diff --git a/doc/setup.rst b/doc/setup.rst
index 66eb0469e4..474a93e866 100644
--- a/doc/setup.rst
+++ b/doc/setup.rst
@@ -756,6 +756,7 @@ are always ways to make your installation more secure:
 
 * Serve phpMyAdmin on HTTPS only. Preferably, you should use HSTS as well, so that
   you're protected from protocol downgrade attacks.
+* Remove the ``test`` directory from phpMyAdmin, unless you are developing and need test suite.
 * Remove the ``setup`` directory from phpMyAdmin, you will probably not
   use it after the initial setup.
 * Properly choose an authentication method - :ref:`cookie`