Sergei Vasilev
55 lines
1.4 KiB
Markdown
55 lines
1.4 KiB
Markdown
# IQON Phase 1 Baseline
|
|
|
|
Purpose: зафиксировать состояние live `iqon.com` перед применением локального Phase 1 hardening-пакета.
|
|
|
|
## Contents
|
|
|
|
- [Command](#command)
|
|
- [Result](#result)
|
|
- [Failing Checks](#failing-checks)
|
|
- [Passing Checks](#passing-checks)
|
|
- [Interpretation](#interpretation)
|
|
|
|
## Command
|
|
|
|
```bash
|
|
scripts/iqon-phase1-verify.sh https://iqon.com
|
|
```
|
|
|
|
Run date: 20 May 2026.
|
|
|
|
## Result
|
|
|
|
Overall status: failed, as expected before snippet and hosting rules are activated.
|
|
|
|
## Failing Checks
|
|
|
|
| Check | Observed Signal |
|
|
|-------|-----------------|
|
|
| `X-Content-Type-Options` | Missing |
|
|
| `X-Frame-Options` | Missing |
|
|
| `Referrer-Policy` | Missing |
|
|
| `Permissions-Policy` | Missing |
|
|
| `Content-Security-Policy` | Missing |
|
|
| Viewport meta | Missing |
|
|
| Skip link | Missing |
|
|
| Known HTTP URLs | Still present |
|
|
| `og:site_name` | Still has `- IQON` |
|
|
| REST users endpoint | Public users still exposed |
|
|
| `readme.html` | Returns `200` |
|
|
|
|
## Passing Checks
|
|
|
|
| Check | Observed Signal |
|
|
|-------|-----------------|
|
|
| XML-RPC HEAD smoke | Empty reply via HEAD, status `000` |
|
|
|
|
## Interpretation
|
|
|
|
The baseline confirms that the Phase 1 package targets real current live findings. After activation, the same script should move from failed to passed, except any item that is intentionally handled outside WordPress, such as physical install-document files.
|
|
|
|
---
|
|
|
|
*Created: 20 May 2026*
|
|
*Updated: 20 May 2026*
|