Every check ยท Exposed files
Database admin pages
What it checks
/phpmyadmin/, /phpMyAdmin/, /adminer.php
Why it matters
phpMyAdmin or Adminer signs in to the database from the web, so anyone can try passwords against it.
How to fix it
- Restrict it to your own address in the web server, or reach it through a VPN or an SSH tunnel.
- Remove it if you don't use it: Adminer is one file you can upload when you need it.
Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users