Remove a public phpinfo page

exposed-phpinfo

A phpinfo page prints your PHP build, loaded modules, absolute paths and environment variables to any visitor. Delete it from the web root.

Why this matters

Your PHP configuration page is publicly accessible. It reveals server paths, modules, and environment details — reconnaissance data that aids further attacks but is not directly exploitable.

Your stack

Web servers

Nginx Apache

Frameworks

Laravel WordPress

Nginx

1 Remove the phpinfo() file from production
2 Block access as a safety net

nginx

location ~ /phpinfo\.php {
    deny all;
    return 404;
}

Apache

1 Remove the phpinfo() file from production

apacheconf

# Remove the file
rm /var/www/html/phpinfo.php

# Block as safety net in .htaccess
<Files "phpinfo.php">
    Require all denied
</Files>

Does your app still have this?

Scan your domain