Xdebug on in production is a 3x tax you did not agree to

Merely loading the extension slows execution substantially even with no debugging session and no profiler running, because it installs hooks into the engine.

$ php -m | grep -i xdebug
xdebug

$ php -d zend_extension= -r '...'      # without
$ php -r '...'                          # with

# same benchmark, one server, 2018:
#   without xdebug   184 req/s
#   with xdebug       61 req/s

It ends up in production through a Dockerfile that installs it unconditionally, or a package that pulls it in, and nothing announces its presence. Adding a check to the deploy or to a health endpoint is the reliable prevention. The right arrangement is a separate ini file enabled only in the development image, and keeping the profiler behind a trigger so that even locally it runs when asked rather than always.