diff --git a/reports/current-plan-status-2026-05-20.md b/reports/current-plan-status-2026-05-20.md
new file mode 100644
index 0000000..ea77445
--- /dev/null
+++ b/reports/current-plan-status-2026-05-20.md
@@ -0,0 +1,53 @@
+# IQON current plan status
+
+Purpose: record the current state of the IQON remediation plan after backup, hardening, redirects, contact smoke, and retention decisions.
+
+Created: 2026-05-20
+Updated: 2026-05-20
+
+## Current decisions
+
+1. Apex `iqon.com` remains on the old hardened WordPress design.
+2. `www.iqon.com` remains on the new static redesign.
+3. Public site policy is English-only.
+4. Remote plaintext DB archive remains on the hosting account as a rollback layer.
+5. Encrypted local DB archive remains the durable secure backup layer.
+6. WordPress static snapshot is deferred.
+
+## Completed plan items
+
+| Item | Status | Evidence |
+|---|---|---|
+| Old WordPress hardening | Done | Phase verification script passed repeatedly |
+| Mobile contact overflow | Done | Browser QA after patch showed no 390px overflow |
+| SEO cleanup | Done | `og:site_name=IQON`, HTTPS URL rewrite, English redirects |
+| Contacts cleanup | Done | Contact page uses `office@iqon.com` and `@infobidgebot` |
+| Contact form smoke | Done | Form returned `sent=ok` success script |
+| English-only redirects | Done | Sampled 301 rules passed |
+| DB archive creation | Done | Remote and local `gzip -t` passed |
+| Encrypted local backup | Done | Decrypt-to-`gzip -t` passed; key stored in Vaultwarden |
+| Remote backup retention | Decided | Remote archive remains by owner decision |
+
+## Current backup layers
+
+| Layer | Location | Purpose |
+|---|---|---|
+| Remote rollback archive | `/var/www/u0012812/data/backups/iqon-u0012812_iqon-20260520-231601.sql.gz` | Fast hosting-side rollback source |
+| Encrypted durable archive | `/Users/svmac/.codex/memories/secure-artifacts/iqon/iqon-u0012812_iqon-20260520-231601.sql.gz.enc` | Local encrypted backup copy |
+| Vaultwarden key | `IQON DB archive encryption key - 20260520-231601` | Decryption passphrase |
+
+## Remaining optional work
+
+1. Confirm inbox delivery of the contact smoke email if mailbox access is needed.
+2. Decide whether to retire WordPress later by taking a static snapshot of the old design.
+3. Periodically re-run live health checks after DNS/hosting changes.
+4. Review old WordPress plugins/admin surface if deeper security hardening is desired.
+
+## Baseline health commands
+
+```bash
+scripts/iqon-phase1-verify.sh https://iqon.com
+curl -k -sS -L https://www.iqon.com/ | rg -n "theme-color|hero-cloud|topbar"
+curl -k -sS -I 'https://iqon.com/homepage/' | rg -n '^HTTP/|^location:'
+curl -k -sS -I 'https://iqon.com/%d1%83%d1%81%d0%bb%d1%83%d0%b3%d0%b8-%d1%80%d0%b5%d1%88%d0%b5%d0%bd%d0%b8%d1%8f/' | rg -n '^HTTP/|^location:'
+```