Vulnerabilities
phpinfo() vs Verbose API Errors on Production
February 23, 2025
phpinfo() vs verbose API errors on production is two costumes of the same leak class. phpinfo() prints PHP version, extensions, paths, and often environment-shaped configuration into an HTML page. Verbose API errors print stack traces, SQL fragments, or framework internals into JSON. Both help an operator debug. Both help a stranger map the stack. Disable display_errors and remove diagnostic routes from the document root. RoastMyOpsec does not currently treat /phpinfo.php as a scored path. It may heuristic-scan common API error bodies. It does not enable debug mode, does not send exploit payloads, and does not dump phpinfo.
The practical difference
phpinfo is a single well-known page someone left in public/. Verbose errors are every 500 that still has APP_DEBUG=true. Server banners (X-Powered-By: PHP/8.x) are a lighter cousin — a version hint without the full dump. See server banners vs stack fingerprinting.
phpinfo is not a credential file, but it often names include_path, session.save_path, and loaded modules. Treat a reachable page as an information leak and delete it.
How to choose what to shut off
Production: display_errors off, generic client messages, logs on the server. Remove phpinfo.php, test.php, and framework debug bars from the artifact. CDN: deny those names even if CI is perfect. Staging can keep diagnostics behind auth — not on the marketing host.
| Surface | Typical leak | First response | Takeaway |
|---|---|---|---|
| /phpinfo.php | Runtime and path inventory | Delete; deny the name | Not a scored roast path today |
| JSON 500 with trace | Code paths, sometimes queries | Generic error; log server-side | See verbose API errors |
| X-Powered-By / Server | Product and version hint | Strip at the edge | Fingerprint, not a dump |
| .env on the origin | Live secrets | Rotate; deny | Incident class; not phpinfo |
What the roast can prove
Verbose API-body heuristics can surface as findings. A 404 on /phpinfo.php is not a certificate the file is gone under /admin/phpinfo.php. Pair with exposed .git vs .env if the dump named a config path, and with server banners if PHP still announces itself.
Common mistakes
The first mistake is leaving a phpinfo 'health check' on the same host as checkout.
The second mistake is APP_DEBUG=true because 'it's behind Cloudflare.'
The third mistake is deleting phpinfo.php and keeping display_errors on.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is phpinfo a vulnerability?
- It is an information leak. Remove it from production. It is not a password dump by itself.
- Does RoastMyOpsec fetch phpinfo.php?
- Not as a scored path today. Treat it like other diagnostic leftovers and deny the name anyway.
- Is X-Powered-By the same as phpinfo?
- No. A banner is a hint. phpinfo is a brochure. Strip both.
Sources
Related guides
Vulnerabilities
Framework Debug Mode vs Verbose API ErrorsVulnerabilities
Apache server-status vs phpinfo() on ProductionNews
Server Banners vs Stack Fingerprinting