RoastMyOpsec

Vulnerabilities

Apache server-status vs phpinfo() on Production

October 11, 2025

Apache server-status vs phpinfo() on production is two operator pages that must not be world-readable. mod_status /server-status lists workers, vhosts, and request lines. phpinfo() lists the PHP runtime. nginx stub_status and Spring Actuator /health-with-details are cousins. None of these are credentials by themselves; all of them shrink reconnaissance. Bind them to localhost or a VPN, or deny the path at the CDN. RoastMyOpsec does not currently score /server-status, /server-info, or stub_status. It does not fetch phpinfo.php as a scored path. It does not enable ExtendedStatus or dump worker tables.

The practical difference

server-status is the HTTP server's live scoreboard. phpinfo is the language runtime. Framework debug mode is every 500. Treat all three as diagnostics, not marketing.

robots.txt Disallow: /server-status advertises the name. Deny at the edge instead. See Disallow vs access control.

How to choose a lock

Production: Location deny all for /server-status and /server-info, or listen only on 127.0.0.1. CDN: deny those prefixes even if Apache is 'internal.' phpinfo.php: delete from the artifact. Actuator: expose only health without details on the public origin.

Path / pageTypical stackWhat it often showsTakeaway
/server-statusApache mod_statusWorkers, sometimes request URIsNot a scored roast path; deny anyway
/phpinfo.phpPHPRuntime and path inventorySee phpinfo vs verbose errors
stub_statusnginxConnection countersLocalhost or deny
Framework DEBUGAppEvery 500 as a dumpSee framework debug mode

What the roast can prove

A 404 on /server-status is not proof it is gone on another vhost. Edge deny is cheap. Pair with htaccess vs web.config if the config that enabled status was downloadable, and with robots.txt if Disallow listed the path.

Common mistakes

The first mistake is ExtendedStatus On with Location /server-status Allow from all.

The second mistake is Disallow: /server-status and calling it a fix.

The third mistake is exposing Actuator env on the same host as checkout.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Is /server-status a vulnerability?
On a public origin it is an information leak. Restrict it to localhost or a management network.
Does RoastMyOpsec fetch server-status?
Not as a scored path today. Deny it anyway. phpinfo.php is also not a scored path.
Is stub_status the same as phpinfo?
No. stub_status is counters. phpinfo is a runtime brochure. Both should stay off the public origin.

Sources

Related guides