iqon/MEMORY/WORK/20260520-005444_continue-iqon-phase1/PRD.md

task, slug, effort, phase, progress, mode, started, updated

task	slug	effort	phase	progress	mode	started	updated
Продолжить аудит iqon.com без остановок	20260520-005444_continue-iqon-phase1	extended	verify	20/20	interactive	2026-05-20T00:54:44Z	2026-05-20T00:59:00Z

Продолжить аудит iqon.com без остановок

Purpose: превратить полный аудит iqon.com в локальный Phase 1 hardening-пакет без записи на live-сайт.

Context

Пользователь попросил продолжать без остановок после полного аудита iqon.com. Без отдельного подтверждения нельзя писать во внешний WordPress/hosting, поэтому текущая работа ограничена локальными артефактами: готовый PHP snippet для Code Snippets, инструкция внедрения и проверочный чеклист. Источники: iqon-full-audit-2026-05-19.md, /Users/svmac/.codex/memories/wiki/projects/iqon-com.md, live-проверки из предыдущего шага.

Criteria

• ISC-1: Git status inspected before local file edits.
• ISC-2: Existing iqon audit document read before implementation.
• ISC-3: Project memory page read before implementation.
• ISC-4: Development memory routing check completed successfully.
• ISC-5: Remote live writes excluded from this pass.
• ISC-6: WordPress hardening snippet file exists locally.
• ISC-7: Snippet blocks public REST user endpoint.
• ISC-8: Snippet disables XML-RPC through WordPress filter.
• ISC-9: Snippet includes install documentation fallback block.
• ISC-10: Snippet sends missing defensive security headers.
• ISC-11: Snippet injects viewport when absent.
• ISC-12: Snippet rewrites known HTTP iqon URLs.
• ISC-13: Snippet rewrites known HTTP maps URLs.
• ISC-14: Snippet fixes Yoast site-name metadata.
• ISC-15: Snippet removes WordPress generator output.
• ISC-16: Snippet adds emergency responsive CSS.
• ISC-17: Deployment document describes non-secret installation steps.
• ISC-18: Deployment document lists live verification commands.
• ISC-19: PHP syntax verification attempted on snippet.
• ISC-20: Created artifacts contain no credential values.

Decisions

• Use a local snippet package, not a live deployment.
• Prefer defensive, reversible WordPress filters before redesign.
• Keep secrets out of new files and final response.

Verification

• git status --short confirms worktree awareness.
• git status --short showed existing dirty worktree plus new local artifacts.
• rg --files wp-snippets showed iqon-phase1-hardening.php and README.md.
• php -l wp-snippets/iqon-phase1-hardening.php was attempted; local PHP CLI is missing.
• rg -n "password|passwd|token|BEGIN RSA|BEGIN OPENSSH|api[_-]?key|private_key" wp-snippets returned no output.
• Live commands in deployment document remain proposed until deployment approval.