Server Configuration
PHP Error Display in Production Check
Displaying PHP errors in production is a security flaw. Learn how to disable them and use logs for secure debugging.
What this test checks
This test checks whether PHP errors (Fatal error, Parse error, Warning, Notice, Deprecated, Uncaught Error, Exception) are displayed publicly on your site. Displaying errors in production exposes sensitive information about code structure, file paths, PHP versions, and sometimes database credentials. This data facilitates targeted attacks.
Our recommendation
Disable error display in production by setting display_errors to Off in your php.ini. In Laravel, ensure APP_DEBUG is set to false in your .env file. Use logs (storage/logs/laravel.log) for debugging. Also configure an error monitoring service (e.g., Sentry, Bugsnag) to be alerted without exposing information to visitors.
Security tests
Read more
Form Security