iqon/wp-snippets/hosting-rules.md

IQON Phase 1 Hosting Rules

Purpose: зафиксировать server-level правила для рисков, которые WordPress snippet не может гарантированно закрыть.

Contents

• Scope
• nginx Draft
• Apache htaccess Draft
• reg.ru Shared Hosting Path
• Verification
• Rollback

Scope

Эти правила не применены на live-сайте. Они являются draft-артефактом для внедрения после backup и явного подтверждения на remote write.

nginx Draft

location ~* ^/(readme|license)\.html$ {
    return 404;
}

location = /xmlrpc.php {
    return 403;
}

Apache htaccess Draft

Use only if the hosting route confirms Apache or .htaccess processing for this site.

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^(readme|license)\.html$ - [R=404,L,NC]
RewriteRule ^xmlrpc\.php$ - [F,L,NC]
</IfModule>

reg.ru Shared Hosting Path

If neither nginx config nor .htaccess is available, use a file-level fallback after backup:

1. Confirm that /readme.html and /license.html are physical public files.
2. Download or copy those files into the dated backup bundle.
3. Remove the public files or replace them with non-sensitive 404 placeholders.
4. Re-run verification commands below.

Do not overwrite server files without reading the destination first.

Verification

curl -I -L https://iqon.com/readme.html
curl -I -L https://iqon.com/license.html
curl -I --http1.1 https://iqon.com/xmlrpc.php

Expected signal:

• readme.html returns 403 or 404.
• license.html returns 403 or 404.
• xmlrpc.php returns 403, 404, 405, or another intentionally blocked status after confirming no integration depends on XML-RPC.

Rollback

1. Remove only the rule that caused the confirmed regression.
2. Restore public files only from the dated backup if file-level fallback was used.
3. Re-run the same verification commands.
4. Document the before/after status in the deployment notes.

---

Created: 20 May 2026 Updated: 20 May 2026