Vulnerabilities
Apache server-status vs phpinfo() on Production
October 11, 2025
Apache server-status vs phpinfo() on production is two operator pages that must not be world-readable. mod_status /server-status lists workers, vhosts, and request lines. phpinfo() lists the PHP runtime. nginx stub_status and Spring Actuator /health-with-details are cousins. None of these are credentials by themselves; all of them shrink reconnaissance. Bind them to localhost or a VPN, or deny the path at the CDN. RoastMyOpsec does not currently score /server-status, /server-info, or stub_status. It does not fetch phpinfo.php as a scored path. It does not enable ExtendedStatus or dump worker tables.
The practical difference
server-status is the HTTP server's live scoreboard. phpinfo is the language runtime. Framework debug mode is every 500. Treat all three as diagnostics, not marketing.
robots.txt Disallow: /server-status advertises the name. Deny at the edge instead. See Disallow vs access control.
How to choose a lock
Production: Location deny all for /server-status and /server-info, or listen only on 127.0.0.1. CDN: deny those prefixes even if Apache is 'internal.' phpinfo.php: delete from the artifact. Actuator: expose only health without details on the public origin.
| Path / page | Typical stack | What it often shows | Takeaway |
|---|---|---|---|
| /server-status | Apache mod_status | Workers, sometimes request URIs | Not a scored roast path; deny anyway |
| /phpinfo.php | PHP | Runtime and path inventory | See phpinfo vs verbose errors |
| stub_status | nginx | Connection counters | Localhost or deny |
| Framework DEBUG | App | Every 500 as a dump | See framework debug mode |
What the roast can prove
A 404 on /server-status is not proof it is gone on another vhost. Edge deny is cheap. Pair with htaccess vs web.config if the config that enabled status was downloadable, and with robots.txt if Disallow listed the path.
Common mistakes
The first mistake is ExtendedStatus On with Location /server-status Allow from all.
The second mistake is Disallow: /server-status and calling it a fix.
The third mistake is exposing Actuator env on the same host as checkout.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is /server-status a vulnerability?
- On a public origin it is an information leak. Restrict it to localhost or a management network.
- Does RoastMyOpsec fetch server-status?
- Not as a scored path today. Deny it anyway. phpinfo.php is also not a scored path.
- Is stub_status the same as phpinfo?
- No. stub_status is counters. phpinfo is a runtime brochure. Both should stay off the public origin.
Sources
Related guides
Vulnerabilities
phpinfo() vs Verbose API Errors on ProductionVulnerabilities
Spring Actuator vs Apache server-status on ProductionVulnerabilities
robots.txt Disallow vs Access Control for Hidden Paths