortcodes(): void {
+        $plugin = Plugin::instance();
+
+        $plugin->init_frontend();
+
+        $tags = array_column( WPStub::callsTo( 'add_shortcode' ), 0 );
+        $this->assertSame( array( 'doneproject', 'doneproject_pages', 'doneproject_list' ), $tags );
+        $this->assertInstanceOf( Frontend::class, WPStub::firstCall( 'add_shortcode' )[1][0] );
+    }
+
+    public function testInitRestRegistersRoute(): void {
+        $plugin = Plugin::instance();
+
+        $plugin->init_rest();
+
+        $call = WPStub::firstCall( 'register_rest_route' );
+        $this->assertSame( 'doneproject/v1', $call[0] );
+        $this->assertInstanceOf( REST::class, $call[2]['callback'][0] );
+    }
+}
diff --git a/tests/RESTTest.php b/tests/RESTTest.php
new file mode 100644
index 0000000..e79288a
--- /dev/null
+++ b/tests/RESTTest.php
@@ -0,0 +1,51 @@
+<?php
+namespace DoneProject\Tests;
+
+use DoneProject\REST;
+
+class RESTTest extends TestCase {
+    public function testConstructorRegistersHelloRoute(): void {
+        new REST( $this->pluginStub() );
+
+        $call = WPStub::firstCall( 'register_rest_route' );
+        $this->assertNotNull( $call );
+        $this->assertSame( 'doneproject/v1', $call[0] );
+        $this->assertSame( '/hello', $call[1] );
+        $this->assertSame( 'GET', $call[2]['methods'] );
+        $this->assertSame( '__return_true', $call[2]['permission_callback'] );
+        $this->assertSame( 'hello', $call[2]['callback'][1] );
+    }
+
+    public function testHelloUsesStoredGreeting(): void {
+        WPStub::$options['doneproject-plugin_greeting'] = 'Hei';
+        $rest = new REST( $this->pluginStub() );
+
+        $response = $rest->hello( null );
+
+        $this->assertSame( array( 'message' => 'Hei maailm' ), $response );
+    }
+
+    public function testHelloFallsBackToDefaultGreeting(): void {
+        $rest = new REST( $this->pluginStub() );
+
+        $response = $rest->hello( null );
+
+        $this->assertSame( array( 'message' => 'Tere maailm' ), $response );
+        $this->assertSame( array( 'doneproject-plugin_greeting', 'Tere' ), WPStub::firstCall( 'get_option' ) );
+    }
+
+    public function testHelloReadsTheOptionOfTheGivenPluginSlug(): void {
+        WPStub::$options['other-slug_greeting'] = 'Moi';
+        $rest = new REST( $this->pluginStub( 'other-slug' ) );
+
+        $this->assertSame( array( 'message' => 'Moi maailm' ), $rest->hello( null ) );
+    }
+
+    public function testHelloPassesResponseThroughRestEnsureResponse(): void {
+        $rest = new REST( $this->pluginStub() );
+
+        $rest->hello( null );
+
+        $this->assertCount( 1, WPStub::callsTo( 'rest_ensure_response' ) );
+    }
+}
diff --git a/tests/TestCase.php b/tests/TestCase.php
new file mode 100644
index 0000000..a4b1a66
--- /dev/null
+++ b/tests/TestCase.php
@@ -0,0 +1,42 @@
+<?php
+namespace DoneProject\Tests;
+
+use PHPUnit\Framework\TestCase as PHPUnitTestCase;
+
+abstract class TestCase extends PHPUnitTestCase {
+    protected function setUp(): void {
+        parent::setUp();
+        WPStub::reset();
+    }
+
+    protected function tearDown(): void {
+        WPStub::reset();
+        unset( $GLOBALS['doneproject_current_post'] );
+        parent::tearDown();
+    }
+
+    /**
+     * Plugin double exposing the slug/version the plugin classes read.
+     */
+    protected function pluginStub( string $slug = 'doneproject-plugin', string $version = '0.1.0' ): object {
+        return new class( $slug, $version ) {
+            public $slug;
+            public $version;
+
+            public function __construct( $slug, $version ) {
+                $this->slug = $slug;
+                $this->version = $version;
+            }
+        };
+    }
+
+    /**
+     * @param mixed[] $args
+     * @return mixed
+     */
+    protected function callPrivate( object $object, string $method, array $args = array() ) {
+        $reflection = new \ReflectionMethod( $object, $method );
+        $reflection->setAccessible( true );
+        return $reflection->invokeArgs( $object, $args );
+    }
+}
diff --git a/tests/WPStub.php b/tests/WPStub.php
new file mode 100644
index 0000000..10ec69b
--- /dev/null
+++ b/tests/WPStub.php
@@ -0,0 +1,62 @@
+<?php
+namespace DoneProject\Tests;
+
+/**
+ * Collects the WordPress API calls made by the plugin and holds the values the
+ * stubbed functions should return.
+ */
+class WPStub {
+    /** @var array<string, array<int, array>> */
+    public static $calls = array();
+
+    /** @var array<string, mixed> */
+    public static $options = array();
+
+    /** @var bool */
+    public static $is_admin = false;
+
+    /** @var bool */
+    public static $current_user_can = true;
+
+    /** @var array Posts returned by the WP_Query stub. */
+    public static $posts = array();
+
+    /** @var array{basedir: string, baseurl: string} */
+    public static $upload_dir = array( 'basedir' => '/uploads', 'baseurl' => 'http://example.com/wp-content/uploads' );
+
+    /** @var bool */
+    public static $mkdir_p = true;
+
+    /** @var mixed Image editor returned by wp_get_image_editor(). */
+    public static $image_editor = null;
+
+    public static function reset(): void {
+        self::$calls = array();
+        self::$options = array();
+        self::$is_admin = false;
+        self::$current_user_can = true;
+        self::$posts = array();
+        self::$upload_dir = array( 'basedir' => '/uploads', 'baseurl' => 'http://example.com/wp-content/uploads' );
+        self::$mkdir_p = true;
+        self::$image_editor = null;
+    }
+
+    public static function record( string $function, array $args ): void {
+        self::$calls[ $function ][] = $args;
+    }
+
+    /**
+     * @return array<int, array> Arguments of every recorded call to $function.
+     */
+    public static function callsTo( string $function ): array {
+        return self::$calls[ $function ] ?? array();
+    }
+
+    public static function firstCall( string $function ): ?array {
+        return self::$calls[ $function ][0] ?? null;
+    }
+
+    public static function called( string $function ): bool {
+        return ! empty( self::$calls[ $function ] );
+    }
+}
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
new file mode 100644
index 0000000..b666cb7
--- /dev/null
+++ b/tests/bootstrap.php
@@ -0,0 +1,9 @@
+<?php
+/**
+ * PHPUnit bootstrap: fakes a WordPress runtime before the plugin classes load.
+ */
+
+define( 'ABSPATH', __DIR__ . '/wp/' );
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/wp-stubs.php';
diff --git a/tests/wp-stubs.php b/tests/wp-stubs.php
new file mode 100644
index 0000000..796fe78
--- /dev/null
+++ b/tests/wp-stubs.php
@@ -0,0 +1,274 @@
+<?php
+/**
+ * Minimal stand-ins for the WordPress functions and classes the plugin uses, so
+ * the plugin classes can be unit tested without a WordPress installation.
+ */
+
+use DoneProject\Tests\WPStub;
+
+class WP_Error {
+    private $code;
+    private $message;
+
+    public function __construct( $code = '', $message = '' ) {
+        $this->code = $code;
+        $this->message = $message;
+    }
+
+    public function get_error_code() {
+        return $this->code;
+    }
+
+    public function get_error_message() {
+        return $this->message;
+    }
+}
+
+/**
+ * Iterates over WPStub::$posts the way WP_Query iterates over found posts.
+ */
+class WP_Query {
+    public $args;
+    public $posts;
+    private $position = -1;
+
+    public function __construct( $args = array() ) {
+        $this->args = $args;
+        $this->posts = WPStub::$posts;
+        WPStub::record( 'WP_Query', array( $args ) );
+    }
+
+    public function have_posts() {
+        return $this->position + 1 < count( $this->posts );
+    }
+
+    public function the_post() {
+        $this->position++;
+        $GLOBALS['doneproject_current_post'] = $this->posts[ $this->position ];
+    }
+}
+
+/**
+ * Image editor double: records resize()/save() calls and returns configured results.
+ */
+class DoneProject_Fake_Image_Editor {
+    public $resize_result;
+    public $save_result;
+    public $resize_calls = array();
+    public $save_calls = array();
+
+    public function __construct( $save_result = array( 'path' => '/uploads/doneproject-thumbs/thumb.jpg' ), $resize_result = true ) {
+        $this->save_result = $save_result;
+        $this->resize_result = $resize_result;
+    }
+
+    public function resize( $width, $height, $crop = false ) {
+        $this->resize_calls[] = array( $width, $height, $crop );
+        return $this->resize_result;
+    }
+
+    public function save( $path ) {
+        $this->save_calls[] = $path;
+        if ( is_array( $this->save_result ) && ! empty( $this->save_result['create'] ) ) {
+            file_put_contents( $path, 'thumb' );
+        }
+        return $this->save_result;
+    }
+}
+
+function add_action( $hook, $callback, $priority = 10, $accepted_args = 1 ) {
+    WPStub::record( 'add_action', array( $hook, $callback, $priority ) );
+    return true;
+}
+
+function add_shortcode( $tag, $callback ) {
+    WPStub::record( 'add_shortcode', array( $tag, $callback ) );
+}
+
+function register_activation_hook( $file, $callback ) {
+    WPStub::record( 'register_activation_hook', array( $file, $callback ) );
+}
+
+function register_deactivation_hook( $file, $callback ) {
+    WPStub::record( 'register_deactivation_hook', array( $file, $callback ) );
+}
+
+function get_option( $name, $default = false ) {
+    WPStub::record( 'get_option', array( $name, $default ) );
+    return array_key_exists( $name, WPStub::$options ) ? WPStub::$options[ $name ] : $default;
+}
+
+function update_option( $name, $value ) {
+    WPStub::record( 'update_option', array( $name, $value ) );
+    WPStub::$options[ $name ] = $value;
+    return true;
+}
+
+function is_admin() {
+    return WPStub::$is_admin;
+}
+
+function current_user_can( $capability ) {
+    WPStub::record( 'current_user_can', array( $capability ) );
+    return WPStub::$current_user_can;
+}
+
+function add_options_page( $page_title, $menu_title, $capability, $menu_slug, $callback ) {
+    WPStub::record( 'add_options_page', array( $page_title, $menu_title, $capability, $menu_slug, $callback ) );
+}
+
+function register_setting( $group, $name, $args = array() ) {
+    WPStub::record( 'register_setting', array( $group, $name, $args ) );
+}
+
+function add_settings_section( $id, $title, $callback, $page ) {
+    WPStub::record( 'add_settings_section', array( $id, $title, $callback, $page ) );
+}
+
+function add_settings_field( $id, $title, $callback, $page, $section = 'default' ) {
+    WPStub::record( 'add_settings_field', array( $id, $title, $callback, $page, $section ) );
+}
+
+function settings_fields( $group ) {
+    WPStub::record( 'settings_fields', array( $group ) );
+    echo '<input type="hidden" name="option_page" value="' . $group . '" />';
+}
+
+function do_settings_sections( $page ) {
+    WPStub::record( 'do_settings_sections', array( $page ) );
+}
+
+function submit_button( $text = null ) {
+    WPStub::record( 'submit_button', array( $text ) );
+    echo '<input type="submit" value="Save" />';
+}
+
+function register_rest_route( $namespace, $route, $args = array() ) {
+    WPStub::record( 'register_rest_route', array( $namespace, $route, $args ) );
+    return true;
+}
+
+function rest_ensure_response( $response ) {
+    WPStub::record( 'rest_ensure_response', array( $response ) );
+    return $response;
+}
+
+function wp_register_style( $handle, $src = '', $deps = array(), $version = false ) {
+    WPStub::record( 'wp_register_style', array( $handle, $src, $deps, $version ) );
+}
+
+function wp_register_script( $handle, $src = '', $deps = array(), $version = false, $in_footer = false ) {
+    WPStub::record( 'wp_register_script', array( $handle, $src, $deps, $version, $in_footer ) );
+}
+
+function wp_enqueue_style( $handle ) {
+    WPStub::record( 'wp_enqueue_style', array( $handle ) );
+}
+
+function wp_enqueue_script( $handle ) {
+    WPStub::record( 'wp_enqueue_script', array( $handle ) );
+}
+
+function plugins_url( $path = '', $plugin = '' ) {
+    return 'http://example.com/wp-content/plugins/doneproject-plugin/' . ltrim( $path, '/' );
+}
+
+function shortcode_atts( $pairs, $atts, $shortcode = '' ) {
+    $atts = (array) $atts;
+    $out = array();
+    foreach ( $pairs as $name => $default ) {
+        $out[ $name ] = array_key_exists( $name, $atts ) ? $atts[ $name ] : $default;
+    }
+    return $out;
+}
+
+function sanitize_text_field( $value ) {
+    return trim( strip_tags( (string) $value ) );
+}
+
+function sanitize_title( $value ) {
+    $value = strtolower( trim( (string) $value ) );
+    $value = preg_replace( '/[^a-z0-9_\-]+/', '-', $value );
+    return trim( $value, '-' );
+}
+
+function esc_html( $text ) {
+    return htmlspecialchars( (string) $text, ENT_QUOTES );
+}
+
+function esc_attr( $text ) {
+    return htmlspecialchars( (string) $text, ENT_QUOTES );
+}
+
+function esc_html__( $text, $domain = 'default' ) {
+    WPStub::record( 'esc_html__', array( $text, $domain ) );
+    return htmlspecialchars( $text, ENT_QUOTES );
+}
+
+function esc_url( $url ) {
+    return str_replace( ' ', '%20', (string) $url );
+}
+
+function esc_url_raw( $url ) {
+    return trim( (string) $url );
+}
+
+function wp_kses_post( $content ) {
+    return $content;
+}
+
+function wpautop( $text ) {
+    return '<p>' . $text . '</p>';
+}
+
+function get_the_ID() {
+    return $GLOBALS['doneproject_current_post']['ID'] ?? 0;
+}
+
+function get_the_title() {
+    return $GLOBALS['doneproject_current_post']['title'] ?? '';
+}
+
+function get_permalink() {
+    return $GLOBALS['doneproject_current_post']['permalink'] ?? '';
+}
+
+function get_the_excerpt() {
+    return $GLOBALS['doneproject_current_post']['excerpt'] ?? '';
+}
+
+function get_post_field( $field, $post_id ) {
+    WPStub::record( 'get_post_field', array( $field, $post_id ) );
+    foreach ( WPStub::$posts as $post ) {
+        if ( ( $post['ID'] ?? null ) === $post_id ) {
+            return $post[ $field ] ?? '';
+        }
+    }
+    return '';
+}
+
+function wp_reset_postdata() {
+    WPStub::record( 'wp_reset_postdata', array() );
+    unset( $GLOBALS['doneproject_current_post'] );
+}
+
+function wp_get_upload_dir() {
+    return WPStub::$upload_dir;
+}
+
+function wp_mkdir_p( $dir ) {
+    WPStub::record( 'wp_mkdir_p', array( $dir ) );
+    if ( ! WPStub::$mkdir_p ) {
+        return false;
+    }
+    return is_dir( $dir ) || mkdir( $dir, 0777, true );
+}
+
+function wp_get_image_editor( $path ) {
+    WPStub::record( 'wp_get_image_editor', array( $path ) );
+    return WPStub::$image_editor;
+}
+
+function is_wp_error( $thing ) {
+    return $thing instanceof WP_Error;
+}