# Полный аудит iqon.com

Purpose: текущий аудит live-сайта `iqon.com` и план необходимых изменений с опорой на Open Design `design-review` и `frontend-design`.

## Contents

- [Executive Finding](#executive-finding)
- [Verified Live Facts](#verified-live-facts)
- [Open Design Assessment](#open-design-assessment)
- [Findings](#findings)
- [Change Plan](#change-plan)
- [Recommended Strategy](#recommended-strategy)
- [Phase 1 Local Package](#phase-1-local-package)
- [Phase 2 URL Cleanup Package](#phase-2-url-cleanup-package)
- [Phase 3 Content Structure Package](#phase-3-content-structure-package)
- [Phase 4 Static Prototype Package](#phase-4-static-prototype-package)
- [Verification Checklist](#verification-checklist)
- [Open Questions](#open-questions)

## Executive Finding

`iqon.com` сейчас выглядит и работает как legacy WordPress-сайт 2012-2013 года с частично обновлённой платформой. PHP 8 и jQuery fixes применены, но сайт всё ещё не соответствует современному уровню B2B IT-консалтинга: фиксированная ширина 960px, устаревший контент, слабая SEO-семантика, открытые WordPress surfaces, mixed content и отсутствие ключевых security headers.

Главная рекомендация: не развивать текущую тему как долгосрочную основу. Правильнее использовать быстрый hardening текущего WordPress как временную меру, затем заменить публичный сайт на статический или headless/static-пакет на базе локального light redesign.

## Verified Live Facts

Проверено 19 May 2026.

| Area | Fact | Evidence |
|------|------|----------|
| Canonical host | `https://www.iqon.com/` redirects to `https://iqon.com/` | `curl -I -L https://www.iqon.com/` |
| HTTPS | HSTS present: `strict-transport-security: max-age=31536000` | `curl -I -L https://www.iqon.com/` |
| Security headers | CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy absent from sampled homepage headers | `curl -I -L https://www.iqon.com/` |
| WordPress REST | `/wp-json/` is public and exposes namespaces/routes | `curl https://www.iqon.com/wp-json/` |
| Users endpoint | Public users include `admin` and `iqnadm01` | `curl https://iqon.com/wp-json/wp/v2/users` |
| Yoast | Live HTML shows Yoast SEO plugin v27.3 | homepage HTML |
| Readme | `https://iqon.com/readme.html` returns HTTP 200 | `curl -I -L https://iqon.com/readme.html` |
| Sitemap | `page-sitemap.xml` has 66 URLs | parsed sitemap |
| Sitemap duplicates | 3 duplicated URL groups: `/industry-specific-services/` x2, `/contact/` x2, `/homepage/` x3 | parsed sitemap |
| Encoded URLs | 29 sitemap URLs are percent-encoded Cyrillic paths | parsed sitemap |
| Last content freshness | Latest page sitemap `lastmod` is `2013-07-25T11:20:03+00:00` | parsed sitemap |
| Theme layout | CSS uses fixed `#wrapper { width: 960px; }` and no responsive media strategy in theme CSS | live `style.css` |
| Contact page | Contact page embeds HTTP Google Maps iframe and uses legacy `jquery.realperson` CAPTCHA | `curl https://iqon.com/contact/` |
| Homepage mixed content | Homepage includes HTTP hero/image/OG resources | homepage HTML |
| XML-RPC | `xmlrpc.php` gives empty reply under HTTP/1.1 HEAD check; treat as unresolved until POST-tested | `curl -I --http1.1 https://iqon.com/xmlrpc.php` |

Important correction: old local memory says WordPress 4.9.13. The live site now exposes newer platform signals, including Yoast 27.3 and modern REST namespaces. Exact WordPress core version was not confirmed in this audit, so do not repeat `WP 4.9.13` as a current live fact without a direct core-version check.

## Open Design Assessment

The requested `opendesign` skill is represented locally by Open Design skill entries `design-review` and `frontend-design`.

Applied Open Design criteria:

- Production interface should be responsive, not fixed-width desktop.
- Navigation and page sections should use semantic HTML and predictable scan patterns.
- B2B/consulting interface should feel clear, credible, current, and operationally useful.
- Typography, spacing, color, focus states, and layout should be systematic rather than incidental.
- A redesign should be the actual usable site, not a marketing mockup disconnected from contact, services, and cases.

Live `iqon.com` fails the production UI bar mainly because its visual system is still built around fixed pixel widths, floats, absolute positioning, old fonts, image-based buttons, and content from 2012-2013. The local root static draft is closer to the right direction than the live site: it has semantic sections, modern typography, a responsive viewport, clear service tiles, and current consulting language.

## Findings

### P0 — Security And Exposure

| Finding | Severity | Evidence | Required Change |
|---------|----------|----------|-----------------|
| Public REST user enumeration | High | `/wp-json/wp/v2/users` exposes `admin`, `iqnadm01` | Restrict user endpoints and author archives; preserve only required public REST routes |
| Missing defensive headers | High | Homepage headers only show HSTS among sampled security headers | Add CSP, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy |
| Public `readme.html` | Medium | `readme.html` returns HTTP 200 | Block or return 404/403 for readme and other install docs |
| Legacy contact CAPTCHA | Medium | `jquery.realperson` plugin is from 2009 and uses removed `.live()` API | Replace CAPTCHA/contact flow or browser-test and patch compatibility immediately |
| XML-RPC state unresolved | Medium | HEAD check produced empty reply | Perform safe POST method check; disable XML-RPC unless explicitly needed |

### P0 — Mixed Content And Trust

| Finding | Severity | Evidence | Required Change |
|---------|----------|----------|-----------------|
| HTTP hero image and link | High | Homepage uses `http://www.iqon.com/...homepage.png` and `http://www.iqon.com/hows-business/` | Replace with HTTPS/canonical URLs |
| HTTP OG image and schema thumbnail | High | `og:image` and schema image point to HTTP | Set HTTPS image URL in Yoast/schema filters |
| HTTP Google Maps iframe | Medium | Contact page iframe uses `http://maps.google.com/...` | Replace with HTTPS embed or static contact block |

### P1 — SEO And Information Architecture

| Finding | Severity | Evidence | Required Change |
|---------|----------|----------|-----------------|
| Duplicate title tags | High | Homepage has initial `<title>` plus Yoast `<title>` | Ensure exactly one meaningful title |
| Weak homepage title | High | Yoast title is only `How’s business?` | Use brand/category: `IQON | IT Strategy and Transformation Consulting` |
| Broken brand name in metadata | Medium | `og:site_name` is `- IQON` | Set site name to `IQON` |
| Stale sitemap dates | High | latest page `lastmod` is 2013-07-25 | Update content or noindex stale pages until refreshed |
| Duplicate sitemap URLs | Medium | 3 duplicated URL groups in sitemap | Remove duplicate pages or canonicalize/redirect |
| 29 encoded Cyrillic URLs | Medium | percent-encoded Russian URL paths in sitemap | Decide: keep bilingual architecture with hreflang, or noindex/redirect archived Russian pages |
| Thin service landing page | High | `/services-solutions/` renders only a heading | Build meaningful service overview with links and conversion path |
| Single old case study | Medium | case studies archive shows one 2010-era Rompetrol case | Add current cases or reposition as historical archive |

### P1 — Design, UX, Accessibility

| Finding | Severity | Evidence | Required Change |
|---------|----------|----------|-----------------|
| No mobile-first layout | High | CSS fixed `960px` wrapper and desktop floats | Replace with responsive grid/flex layout |
| No viewport meta in live theme | High | sampled live pages omit viewport meta | Add viewport immediately |
| Div-based navigation | Medium | `div#menu`, `div#content`, `div#footer` | Use `header`, `nav`, `main`, `section`, `footer` in redesign |
| Missing image alt text | Medium | hero/case images have no useful alt | Add descriptive alt or mark decorative images |
| No visible focus system in theme CSS | Medium | theme CSS has hover styles, no focus-visible system | Add keyboard focus states |
| Image buttons | Low | case/read and submit use image-based controls | Replace with semantic buttons/links and text labels |

### P1 — Content And Positioning

| Finding | Severity | Evidence | Required Change |
|---------|----------|----------|-----------------|
| Brand message is dated | High | homepage leads with old case-study headline, not clear offer | Define current IQON positioning and value proposition |
| Footer copyright stale | Medium | live footer says 2016 | Update copyright and legal footer |
| Contact information conflicts | Medium | local draft and live site have different phone/address details | Choose canonical contact data before launch |
| Russian/Kazakhstan offices may be stale | Medium | contact page lists Moscow and Almaty office details | Verify active offices before publishing |

### P2 — Technical Debt

| Finding | Severity | Evidence | Required Change |
|---------|----------|----------|-----------------|
| WordPress core version unknown | Medium | live signals differ from old memory | Confirm via admin/core files before platform decision |
| Legacy theme still active | High | theme CSS and markup are still 2012-style | Do not invest heavily in theme beyond hardening |
| Google-hosted jQuery dependency | Medium | loads jQuery from `ajax.googleapis.com` | Prefer local bundled asset or verified CDN policy |
| `jquery.realperson` compatibility risk | Medium | plugin uses `.live()` while jQuery is 3.7.1 | Replace or patch plugin |

## Change Plan

### Phase 0 — Backup And Baseline

| Task | Owner Action | Verification |
|------|--------------|--------------|
| Confirm DB archive completion | Check reg.ru backup archive status for `u0012812_iqon` | Archive exists and can be downloaded |
| Capture current live HTML/CSS | Save homepage/contact/services/case samples | Files exist in backup folder |
| Confirm WP core version | Check admin/core/version source | Exact version recorded |
| Browser-test contact form | Submit safe test using non-production message | Form validation and delivery behavior known |

### Phase 1 — Same-Day Hardening

| Task | Method | Expected Signal |
|------|--------|-----------------|
| Add viewport meta | `wp_head` or output buffering snippet | HTML contains `<meta name="viewport" content="width=device-width, initial-scale=1">` |
| Replace HTTP URLs | DB update or output buffering | `rg "http://www.iqon.com|http://maps.google.com"` returns no live HTML hits |
| Add security headers | nginx/hosting config or WP `send_headers` | Headers include CSP/frame/content/referrer/permissions policy |
| Restrict REST users | WP filter or security plugin | `/wp-json/wp/v2/users` no longer exposes usernames |
| Block readme | nginx/hosting rule or WP redirect | `readme.html` returns 403/404 |
| Disable XML-RPC if unused | hosting rule or WP filter | XML-RPC cannot be used for pingback/login abuse |

### Phase 2 — SEO And Content Cleanup

| Task | Method | Expected Signal |
|------|--------|-----------------|
| Fix site name | Yoast/site settings | `og:site_name` is `IQON` |
| Fix homepage title and description | Yoast/page settings | Search snippet describes IQON offer clearly |
| Fix sitemap duplicates | Delete/redirect/noindex duplicate pages | `/contact/`, `/homepage/`, `/industry-specific-services/` are singletons |
| Decide Russian URLs policy | hreflang bilingual mode or noindex/redirect archive | 29 encoded URLs have intentional index status |
| Rewrite services overview | Replace empty page content | `/services-solutions/` has meaningful overview and service cards |
| Update contact facts | Verify addresses/phones/emails | Live contact matches approved company data |

### Phase 3 — Open Design Redesign

Recommended direction: use the local root light redesign as the base, not the dark `new_redesign/` as-is.

| Task | Method | Expected Signal |
|------|--------|-----------------|
| Choose canonical local variant | Decide root draft vs `new_redesign/` | One source of truth recorded in memory |
| Build light B2B design system | Tokens for color, type, spacing, components | CSS variables and reusable sections exist |
| Rebuild navigation | Real URLs, mobile nav, semantic landmarks | Header works desktop/mobile |
| Rebuild services | 5 service pages or 5 sections with clear CTAs | Service pages have titles, descriptions, CTAs |
| Rebuild cases | Current case cards or historical archive framing | Case content no longer feels abandoned |
| Rebuild contact | Verified data, simple form/mailto/Telegram, privacy note | Contact path works without legacy CAPTCHA |

### Phase 4 — Deployment Strategy

| Option | Use When | Pros | Cons |
|--------|----------|------|------|
| Static replacement | Content can be frozen and maintained in repo | Fast, secure, low maintenance | Requires redirects and deployment discipline |
| New WordPress theme | Client needs WP editing | Preserves CMS workflows | More moving parts and security maintenance |
| Incremental legacy repair | Need risk reduction today | Fastest safe improvement | Does not solve brand/design/content age |

## Recommended Strategy

1. Execute Phase 0 and Phase 1 first. This reduces public risk without committing to a redesign path.
2. Choose static replacement unless there is a hard requirement for WordPress editing.
3. Use the light root draft as the base direction: it preserves the yellow IQON signal, reads more credible for B2B consulting, and avoids the overly dark tech-startup tone of `new_redesign/`.
4. Treat old WordPress content as source material, not as final copy. Most service pages and cases need rewriting, not restyling.
5. Keep the old site restorable until the new package passes desktop/mobile browser QA and URL redirect checks.

## Phase 1 Local Package

Prepared 20 May 2026, not deployed to live WordPress.

| Artifact | Purpose | Status |
|----------|---------|--------|
| `wp-snippets/iqon-phase1-hardening.php` | Reversible WordPress snippet for immediate hardening | Local draft |
| `wp-snippets/README.md` | Install draft, verification commands, rollback notes | Local draft |
| `wp-snippets/hosting-rules.md` | nginx/Apache/file-level drafts for install docs and XML-RPC | Local draft |
| `scripts/iqon-phase1-verify.sh` | Automated post-activation verification script | Local draft |
| `reports/phase1-baseline-2026-05-20.md` | Current live baseline before activation | Local report |

The snippet covers defensive headers, REST user endpoint removal, XML-RPC disable filter, viewport fallback, emergency responsive CSS, HTTP URL rewriting, Yoast site-name correction, and generator removal. The package intentionally does not include credentials and does not perform any remote writes.

Important limit: physical `readme.html` and `license.html` may be served by nginx before WordPress runs. The PHP snippet includes only a WordPress fallback; guaranteed enforcement requires hosting-level blocking or removing the files after backup.

Baseline result: `scripts/iqon-phase1-verify.sh https://iqon.com` currently fails on missing defensive headers, missing viewport, missing skip link, known HTTP URLs, `og:site_name`, public REST users, and `readme.html` returning `200`. This is expected before deployment and gives a comparison point after activation.

## Phase 2 URL Cleanup Package

Prepared 20 May 2026, not deployed to live WordPress.

| Artifact | Purpose | Status |
|----------|---------|--------|
| `reports/live-captures/2026-05-20/page-sitemap.xml` | Captured current Yoast page sitemap | Local capture |
| `scripts/iqon-sitemap-inventory.py` | Reproducible sitemap parser | Local tool |
| `seo/sitemap-inventory-2026-05-20.csv` | Parsed sitemap inventory | Local inventory |
| `seo/url-cleanup-plan-2026-05-20.md` | URL policy, duplicate cleanup, redirect drafts | Local plan |

Current inventory: 66 sitemap rows, 29 encoded multilingual URLs, 7 duplicate rows, 1 typo slug, 1 thin services landing, and 1 legacy home alias.

## Phase 3 Content Structure Package

Prepared 20 May 2026, not implemented on live site.

| Artifact | Purpose | Status |
|----------|---------|--------|
| `content/site-structure-brief-2026-05-20.md` | Target sitemap, positioning, page briefs, content backlog | Local brief |

Recommended structure: root homepage, `/services/`, five service detail pages, `/industries/`, `/case-studies/`, and `/contact/`. Required owner inputs before launch: canonical contact data, language policy, deployment target, service naming, case-study policy, and legal/privacy footer.

## Phase 4 Static Prototype Package

Prepared 20 May 2026, not deployed to live site.

| Artifact | Purpose | Status |
|----------|---------|--------|
| `index.html` | Updated homepage with real target-sitemap links | Local prototype |
| `services/index.html` | Services overview page | Local prototype |
| `services/*/index.html` | Five service detail pages | Local prototype |
| `industries/index.html` | Industry overview page | Local prototype |
| `case-studies/index.html` | Case-study decision placeholder | Local prototype |
| `contact/index.html` | Contact page with owner-confirmation notes | Local prototype |
| `sitemap.xml` | Static target sitemap | Local prototype |
| `robots.txt` | Static robots file | Local prototype |
| `reports/static-prototype-smoke-2026-05-20.md` | Local HTTP smoke results | Local report |
| `reports/visual-qa-2026-05-20.md` | Headless Chrome visual QA report | Local report |

Local smoke result: all 10 target pages plus `sitemap.xml` and `robots.txt` returned HTTP 200 through `python3 -m http.server 8061`. Headless Chrome mobile QA found and fixed horizontal clipping in nav, hero copy, and service-card copy. The prototype still needs owner input for contact data/cases before deployment.

## Verification Checklist

| Check | Command Or Method | Expected Signal |
|-------|-------------------|-----------------|
| Headers | `curl -I -L https://iqon.com/` | Security headers present |
| Mixed content | Fetch homepage/contact and search `http://` | No HTTP asset/embed URLs |
| REST users | `curl https://iqon.com/wp-json/wp/v2/users` | No public user list |
| Readme | `curl -I https://iqon.com/readme.html` | 403 or 404 |
| Sitemap | Parse `page-sitemap.xml` | No duplicate canonical URLs |
| Mobile | Browser at 390px width | No horizontal scroll, nav usable |
| Accessibility | Keyboard tab through header/form | Visible focus and reachable controls |
| Contact | Safe test submission | Known outcome: delivered, blocked, or replaced |

## Open Questions

- Which contact data is canonical: live Bucharest/Moscow/Almaty details or local draft Bucharest-only details?
- Should the site remain English-only, bilingual EN/RU, or archive Russian pages?
- Should the final site be static, WordPress, or hybrid?
- Are there current IQON case studies that can replace the 2010 Rompetrol example?
- Is `office@iqon.kz` still valid and monitored?

---

*Created: 19 May 2026, 22:45*
*Updated: 19 May 2026, 22:45*