---
title: "Close debug and admin doors · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/secrets-and-configuration/close-debug-doors
id: APS-64
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 745
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Close debug and admin doors

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-64
- Level: Required
- Chapter: [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md)
- Rule: Remove debug, test and status tools from production, or put them behind a login and a private network.
- Check: The agent requests common debug and admin paths. Each one answers 404 or asks for a login.
- Risk: An account or system taken over
- How: Keep a list of every route the app serves, and compare it with the routes you meant to publish. Turn off framework consoles and API explorers in production. Put admin pages on a separate address that only staff can reach. At the network layer, [close admin ports to the internet](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Plain text example

```text
/admin  /debug  /console  /actuator  /phpinfo.php  /graphql (with introspection)  /swagger  /server-status
```

## Sources

- [OWASP WSTG on admin interfaces](https://wstg.owasp.org/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management/05-Enumerate_Infrastructure_and_Application_Admin_Interfaces/)
- [CWE-489 Active Debug Code](https://cwe.mitre.org/data/definitions/489.html)

## Related rules

- INF-31 [Close admin ports to the internet](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports.md) in Infrastructure and environments
- APS-66 [Remove defaults and samples](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/remove-defaults.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/close-debug-doors">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep storage buckets private](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/private-storage-buckets.md)
- Next: [Serve no hidden files](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/no-hidden-files.md)
- [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md)