Agent WranglersAPS-64Required
Close debug and admin doors
Remove debug, test and status tools from production, or put them behind a login and a private network.
How to do it
Keep a list of every route the app serves, and compare it with the routes you meant to publish. Turn off framework consoles and API explorers in production. Put admin pages on a separate address that only staff can reach. At the network layer, close admin ports to the internet.
Examples
Plain text example
/admin /debug /console /actuator /phpinfo.php /graphql (with introspection) /swagger /server-statusHow to check
The agent requests common debug and admin paths. Each one answers 404 or asks for a login.
Sources
Related rules
- INF-31 Close admin ports to the internet in Infrastructure and environments
- APS-66 Remove defaults and samples in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/close-debug-doors">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.