Skip to content

OWASP A05: Security misconfiguration

Are your servers and tools properly locked down?

Background

Default passwords. Admin interfaces facing the internet. Verbose error messages. Cloud storage buckets accidentally public.

Questions to ask yourself

  • Are admin interfaces reachable from the public internet?
  • Are cloud storage buckets, databases, or APIs facing the internet without auth?
  • Are we showing detailed error messages to users?
  • Has anyone reviewed our server and cloud configuration against a benchmark?

What you can do today

Three scans, no excuses

Easiest class of flaw to find.

  • 01Run Security Headers on your site. Aim for B+.
  • 02Check admin paths (/admin, /wp-admin, /phpmyadmin). Restrict by IP or VPN.
  • 03For cloud users, use Defender for Cloud / AWS Trusted Advisor / Google SCC.