Agent WranglersAPS-66Recommended
Remove defaults and samples
Change every default password and remove sample apps, admin consoles and test pages before going live.
How to do it
Set new passwords for databases, admin panels and devices during setup. Delete example pages and install scripts. Close admin ports to the internet, or put them behind a login and a private network. Debug tools are covered in close debug and admin doors.
How to check
Try the default login for each product in use, and request each product's sample and install pages. Each login fails, and each page returns 404.
Sources
Related rules
- DAT-59 Turn off database features that reach the server in Data and databases
- APS-64 Close debug and admin doors in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/remove-defaults">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.