chore: save iqon static deploy snapshot

2026-05-20 17:21:42 +03:00
parent 497f2450e9
commit c023fe5d8d
121 changed files with 3211 additions and 24373 deletions
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# SPEC: wp-snippets/README.md#verification
+# Compliance date: 2026-05-20
+# Launch type: manual post-deployment verification
+# Registry: iqon Phase 1 hardening verification
+
+set -u
+
+BASE_URL="${1:-https://iqon.com}"
+FAILED=0
+
+note() {
+  printf '\n[%s] %s\n' "$1" "$2"
+}
+
+fail() {
+  FAILED=1
+  printf '[FAIL] %s\n' "$1"
+}
+
+pass() {
+  printf '[PASS] %s\n' "$1"
+}
+
+fetch_headers() {
+  curl -sS -I -L "$BASE_URL/"
+}
+
+fetch_home() {
+  curl -sS -L "$BASE_URL/"
+}
+
+note CHECK "Security headers"
+if ! HEADERS="$(fetch_headers)"; then
+  HEADERS=""
+  fail 'could not fetch homepage headers'
+fi
+printf '%s\n' "$HEADERS" | rg -qi '^x-content-type-options:\s*nosniff' \
+  && pass 'X-Content-Type-Options present' \
+  || fail 'X-Content-Type-Options missing'
+printf '%s\n' "$HEADERS" | rg -qi '^x-frame-options:\s*SAMEORIGIN' \
+  && pass 'X-Frame-Options present' \
+  || fail 'X-Frame-Options missing'
+printf '%s\n' "$HEADERS" | rg -qi '^referrer-policy:' \
+  && pass 'Referrer-Policy present' \
+  || fail 'Referrer-Policy missing'
+printf '%s\n' "$HEADERS" | rg -qi '^permissions-policy:' \
+  && pass 'Permissions-Policy present' \
+  || fail 'Permissions-Policy missing'
+printf '%s\n' "$HEADERS" | rg -qi '^content-security-policy:' \
+  && pass 'Content-Security-Policy present' \
+  || fail 'Content-Security-Policy missing'
+
+note CHECK "Homepage HTML"
+if HOME="$(fetch_home)"; then
+  printf '%s\n' "$HOME" | rg -q 'name=["'\'']viewport["'\'']' \
+    && pass 'viewport present' \
+    || fail 'viewport missing'
+  printf '%s\n' "$HOME" | rg -q 'iqon-skip-link' \
+    && pass 'skip link present' \
+    || fail 'skip link missing'
+  printf '%s\n' "$HOME" | rg -q 'http://www\.iqon\.com|http://iqon\.com|http://maps\.google\.com|http://maps\.googleapis\.com' \
+    && fail 'known HTTP URLs still present' \
+    || pass 'known HTTP URLs absent'
+  printf '%s\n' "$HOME" | rg -q 'property=["'\'']og:site_name["'\''][^>]*content=["'\'']- IQON["'\'']' \
+    && fail 'og:site_name still has - IQON' \
+    || pass 'og:site_name no longer has - IQON'
+else
+  fail 'could not fetch homepage HTML'
+fi
+
+note CHECK "REST users endpoint"
+if USERS_BODY="$(curl -sS -L "$BASE_URL/wp-json/wp/v2/users")"; then
+  printf '%s\n' "$USERS_BODY" | rg -q '"slug"\s*:\s*"(admin|iqnadm01)"' \
+    && fail 'public REST users still exposed' \
+    || pass 'public REST users not exposed'
+else
+  fail 'could not fetch REST users endpoint'
+fi
+
+note CHECK "Install documents"
+README_STATUS="$(curl -sS -o /dev/null -w '%{http_code}' -L "$BASE_URL/readme.html")"
+case "$README_STATUS" in
+  403|404) pass "readme.html blocked with $README_STATUS" ;;
+  *) fail "readme.html returned $README_STATUS" ;;
+esac
+
+note CHECK "XML-RPC HEAD smoke"
+XMLRPC_STATUS="$(curl -sS -o /dev/null -w '%{http_code}' -I --http1.1 "$BASE_URL/xmlrpc.php")"
+XMLRPC_CURL_STATUS=$?
+case "$XMLRPC_STATUS" in
+  403|404|405) pass "xmlrpc.php not plainly usable via HEAD: $XMLRPC_STATUS" ;;
+  000)
+    if [ "$XMLRPC_CURL_STATUS" -eq 52 ]; then
+      pass "xmlrpc.php returned empty reply via HEAD: $XMLRPC_STATUS"
+    else
+      fail "xmlrpc.php check failed with curl status $XMLRPC_CURL_STATUS"
+    fi
+    ;;
+  *) fail "xmlrpc.php returned $XMLRPC_STATUS; run safe POST check" ;;
+esac
+
+printf '\n'
+if [ "$FAILED" -eq 0 ]; then
+  printf '[OK] iqon Phase 1 verification passed for %s\n' "$BASE_URL"
+else
+  printf '[FAIL] iqon Phase 1 verification failed for %s\n' "$BASE_URL"
+fi
+
+exit "$FAILED"