0

Is having the WP_DEBUG_LOG enabled, and having a debug.log in a production environment a security issue?

  • Which debug log are you talking about, are you looking for "yes" or "no" for this? – bravokeyl Aug 8 '17 at 9:34
  • The WP_DEBUG in the debug.log file – baswijdenesdotcom Aug 8 '17 at 12:11
2

I would consider it a security concern if everyone is able to view the debug.log file from the browser.

It could reveal e.g. paths, plugins and their problems.

There are though ways to restrict access to it via Nginx or Apache.

Another problem I've seen with logging to debug.log on production sites is that it's not auto log-rotated, so it can grow fast for busy problematic sites. It's easy to forget about it there, until the disk is full or the huge size starts to slow things down.

ps: I just remembered I wrote something about access restrictions here.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.