Sensitive Files
WordPress Debug Log Exposure Check
The debug.log file can contain sensitive site information. Check that it is not publicly accessible and learn how to disable it in production.
What this test checks
This test checks whether the WordPress debug log file (debug.log) is publicly accessible. This file contains detailed information about errors, warnings, and SQL queries executed on your site. Its exposure can reveal database structure, credentials, or file paths, making attacks easier.
Our recommendation
Disable debugging in production by setting WP_DEBUG_LOG to false in your wp-config.php. If you must keep logs, place the file outside the site's public directory and protect it with authentication. Use error monitoring plugins (e.g., Sentry, Bugsnag) to track issues without exposing information to visitors. Regularly check for this file and delete it if no longer needed.
Security tests
Read more
Header Security