# IQON Phase 1 Hosting Rules

Purpose: зафиксировать server-level правила для рисков, которые WordPress snippet не может гарантированно закрыть.

## Contents

- [Scope](#scope)
- [nginx Draft](#nginx-draft)
- [Apache htaccess Draft](#apache-htaccess-draft)
- [reg.ru Shared Hosting Path](#regru-shared-hosting-path)
- [Verification](#verification)
- [Rollback](#rollback)

## Scope

Эти правила не применены на live-сайте. Они являются draft-артефактом для внедрения после backup и явного подтверждения на remote write.

## nginx Draft

```nginx
location ~* ^/(readme|license)\.html$ {
    return 404;
}

location = /xmlrpc.php {
    return 403;
}
```

## Apache htaccess Draft

Use only if the hosting route confirms Apache or `.htaccess` processing for this site.

```apache
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^(readme|license)\.html$ - [R=404,L,NC]
RewriteRule ^xmlrpc\.php$ - [F,L,NC]
</IfModule>
```

## reg.ru Shared Hosting Path

If neither nginx config nor `.htaccess` is available, use a file-level fallback after backup:

1. Confirm that `/readme.html` and `/license.html` are physical public files.
2. Download or copy those files into the dated backup bundle.
3. Remove the public files or replace them with non-sensitive 404 placeholders.
4. Re-run verification commands below.

Do not overwrite server files without reading the destination first.

## Verification

```bash
curl -I -L https://iqon.com/readme.html
curl -I -L https://iqon.com/license.html
curl -I --http1.1 https://iqon.com/xmlrpc.php
```

Expected signal:

- `readme.html` returns `403` or `404`.
- `license.html` returns `403` or `404`.
- `xmlrpc.php` returns `403`, `404`, `405`, or another intentionally blocked status after confirming no integration depends on XML-RPC.

## Rollback

1. Remove only the rule that caused the confirmed regression.
2. Restore public files only from the dated backup if file-level fallback was used.
3. Re-run the same verification commands.
4. Document the before/after status in the deployment notes.

---

*Created: 20 May 2026*
*Updated: 20 May 2026*