Sergei Vasilev
1.4 KiB
1.4 KiB
IQON Phase 1 Baseline
Purpose: зафиксировать состояние live iqon.com перед применением локального Phase 1 hardening-пакета.
Contents
Command
scripts/iqon-phase1-verify.sh https://iqon.com
Run date: 20 May 2026.
Result
Overall status: failed, as expected before snippet and hosting rules are activated.
Failing Checks
| Check | Observed Signal |
|---|---|
X-Content-Type-Options |
Missing |
X-Frame-Options |
Missing |
Referrer-Policy |
Missing |
Permissions-Policy |
Missing |
Content-Security-Policy |
Missing |
| Viewport meta | Missing |
| Skip link | Missing |
| Known HTTP URLs | Still present |
og:site_name |
Still has - IQON |
| REST users endpoint | Public users still exposed |
readme.html |
Returns 200 |
Passing Checks
| Check | Observed Signal |
|---|---|
| XML-RPC HEAD smoke | Empty reply via HEAD, status 000 |
Interpretation
The baseline confirms that the Phase 1 package targets real current live findings. After activation, the same script should move from failed to passed, except any item that is intentionally handled outside WordPress, such as physical install-document files.
Created: 20 May 2026 Updated: 20 May 2026