What Is Security Misconfiguration?
Security misconfiguration is the broad category of insecure defaults, overly-open settings, and forgotten features — the gap between “it works” and “it is safe.” It is one of the most common entries in the OWASP Top 10 precisely because secure configuration is rarely the default and easy to overlook. No exotic exploit required; the door was simply left open.
What does misconfiguration look like?#
| Case | Example |
|---|---|
| Default credentials | admin/admin left unchanged |
| Verbose errors | Stack traces revealing internals |
| Unneeded features | Sample apps, debug endpoints in prod |
| Open storage | Public cloud buckets |
| Missing headers | No security headers |
| Excess permissions | Over-privileged service accounts |
Each is individually simple, which is what makes the category so pervasive — and so findable by attackers running routine scans.
Why is it so widespread?#
Because software optimizes for a smooth start, not a secure one. Defaults favor convenience: sample accounts to log in with, permissive settings so nothing blocks you, features enabled so you can explore. Every one you leave as-is is exposure. Add configuration drift over time and the sprawling surface of cloud platforms, and insecure states become the path of least resistance.
How do you prevent it?#
- Harden by default — apply a security baseline like CIS Benchmarks.
- Remove what you do not need — sample apps, debug features, unused services.
- Automate configuration — infrastructure as code so settings are reviewable and repeatable.
- Scan for drift — detect when systems wander from the baseline.
Misconfiguration is where security baselines and hardening pay off. More at the Web Security hub.
Frequently asked questions#
What is security misconfiguration?
Security misconfiguration is any insecure setting, default, or oversight in how a system is configured — default credentials, verbose error messages, unnecessary features enabled, open cloud storage, missing security headers. It is one of the most common categories in the OWASP Top 10 because secure configuration is easy to skip and rarely default.
Why is misconfiguration so common?
Because software ships to be easy to start, not secure by default: sample accounts, permissive settings, and enabled features to help you get going. Every unchanged default and unremoved feature is potential exposure. Systems also drift over time, and complex cloud platforms make insecure states easy to reach accidentally.