# IQON Phase 1 Baseline

Purpose: зафиксировать состояние live `iqon.com` перед применением локального Phase 1 hardening-пакета.

## Contents

- [Command](#command)
- [Result](#result)
- [Failing Checks](#failing-checks)
- [Passing Checks](#passing-checks)
- [Interpretation](#interpretation)

## Command

```bash
scripts/iqon-phase1-verify.sh https://iqon.com
```

Run date: 20 May 2026.

## Result

Overall status: failed, as expected before snippet and hosting rules are activated.

## Failing Checks

| Check | Observed Signal |
|-------|-----------------|
| `X-Content-Type-Options` | Missing |
| `X-Frame-Options` | Missing |
| `Referrer-Policy` | Missing |
| `Permissions-Policy` | Missing |
| `Content-Security-Policy` | Missing |
| Viewport meta | Missing |
| Skip link | Missing |
| Known HTTP URLs | Still present |
| `og:site_name` | Still has `- IQON` |
| REST users endpoint | Public users still exposed |
| `readme.html` | Returns `200` |

## Passing Checks

| Check | Observed Signal |
|-------|-----------------|
| XML-RPC HEAD smoke | Empty reply via HEAD, status `000` |

## Interpretation

The baseline confirms that the Phase 1 package targets real current live findings. After activation, the same script should move from failed to passed, except any item that is intentionally handled outside WordPress, such as physical install-document files.

---

*Created: 20 May 2026*
*Updated: 20 May 2026*