I suspect the problem is that your browser is automatically trying to download "favicon.ico" for your web site, which happens to contain your "on" string. Your Serial.println(readString); should have shown you that. You could avoid the problem by making the strings unique, for example by converting them to uppercase or by testing for "?on" etc.
As a general principle I recommend using c-strings rather than the String class. The String class does not give you any significant benefits, exposes a memory leak that can cause instability problems on older IDE versions, and exposes you to possible memory fragmentation issues on all versions. Using dynamic memory to manage dynamic data is fine on a PC with virtual memory support, loads of RAM and the resources to do proper garbage collection and compaction - it's a fundamentally bad strategy on a memory-starved microcontroller.
To eliminate the String class you would replace String readString with a char array, and have a variable to record how many characters are stored in the array.
const int BUFFER_SIZE = 80; // or however big it needs to be in your application
char buffer[BUFFER_SIZE+1]; // +1 allows space for the null terminator
int length = 0;
Then you append new characters like this:
if(length < BUFFER_SIZE)
buffer[length++] = c;
buffer[length] = 0; // append null terminator;
Clear the buffer by setting length=0.
Use strstr() to test whether the buffer contains a specified string.
if(strstr(buffer, "?on") != 0)
// match found ...
If you want to print the content of the buffer, you can pass the buffer to any of the usual print functions: