---
task: Продолжить аудит iqon.com без остановок
slug: 20260520-005444_continue-iqon-phase1
effort: extended
phase: verify
progress: 20/20
mode: interactive
started: 2026-05-20T00:54:44Z
updated: 2026-05-20T00:59:00Z
---

# Продолжить аудит iqon.com без остановок

Purpose: превратить полный аудит `iqon.com` в локальный Phase 1 hardening-пакет без записи на live-сайт.

## Context

Пользователь попросил продолжать без остановок после полного аудита `iqon.com`. Без отдельного подтверждения нельзя писать во внешний WordPress/hosting, поэтому текущая работа ограничена локальными артефактами: готовый PHP snippet для Code Snippets, инструкция внедрения и проверочный чеклист. Источники: `iqon-full-audit-2026-05-19.md`, `/Users/svmac/.codex/memories/wiki/projects/iqon-com.md`, live-проверки из предыдущего шага.

## Criteria

- [x] ISC-1: Git status inspected before local file edits.
- [x] ISC-2: Existing iqon audit document read before implementation.
- [x] ISC-3: Project memory page read before implementation.
- [x] ISC-4: Development memory routing check completed successfully.
- [x] ISC-5: Remote live writes excluded from this pass.
- [x] ISC-6: WordPress hardening snippet file exists locally.
- [x] ISC-7: Snippet blocks public REST user endpoint.
- [x] ISC-8: Snippet disables XML-RPC through WordPress filter.
- [x] ISC-9: Snippet includes install documentation fallback block.
- [x] ISC-10: Snippet sends missing defensive security headers.
- [x] ISC-11: Snippet injects viewport when absent.
- [x] ISC-12: Snippet rewrites known HTTP iqon URLs.
- [x] ISC-13: Snippet rewrites known HTTP maps URLs.
- [x] ISC-14: Snippet fixes Yoast site-name metadata.
- [x] ISC-15: Snippet removes WordPress generator output.
- [x] ISC-16: Snippet adds emergency responsive CSS.
- [x] ISC-17: Deployment document describes non-secret installation steps.
- [x] ISC-18: Deployment document lists live verification commands.
- [x] ISC-19: PHP syntax verification attempted on snippet.
- [x] ISC-20: Created artifacts contain no credential values.

## Decisions

- Use a local snippet package, not a live deployment.
- Prefer defensive, reversible WordPress filters before redesign.
- Keep secrets out of new files and final response.

## Verification

- `git status --short` confirms worktree awareness.
- `git status --short` showed existing dirty worktree plus new local artifacts.
- `rg --files wp-snippets` showed `iqon-phase1-hardening.php` and `README.md`.
- `php -l wp-snippets/iqon-phase1-hardening.php` was attempted; local PHP CLI is missing.
- `rg -n "password|passwd|token|BEGIN RSA|BEGIN OPENSSH|api[_-]?key|private_key" wp-snippets` returned no output.
- Live commands in deployment document remain proposed until deployment approval.