A phpinfo() page is publicly accessible
What it is
A file on your site (most often phpinfo.php or info.php) is publicly reachable and calls phpinfo(), which prints the full PHP configuration. We check that the response really looks like a phpinfo() page, a plain HTTP 200 is not enough for us.
Why it’s a problem
The output saves an attacker the reconnaissance work:
- the exact PHP version and the list of loaded modules, which tell them which vulnerability to try,
- paths on disk and server settings,
- environment variables, which often hold database passwords or API keys if the application receives them that way.
Nobody creates this file on purpose. It is left over from debugging or an installation.
How to fix it
Delete the file
The simplest and best fix. If you do not know which file it is, search the code:
grep -rl "phpinfo(" /var/www --include=*.phpIf you need it
Run phpinfo() only from the command line or on a local machine. On production you can disable the function in php.ini:
disable_functions = phpinfoOr block the typical names at the server level (nginx):
location ~* /(phpinfo|info|test)\.php$ {
return 404;
}If the output was public
Assume everything on the page was visible to strangers. Rotate the passwords and keys that appeared in the environment variables.