Sergei Vasilev
124 lines
4.3 KiB
Markdown
124 lines
4.3 KiB
Markdown
# IQON Phase 1 Hardening Package
|
|
|
|
Purpose: локальный пакет временного hardening для live WordPress `iqon.com` до полноценного редизайна или статической замены.
|
|
|
|
## Contents
|
|
|
|
- [Scope](#scope)
|
|
- [Files](#files)
|
|
- [Install Draft](#install-draft)
|
|
- [Hosting Rule Draft](#hosting-rule-draft)
|
|
- [Automated Verification Script](#automated-verification-script)
|
|
- [Verification](#verification)
|
|
- [Rollback](#rollback)
|
|
- [Limits](#limits)
|
|
|
|
## Scope
|
|
|
|
Пакет не был установлен на live-сайт. Он подготовлен как reversible snippet для Code Snippets и должен применяться только после отдельного подтверждения на запись во внешний WordPress.
|
|
|
|
## Files
|
|
|
|
| File | Role |
|
|
|------|------|
|
|
| `wp-snippets/iqon-phase1-hardening.php` | PHP snippet for Code Snippets, "Run snippet everywhere" |
|
|
| `wp-snippets/hosting-rules.md` | nginx/Apache/file-level drafts for install docs and XML-RPC |
|
|
| `scripts/iqon-phase1-verify.sh` | Post-activation verification script |
|
|
|
|
## Install Draft
|
|
|
|
1. Открыть WordPress admin через текущий безопасный маршрут доступа.
|
|
2. Создать новый snippet с названием `IQON Phase 1 hardening`.
|
|
3. Вставить содержимое `wp-snippets/iqon-phase1-hardening.php`.
|
|
4. Выбрать режим `Run snippet everywhere`.
|
|
5. Сохранить snippet как inactive draft.
|
|
6. Сделать свежий backup файлов и базы перед активацией.
|
|
7. Активировать snippet.
|
|
8. Сразу выполнить проверки из раздела Verification.
|
|
|
|
## Hosting Rule Draft
|
|
|
|
PHP snippet не гарантирует блокировку физических файлов, которые веб-сервер отдаёт до WordPress. Для `readme.html` и `license.html` нужен server-level блок или удаление файлов.
|
|
|
|
nginx draft:
|
|
|
|
```nginx
|
|
location ~* ^/(readme|license)\.html$ {
|
|
return 404;
|
|
}
|
|
```
|
|
|
|
Если на reg.ru shared hosting нет доступа к nginx-конфигу, проверить доступные механизмы: панель хостинга, `.htaccess`, файловый менеджер или удаление публичных install-doc файлов после backup.
|
|
|
|
Detailed drafts are in `wp-snippets/hosting-rules.md`.
|
|
|
|
## Automated Verification Script
|
|
|
|
After activation:
|
|
|
|
```bash
|
|
scripts/iqon-phase1-verify.sh https://iqon.com
|
|
```
|
|
|
|
Expected signal: final line is `[OK] iqon Phase 1 verification passed for https://iqon.com`.
|
|
|
|
## Verification
|
|
|
|
Run after activation:
|
|
|
|
```bash
|
|
curl -I -L https://iqon.com/
|
|
```
|
|
|
|
Expected signal: response includes `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy`, and `Content-Security-Policy`.
|
|
|
|
```bash
|
|
curl -sS https://iqon.com/wp-json/wp/v2/users
|
|
```
|
|
|
|
Expected signal: no public list of usernames is returned.
|
|
|
|
```bash
|
|
curl -sS https://iqon.com/ | rg 'http://www\.iqon\.com|http://iqon\.com|http://maps\.google\.com'
|
|
```
|
|
|
|
Expected signal: no output.
|
|
|
|
```bash
|
|
curl -sS https://iqon.com/ | rg 'name="viewport"|iqon-skip-link|og:site_name'
|
|
```
|
|
|
|
Expected signal: viewport exists, skip link exists, site metadata no longer shows `- IQON`.
|
|
|
|
```bash
|
|
curl -I -L https://iqon.com/readme.html
|
|
```
|
|
|
|
Expected signal after hosting rule: `403` or `404`. If it still returns `200`, WordPress snippet is bypassed by static file serving and hosting-level action is still required.
|
|
|
|
```bash
|
|
curl -I --http1.1 https://iqon.com/xmlrpc.php
|
|
```
|
|
|
|
Expected signal: no usable XML-RPC behavior. A stronger check is a safe XML-RPC POST from a test client after confirming no production integrations depend on it.
|
|
|
|
## Rollback
|
|
|
|
1. Disable the `IQON Phase 1 hardening` snippet.
|
|
2. Clear any page/cache layer if present.
|
|
3. Re-run the same curl checks and compare before/after.
|
|
4. Remove hosting rule only if it caused a confirmed false positive.
|
|
|
|
## Limits
|
|
|
|
- This package does not replace the contact form or legacy CAPTCHA.
|
|
- This package does not fix duplicate sitemap URLs.
|
|
- This package does not modernize the WordPress theme.
|
|
- This package does not verify canonical contact data.
|
|
- This package does not confirm the exact WordPress core version.
|
|
|
|
---
|
|
|
|
*Created: 20 May 2026*
|
|
*Updated: 20 May 2026*
|