Data exposure

Debug error pages turned off

Configuration files, backups and source code that should never be public.

Why it matters

Debug pages show source code, file paths, environment variables and often database passwords to anyone who triggers an error; some let visitors execute code on the server.

How to fix it

Quick fix · under 1 hour

Turn debug mode off in the production configuration and restart the application.
Configure a plain error page for 404 and 500 responses.
Rotate any secret that a debug page may have shown.
Re-run the scan to confirm.

Django (settings.py)

DEBUG = False
ALLOWED_HOSTS = ["example.com"]

Laravel (.env)

APP_DEBUG=false
APP_ENV=production

PHP (php.ini)

display_errors = Off
log_errors = On

ASP.NET (web.config)

<customErrors mode="On" />

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free