Download websites that use PHPDebugBar

About PHPDebugBar

PHPDebugBar is a development tool, so finding it on a public website is usually a finding in itself. The toolbar renders inside the page and exposes what a developer wants while debugging, including executed database queries, request parameters, session contents, exceptions, timing profiles and custom log messages.

Written in PHP and released under the MIT licence in 2013, the toolbar plugs into the common frameworks of that ecosystem as well as into standalone applications. On a developer machine it is unremarkable and extremely useful. On a production domain it means the application is serving debug output to the public, and the same panel that helps an engineer also describes the database structure, the framework in use and the shape of internal requests to anybody who opens the page.

The audience for a list like this is unusual, because the interesting thing is the mistake rather than the product. Security researchers use it to measure how common a misconfiguration really is instead of arguing from anecdote. Attack surface and asset management vendors use it to demonstrate exposure at scale to a customer who does not believe the problem exists internally. Hosting providers use it to find accounts that are one page load away from leaking query text. Framework and tooling maintainers read the same set for a different reason entirely, as a rough census of where their stack is deployed.

There is a second reading of the same data that has nothing to do with security. A debugging toolbar is installed by a working development team, not by a site builder or a hosting wizard, so its footprint traces where custom application work is actually being done in a language whose public presence is otherwise dominated by content management systems. For anyone selling to development shops rather than to site owners, the distinction between a hand built application and a packaged platform is the whole segmentation, and few signals draw the line as cleanly.

Honesty matters more than the total here. Detection sees the assets and markers the toolbar leaves in a delivered page, which is strong evidence but not confirmation that the panel renders for every visitor, since some installations sit behind an address allowlist or an authenticated session. Bundled assets can also survive in a build long after the collector itself was switched off. As of October 2026 we record 1,322 sites, and each one is a lead to verify rather than a confirmed exposure.

A per domain check answers a question about one site, usually after something has already gone wrong. The downloadable list supports the opposite kind of work. Measure prevalence across a country or a top level domain, watch whether it falls after a framework changes its defaults, and find the affected estate before somebody less friendly goes looking for it.