You are browsing the documentation for iTop 3.0 which is not the current version.

Consider browsing to iTop 3.1 documentation

Protect iTop setup


The setup wizard used during first install could be disabled to reduce attack surface. Two files are particularly concerned :

  • setup/index.php : of course
  • setup/phpinfo.php : gives lots of informations about the system (note that risk is mitigated by adding authentication since iTop 2.5.2, 2.6.1 and 2.7.0)


You shouldn't remove the whole setup/ directory as it contains files that are necessary for iTop.

Instead you could block web access using a file appropriate to the web server you're using. Such files are already present in the data/ directory, for example :

* Apache httpd :

* Microsoft IIS :

iTop update

To ease iTop update, you might want to automate the procedure. See Automated installation.

3_0_0/install/itop_setup_protection.txt ยท Last modified: 2022/01/21 16:52 (external edit)
Back to top
Contact us