highSeverity: highRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.App source / web serverWhere it livesImplementationThis fix is applied in: App source / web server. That's the surface you'll edit, DNS, response headers, or a static file.~5 minTime to fixEffortRoughly 5 minutes of hands-on work, propagation aside. Most of these are copy-paste.+20 posture+20 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

Exposed phpinfo(): delete the page that maps your whole server

Deleting the phpinfo page removes a full, public readout of your PHP and server configuration.

The threat

The scanner loaded a page and got a phpinfo() readout: the big table PHP prints when you call that one function. These pages almost always start life as a quick “is PHP working?” test named info.php, phpinfo.php, or test.php, dropped in the web root and then forgotten.

The problem is what that one page reveals. It lists your exact PHP and OS versions, every loaded module and its version, your full php.ini settings, absolute filesystem paths like DOCUMENT_ROOT and SCRIPT_FILENAME, and the server’s environment variables. That is a ready-made map of what you run and where it lives, which is exactly the reconnaissance an attacker does first when picking which exploit to try.

The exact fix

This one is refreshingly simple: the page has no business existing in production, so remove it.

Delete the file. Find any diagnostic PHP page and delete it:

# from your web root, find pages that call phpinfo()
grep -rl 'phpinfo(' /var/www --include='*.php'
# then remove each one
rm /var/www/html/info.php

Keep it from coming back. These files get committed by accident, so add them to .gitignore and never include diagnostic scripts in your build or deploy.

If you genuinely cannot delete it this second, disable the function so the page renders nothing useful, then delete it properly:

; php.ini
disable_functions = phpinfo

Watch the environment section. phpinfo() also prints environment variables. If any of yours hold secrets (some apps keep API keys there), treat those as seen and rotate them, then delete the page.

Verify it

curl -s -o /dev/null -w '%{http_code}\n' https://yourdomain.com/info.php

You want 404. Re-run it for the common names too (phpinfo.php, test.php, i.php); a correct result is 404 on all of them, not a 200 that returns HTML with PHP Version in it.

Proof

The ApeCyber scanner flags this on every scan with a single passive GET from the outside, touching nothing. apecyber.com is a static Astro site on Netlify with no PHP at all, so a phpinfo() page cannot exist there to leak, one reason it holds an A / 100. Removing the page is a clean −20 off the posture score.