---
title: "Close debug and admin doors · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/close-debug-doors
updated: 2026-10-20
licence: "All rights reserved"
---

# Close debug and admin doors

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)
- Rule: Remove debug, test and status tools from production, or put them behind a login and a private network.
- How: Keep a list of every route the app serves, and compare it with the routes you meant to publish. Turn off framework consoles and API explorers in production. Put admin pages on a separate address that only staff can reach.
- Check: The agent requests common debug and admin paths. Each one answers 404 or asks for a login.

Example:

```text
/admin  /debug  /console  /actuator  /phpinfo.php  /graphql (with introspection)  /swagger  /server-status
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/close-debug-doors`.

- Previous: [Show short errors](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/short-errors)
- Next: [Serve no hidden files](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/no-hidden-files)
- [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)