Detailed error messages should be suppressed across all layers - web server configs, application configs, and error handlers - because they can leak sensitive information like file paths, database schemas, or server versions. Attackers use this information for reconnaissance. Defense in depth requires suppressing at every layer.