# IQON Phase 1 Hardening Package

Purpose: локальный пакет временного hardening для live WordPress `iqon.com` до полноценного редизайна или статической замены.

## Contents

- [Scope](#scope)
- [Files](#files)
- [Install Draft](#install-draft)
- [Hosting Rule Draft](#hosting-rule-draft)
- [Automated Verification Script](#automated-verification-script)
- [Verification](#verification)
- [Rollback](#rollback)
- [Limits](#limits)

## Scope

Пакет не был установлен на live-сайт. Он подготовлен как reversible snippet для Code Snippets и должен применяться только после отдельного подтверждения на запись во внешний WordPress.

## Files

| File | Role |
|------|------|
| `wp-snippets/iqon-phase1-hardening.php` | PHP snippet for Code Snippets, "Run snippet everywhere" |
| `wp-snippets/hosting-rules.md` | nginx/Apache/file-level drafts for install docs and XML-RPC |
| `scripts/iqon-phase1-verify.sh` | Post-activation verification script |

## Install Draft

1. Открыть WordPress admin через текущий безопасный маршрут доступа.
2. Создать новый snippet с названием `IQON Phase 1 hardening`.
3. Вставить содержимое `wp-snippets/iqon-phase1-hardening.php`.
4. Выбрать режим `Run snippet everywhere`.
5. Сохранить snippet как inactive draft.
6. Сделать свежий backup файлов и базы перед активацией.
7. Активировать snippet.
8. Сразу выполнить проверки из раздела Verification.

## Hosting Rule Draft

PHP snippet не гарантирует блокировку физических файлов, которые веб-сервер отдаёт до WordPress. Для `readme.html` и `license.html` нужен server-level блок или удаление файлов.

nginx draft:

```nginx
location ~* ^/(readme|license)\.html$ {
    return 404;
}
```

Если на reg.ru shared hosting нет доступа к nginx-конфигу, проверить доступные механизмы: панель хостинга, `.htaccess`, файловый менеджер или удаление публичных install-doc файлов после backup.

Detailed drafts are in `wp-snippets/hosting-rules.md`.

## Automated Verification Script

After activation:

```bash
scripts/iqon-phase1-verify.sh https://iqon.com
```

Expected signal: final line is `[OK] iqon Phase 1 verification passed for https://iqon.com`.

## Verification

Run after activation:

```bash
curl -I -L https://iqon.com/
```

Expected signal: response includes `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy`, and `Content-Security-Policy`.

```bash
curl -sS https://iqon.com/wp-json/wp/v2/users
```

Expected signal: no public list of usernames is returned.

```bash
curl -sS https://iqon.com/ | rg 'http://www\.iqon\.com|http://iqon\.com|http://maps\.google\.com'
```

Expected signal: no output.

```bash
curl -sS https://iqon.com/ | rg 'name="viewport"|iqon-skip-link|og:site_name'
```

Expected signal: viewport exists, skip link exists, site metadata no longer shows `- IQON`.

```bash
curl -I -L https://iqon.com/readme.html
```

Expected signal after hosting rule: `403` or `404`. If it still returns `200`, WordPress snippet is bypassed by static file serving and hosting-level action is still required.

```bash
curl -I --http1.1 https://iqon.com/xmlrpc.php
```

Expected signal: no usable XML-RPC behavior. A stronger check is a safe XML-RPC POST from a test client after confirming no production integrations depend on it.

## Rollback

1. Disable the `IQON Phase 1 hardening` snippet.
2. Clear any page/cache layer if present.
3. Re-run the same curl checks and compare before/after.
4. Remove hosting rule only if it caused a confirmed false positive.

## Limits

- This package does not replace the contact form or legacy CAPTCHA.
- This package does not fix duplicate sitemap URLs.
- This package does not modernize the WordPress theme.
- This package does not verify canonical contact data.
- This package does not confirm the exact WordPress core version.

---

*Created: 20 May 2026*
*Updated: 20 May 2026*