---
title: "Remove defaults and samples · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/secrets-and-configuration/remove-defaults
id: APS-66
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 637
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Remove defaults and samples

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-66
- Level: Recommended
- Chapter: [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md)
- Rule: Change every default password and remove sample apps, admin consoles and test pages before going live.
- Check: Try the default login for each product in use, and request each product's sample and install pages. Each login fails, and each page returns 404.
- How: Set new passwords for databases, admin panels and devices during setup. Delete example pages and install scripts. Close admin ports to the internet, or put them behind a login and a private network. Debug tools are covered in [close debug and admin doors](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/close-debug-doors.md).

## Sources

- [OWASP Top 10 A02:2025 Security Misconfiguration](https://top10.owasp.org/2025/A02_2025-Security_Misconfiguration/)
- [CWE-1392 Use of Default Credentials](https://cwe.mitre.org/data/definitions/1392.html)

## Related rules

- DAT-59 [Turn off database features that reach the server](https://agentwranglers.se/playbook/data/database-security/server-file-access.md) in Data and databases
- APS-64 [Close debug and admin doors](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/close-debug-doors.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/remove-defaults">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Serve no hidden files](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/no-hidden-files.md)
- Next: [Keep software current and quiet](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/patch-and-hide-versions.md)
- [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md)