iqon/reports/phase1-baseline-2026-05-20.md

IQON Phase 1 Baseline

Purpose: зафиксировать состояние live iqon.com перед применением локального Phase 1 hardening-пакета.

Contents

• Command
• Result
• Failing Checks
• Passing Checks
• Interpretation

Command

scripts/iqon-phase1-verify.sh https://iqon.com

Run date: 20 May 2026.

Result

Overall status: failed, as expected before snippet and hosting rules are activated.

Failing Checks

Check	Observed Signal
X-Content-Type-Options	Missing
X-Frame-Options	Missing
Referrer-Policy	Missing
Permissions-Policy	Missing
Content-Security-Policy	Missing
Viewport meta	Missing
Skip link	Missing
Known HTTP URLs	Still present
og:site_name	Still has - IQON
REST users endpoint	Public users still exposed
readme.html	Returns 200

Passing Checks

Check	Observed Signal
XML-RPC HEAD smoke	Empty reply via HEAD, status 000

Interpretation

The baseline confirms that the Phase 1 package targets real current live findings. After activation, the same script should move from failed to passed, except any item that is intentionally handled outside WordPress, such as physical install-document files.

---

Created: 20 May 2026 Updated: 20 May 2026