Is having the WP_DEBUG_LOG enabled, and having a debug.log in a production environment a security issue?

  • Which debug log are you talking about, are you looking for "yes" or "no" for this?
    – bravokeyl
    Commented Aug 8, 2017 at 9:34
  • The WP_DEBUG in the debug.log file Commented Aug 8, 2017 at 12:11

1 Answer 1


I would consider it a security concern if everyone is able to view the debug.log file from the browser.

It could reveal e.g. paths, plugins and their problems.

There are though ways to restrict access to it via Nginx or Apache.

Another problem I've seen with logging to debug.log on production sites is that it's not auto log-rotated, so it can grow fast for busy problematic sites. It's easy to forget about it there, until the disk is full or the huge size starts to slow things down.

ps: I just remembered I wrote something about access restrictions here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.