Is phpMyAdmin or a debug tool open to anyone on my site?

Updated 2026-10-16

Short answer: database and debug tools left reachable from the internet are one of the fastest ways a site gets broken into. phpMyAdmin, Adminer, Spring Boot Actuator, Laravel Telescope and the Symfony profiler should never answer to strangers on a live site.

How to check it yourself

  1. Visit the usual addresses on your domain: /phpmyadmin/, /adminer.php, /actuator, /telescope, /_profiler.
  2. Anything other than a 404 or a login you control is a warning sign. A tool page that loads without asking who you are is urgent.
  3. Remove the tool from the live server, or restrict it to your own IP address or a VPN.
  4. For framework debug tools, make sure debug mode is off in production.

What Preventionlabs shows

On domains you've proven are yours, every report checks for database and debug tools open to anyone: phpMyAdmin, Adminer, Spring Boot Actuator, Laravel Telescope and the Symfony profiler, alongside leaked files such as .env, git folders, config backups and server status pages.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free