Sergei Vasilev
19 KiB
Полный аудит iqon.com
Purpose: текущий аудит live-сайта iqon.com и план необходимых изменений с опорой на Open Design design-review и frontend-design.
Contents
- Executive Finding
- Verified Live Facts
- Open Design Assessment
- Findings
- Change Plan
- Recommended Strategy
- Phase 1 Local Package
- Phase 2 URL Cleanup Package
- Phase 3 Content Structure Package
- Phase 4 Static Prototype Package
- Verification Checklist
- Open Questions
Executive Finding
iqon.com сейчас выглядит и работает как legacy WordPress-сайт 2012-2013 года с частично обновлённой платформой. PHP 8 и jQuery fixes применены, но сайт всё ещё не соответствует современному уровню B2B IT-консалтинга: фиксированная ширина 960px, устаревший контент, слабая SEO-семантика, открытые WordPress surfaces, mixed content и отсутствие ключевых security headers.
Главная рекомендация: не развивать текущую тему как долгосрочную основу. Правильнее использовать быстрый hardening текущего WordPress как временную меру, затем заменить публичный сайт на статический или headless/static-пакет на базе локального light redesign.
Verified Live Facts
Проверено 19 May 2026.
| Area | Fact | Evidence |
|---|---|---|
| Canonical host | https://www.iqon.com/ redirects to https://iqon.com/ |
curl -I -L https://www.iqon.com/ |
| HTTPS | HSTS present: strict-transport-security: max-age=31536000 |
curl -I -L https://www.iqon.com/ |
| Security headers | CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy absent from sampled homepage headers | curl -I -L https://www.iqon.com/ |
| WordPress REST | /wp-json/ is public and exposes namespaces/routes |
curl https://www.iqon.com/wp-json/ |
| Users endpoint | Public users include admin and iqnadm01 |
curl https://iqon.com/wp-json/wp/v2/users |
| Yoast | Live HTML shows Yoast SEO plugin v27.3 | homepage HTML |
| Readme | https://iqon.com/readme.html returns HTTP 200 |
curl -I -L https://iqon.com/readme.html |
| Sitemap | page-sitemap.xml has 66 URLs |
parsed sitemap |
| Sitemap duplicates | 3 duplicated URL groups: /industry-specific-services/ x2, /contact/ x2, /homepage/ x3 |
parsed sitemap |
| Encoded URLs | 29 sitemap URLs are percent-encoded Cyrillic paths | parsed sitemap |
| Last content freshness | Latest page sitemap lastmod is 2013-07-25T11:20:03+00:00 |
parsed sitemap |
| Theme layout | CSS uses fixed #wrapper { width: 960px; } and no responsive media strategy in theme CSS |
live style.css |
| Contact page | Contact page embeds HTTP Google Maps iframe and uses legacy jquery.realperson CAPTCHA |
curl https://iqon.com/contact/ |
| Homepage mixed content | Homepage includes HTTP hero/image/OG resources | homepage HTML |
| XML-RPC | xmlrpc.php gives empty reply under HTTP/1.1 HEAD check; treat as unresolved until POST-tested |
curl -I --http1.1 https://iqon.com/xmlrpc.php |
Important correction: old local memory says WordPress 4.9.13. The live site now exposes newer platform signals, including Yoast 27.3 and modern REST namespaces. Exact WordPress core version was not confirmed in this audit, so do not repeat WP 4.9.13 as a current live fact without a direct core-version check.
Open Design Assessment
The requested opendesign skill is represented locally by Open Design skill entries design-review and frontend-design.
Applied Open Design criteria:
- Production interface should be responsive, not fixed-width desktop.
- Navigation and page sections should use semantic HTML and predictable scan patterns.
- B2B/consulting interface should feel clear, credible, current, and operationally useful.
- Typography, spacing, color, focus states, and layout should be systematic rather than incidental.
- A redesign should be the actual usable site, not a marketing mockup disconnected from contact, services, and cases.
Live iqon.com fails the production UI bar mainly because its visual system is still built around fixed pixel widths, floats, absolute positioning, old fonts, image-based buttons, and content from 2012-2013. The local root static draft is closer to the right direction than the live site: it has semantic sections, modern typography, a responsive viewport, clear service tiles, and current consulting language.
Findings
P0 — Security And Exposure
| Finding | Severity | Evidence | Required Change |
|---|---|---|---|
| Public REST user enumeration | High | /wp-json/wp/v2/users exposes admin, iqnadm01 |
Restrict user endpoints and author archives; preserve only required public REST routes |
| Missing defensive headers | High | Homepage headers only show HSTS among sampled security headers | Add CSP, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy |
Public readme.html |
Medium | readme.html returns HTTP 200 |
Block or return 404/403 for readme and other install docs |
| Legacy contact CAPTCHA | Medium | jquery.realperson plugin is from 2009 and uses removed .live() API |
Replace CAPTCHA/contact flow or browser-test and patch compatibility immediately |
| XML-RPC state unresolved | Medium | HEAD check produced empty reply | Perform safe POST method check; disable XML-RPC unless explicitly needed |
P0 — Mixed Content And Trust
| Finding | Severity | Evidence | Required Change |
|---|---|---|---|
| HTTP hero image and link | High | Homepage uses http://www.iqon.com/...homepage.png and http://www.iqon.com/hows-business/ |
Replace with HTTPS/canonical URLs |
| HTTP OG image and schema thumbnail | High | og:image and schema image point to HTTP |
Set HTTPS image URL in Yoast/schema filters |
| HTTP Google Maps iframe | Medium | Contact page iframe uses http://maps.google.com/... |
Replace with HTTPS embed or static contact block |
P1 — SEO And Information Architecture
| Finding | Severity | Evidence | Required Change |
|---|---|---|---|
| Duplicate title tags | High | Homepage has initial <title> plus Yoast <title> |
Ensure exactly one meaningful title |
| Weak homepage title | High | Yoast title is only How’s business? |
Use brand/category: `IQON |
| Broken brand name in metadata | Medium | og:site_name is - IQON |
Set site name to IQON |
| Stale sitemap dates | High | latest page lastmod is 2013-07-25 |
Update content or noindex stale pages until refreshed |
| Duplicate sitemap URLs | Medium | 3 duplicated URL groups in sitemap | Remove duplicate pages or canonicalize/redirect |
| 29 encoded Cyrillic URLs | Medium | percent-encoded Russian URL paths in sitemap | Decide: keep bilingual architecture with hreflang, or noindex/redirect archived Russian pages |
| Thin service landing page | High | /services-solutions/ renders only a heading |
Build meaningful service overview with links and conversion path |
| Single old case study | Medium | case studies archive shows one 2010-era Rompetrol case | Add current cases or reposition as historical archive |
P1 — Design, UX, Accessibility
| Finding | Severity | Evidence | Required Change |
|---|---|---|---|
| No mobile-first layout | High | CSS fixed 960px wrapper and desktop floats |
Replace with responsive grid/flex layout |
| No viewport meta in live theme | High | sampled live pages omit viewport meta | Add viewport immediately |
| Div-based navigation | Medium | div#menu, div#content, div#footer |
Use header, nav, main, section, footer in redesign |
| Missing image alt text | Medium | hero/case images have no useful alt | Add descriptive alt or mark decorative images |
| No visible focus system in theme CSS | Medium | theme CSS has hover styles, no focus-visible system | Add keyboard focus states |
| Image buttons | Low | case/read and submit use image-based controls | Replace with semantic buttons/links and text labels |
P1 — Content And Positioning
| Finding | Severity | Evidence | Required Change |
|---|---|---|---|
| Brand message is dated | High | homepage leads with old case-study headline, not clear offer | Define current IQON positioning and value proposition |
| Footer copyright stale | Medium | live footer says 2016 | Update copyright and legal footer |
| Contact information conflicts | Medium | local draft and live site have different phone/address details | Choose canonical contact data before launch |
| Russian/Kazakhstan offices may be stale | Medium | contact page lists Moscow and Almaty office details | Verify active offices before publishing |
P2 — Technical Debt
| Finding | Severity | Evidence | Required Change |
|---|---|---|---|
| WordPress core version unknown | Medium | live signals differ from old memory | Confirm via admin/core files before platform decision |
| Legacy theme still active | High | theme CSS and markup are still 2012-style | Do not invest heavily in theme beyond hardening |
| Google-hosted jQuery dependency | Medium | loads jQuery from ajax.googleapis.com |
Prefer local bundled asset or verified CDN policy |
jquery.realperson compatibility risk |
Medium | plugin uses .live() while jQuery is 3.7.1 |
Replace or patch plugin |
Change Plan
Phase 0 — Backup And Baseline
| Task | Owner Action | Verification |
|---|---|---|
| Confirm DB archive completion | Check reg.ru backup archive status for u0012812_iqon |
Archive exists and can be downloaded |
| Capture current live HTML/CSS | Save homepage/contact/services/case samples | Files exist in backup folder |
| Confirm WP core version | Check admin/core/version source | Exact version recorded |
| Browser-test contact form | Submit safe test using non-production message | Form validation and delivery behavior known |
Phase 1 — Same-Day Hardening
| Task | Method | Expected Signal |
|---|---|---|
| Add viewport meta | wp_head or output buffering snippet |
HTML contains <meta name="viewport" content="width=device-width, initial-scale=1"> |
| Replace HTTP URLs | DB update or output buffering | `rg "http://www.iqon.com |
| Add security headers | nginx/hosting config or WP send_headers |
Headers include CSP/frame/content/referrer/permissions policy |
| Restrict REST users | WP filter or security plugin | /wp-json/wp/v2/users no longer exposes usernames |
| Block readme | nginx/hosting rule or WP redirect | readme.html returns 403/404 |
| Disable XML-RPC if unused | hosting rule or WP filter | XML-RPC cannot be used for pingback/login abuse |
Phase 2 — SEO And Content Cleanup
| Task | Method | Expected Signal |
|---|---|---|
| Fix site name | Yoast/site settings | og:site_name is IQON |
| Fix homepage title and description | Yoast/page settings | Search snippet describes IQON offer clearly |
| Fix sitemap duplicates | Delete/redirect/noindex duplicate pages | /contact/, /homepage/, /industry-specific-services/ are singletons |
| Decide Russian URLs policy | hreflang bilingual mode or noindex/redirect archive | 29 encoded URLs have intentional index status |
| Rewrite services overview | Replace empty page content | /services-solutions/ has meaningful overview and service cards |
| Update contact facts | Verify addresses/phones/emails | Live contact matches approved company data |
Phase 3 — Open Design Redesign
Recommended direction: use the local root light redesign as the base, not the dark new_redesign/ as-is.
| Task | Method | Expected Signal |
|---|---|---|
| Choose canonical local variant | Decide root draft vs new_redesign/ |
One source of truth recorded in memory |
| Build light B2B design system | Tokens for color, type, spacing, components | CSS variables and reusable sections exist |
| Rebuild navigation | Real URLs, mobile nav, semantic landmarks | Header works desktop/mobile |
| Rebuild services | 5 service pages or 5 sections with clear CTAs | Service pages have titles, descriptions, CTAs |
| Rebuild cases | Current case cards or historical archive framing | Case content no longer feels abandoned |
| Rebuild contact | Verified data, simple form/mailto/Telegram, privacy note | Contact path works without legacy CAPTCHA |
Phase 4 — Deployment Strategy
| Option | Use When | Pros | Cons |
|---|---|---|---|
| Static replacement | Content can be frozen and maintained in repo | Fast, secure, low maintenance | Requires redirects and deployment discipline |
| New WordPress theme | Client needs WP editing | Preserves CMS workflows | More moving parts and security maintenance |
| Incremental legacy repair | Need risk reduction today | Fastest safe improvement | Does not solve brand/design/content age |
Recommended Strategy
- Execute Phase 0 and Phase 1 first. This reduces public risk without committing to a redesign path.
- Choose static replacement unless there is a hard requirement for WordPress editing.
- Use the light root draft as the base direction: it preserves the yellow IQON signal, reads more credible for B2B consulting, and avoids the overly dark tech-startup tone of
new_redesign/. - Treat old WordPress content as source material, not as final copy. Most service pages and cases need rewriting, not restyling.
- Keep the old site restorable until the new package passes desktop/mobile browser QA and URL redirect checks.
Phase 1 Local Package
Prepared 20 May 2026, not deployed to live WordPress.
| Artifact | Purpose | Status |
|---|---|---|
wp-snippets/iqon-phase1-hardening.php |
Reversible WordPress snippet for immediate hardening | Local draft |
wp-snippets/README.md |
Install draft, verification commands, rollback notes | Local draft |
wp-snippets/hosting-rules.md |
nginx/Apache/file-level drafts for install docs and XML-RPC | Local draft |
scripts/iqon-phase1-verify.sh |
Automated post-activation verification script | Local draft |
reports/phase1-baseline-2026-05-20.md |
Current live baseline before activation | Local report |
The snippet covers defensive headers, REST user endpoint removal, XML-RPC disable filter, viewport fallback, emergency responsive CSS, HTTP URL rewriting, Yoast site-name correction, and generator removal. The package intentionally does not include credentials and does not perform any remote writes.
Important limit: physical readme.html and license.html may be served by nginx before WordPress runs. The PHP snippet includes only a WordPress fallback; guaranteed enforcement requires hosting-level blocking or removing the files after backup.
Baseline result: scripts/iqon-phase1-verify.sh https://iqon.com currently fails on missing defensive headers, missing viewport, missing skip link, known HTTP URLs, og:site_name, public REST users, and readme.html returning 200. This is expected before deployment and gives a comparison point after activation.
Phase 2 URL Cleanup Package
Prepared 20 May 2026, not deployed to live WordPress.
| Artifact | Purpose | Status |
|---|---|---|
reports/live-captures/2026-05-20/page-sitemap.xml |
Captured current Yoast page sitemap | Local capture |
scripts/iqon-sitemap-inventory.py |
Reproducible sitemap parser | Local tool |
seo/sitemap-inventory-2026-05-20.csv |
Parsed sitemap inventory | Local inventory |
seo/url-cleanup-plan-2026-05-20.md |
URL policy, duplicate cleanup, redirect drafts | Local plan |
Current inventory: 66 sitemap rows, 29 encoded multilingual URLs, 7 duplicate rows, 1 typo slug, 1 thin services landing, and 1 legacy home alias.
Phase 3 Content Structure Package
Prepared 20 May 2026, not implemented on live site.
| Artifact | Purpose | Status |
|---|---|---|
content/site-structure-brief-2026-05-20.md |
Target sitemap, positioning, page briefs, content backlog | Local brief |
Recommended structure: root homepage, /services/, five service detail pages, /industries/, /case-studies/, and /contact/. Required owner inputs before launch: canonical contact data, language policy, deployment target, service naming, case-study policy, and legal/privacy footer.
Phase 4 Static Prototype Package
Prepared 20 May 2026, not deployed to live site.
| Artifact | Purpose | Status |
|---|---|---|
index.html |
Updated homepage with real target-sitemap links | Local prototype |
services/index.html |
Services overview page | Local prototype |
services/*/index.html |
Five service detail pages | Local prototype |
industries/index.html |
Industry overview page | Local prototype |
case-studies/index.html |
Case-study decision placeholder | Local prototype |
contact/index.html |
Contact page with owner-confirmation notes | Local prototype |
sitemap.xml |
Static target sitemap | Local prototype |
robots.txt |
Static robots file | Local prototype |
reports/static-prototype-smoke-2026-05-20.md |
Local HTTP smoke results | Local report |
reports/visual-qa-2026-05-20.md |
Headless Chrome visual QA report | Local report |
Local smoke result: all 10 target pages plus sitemap.xml and robots.txt returned HTTP 200 through python3 -m http.server 8061. Headless Chrome mobile QA found and fixed horizontal clipping in nav, hero copy, and service-card copy. The prototype still needs owner input for contact data/cases before deployment.
Verification Checklist
| Check | Command Or Method | Expected Signal |
|---|---|---|
| Headers | curl -I -L https://iqon.com/ |
Security headers present |
| Mixed content | Fetch homepage/contact and search http:// |
No HTTP asset/embed URLs |
| REST users | curl https://iqon.com/wp-json/wp/v2/users |
No public user list |
| Readme | curl -I https://iqon.com/readme.html |
403 or 404 |
| Sitemap | Parse page-sitemap.xml |
No duplicate canonical URLs |
| Mobile | Browser at 390px width | No horizontal scroll, nav usable |
| Accessibility | Keyboard tab through header/form | Visible focus and reachable controls |
| Contact | Safe test submission | Known outcome: delivered, blocked, or replaced |
Open Questions
- Which contact data is canonical: live Bucharest/Moscow/Almaty details or local draft Bucharest-only details?
- Should the site remain English-only, bilingual EN/RU, or archive Russian pages?
- Should the final site be static, WordPress, or hybrid?
- Are there current IQON case studies that can replace the 2010 Rompetrol example?
- Is
office@iqon.kzstill valid and monitored?
Created: 19 May 2026, 22:45 Updated: 19 May 2026, 22:45