Error Page Information Leakage Check
VitalSite triggers error responses and scans them for stack traces, file paths, and version strings that hand attackers a roadmap.
Verbose error pages are a quiet but valuable gift to attackers. A stack trace reveals your framework and file paths; a database error exposes query structure; a version string tells them exactly what to exploit. VitalSite triggers an error response and scans the body for these leaks.
What VitalSite checks
We request a non-existent path to provoke an error and inspect the response for:
- Stack traces (framework error dumps, "Traceback", "at ... (file:line:col)")
- Server file paths (/var/www/, /home/user/, C:\Windows)
- Database and runtime errors (SQL errors, PHP warnings/fatals)
- Software version strings (Apache/2.x, nginx/1.x, PHP/7.x)
If any appear, the error page is leaking internal detail it shouldn't.
Why it matters
Individually, each leak is "just" information disclosure. Together, they give an attacker a precise map of your application — its framework, directory layout, database, and versions — which dramatically speeds up finding a real exploit (and pairs directly with CVE matching). This almost always comes from running an app in debug mode in production.
How to fix it
1. Disable debug mode in production. Set your framework's debug/display-errors flag to off. In PHP, display_errors = Off. In Laravel, APP_DEBUG=false. In Django, DEBUG = False. In WordPress, WP_DEBUG to false.
2. Use generic custom error pages. Configure friendly 404 and 500 pages that reveal nothing about the internals.
3. Log errors server-side instead. Send full details to a private log file (outside the web root) so your team can debug without exposing anything publicly.
4. Suppress version banners as covered in the tech stack check.
Verify the fix
Re-scan the domain. The Error Page Information Leakage check should report that error responses are clean — no stack traces, paths, or versions. As a manual check, visit a random non-existent URL and confirm you see a plain custom error page.
Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.
See if this affects your site
Run a free full-domain scan — this check runs on every page, with an exact fix guide.