Laravel
← Back to all checks

Security

Information disclosure

Looks for software versions in your headers and pages, and for error pages showing stack traces. Both tell attackers exactly which exploits to try.

How it works

Once a day, we look for details that help attackers:

  • Software versions in response headers such as Server, X-Powered-By, X-AspNet-Version, X-Generator and X-Runtime, and in the page's generator meta tag. A bare Server: nginx is harmless, but an exact version tells an attacker which known exploits to try.
  • Debug output on a page that does not exist: stack traces, framework error pages, SQL errors and fatal errors mean debug mode is on in production, which can leak file paths, queries and secrets.

Debug tools such as Telescope are covered by the Exposed files check.

Statuses

Status Meaning
OK No versions or debug output found.
Warning Software versions are disclosed, or we could not connect.
Failed Error pages show debug output.

By default you are notified of failures only.

Fixing common problems

  • Debug output: turn off debug mode in production (APP_DEBUG=false in Laravel, display_errors = Off in PHP).
  • Versions in headers: hide them. In nginx, use server_tokens off;. In PHP, set expose_php = Off. In Apache, use ServerTokens Prod. Remove X-Powered-By in your application or proxy, and remove the version from the generator meta tag (most CMSs have a setting or plugin for it).