Warn About a Public debug.log File
Alerts administrators when WordPress writes errors to wp-content/debug.log, a file anyone can usually download and read.
Opens WPIDE on
Code
add_action( 'admin_notices', function () {
if ( ! current_user_can( 'manage_options' ) ) {
return;
}
$file = WP_CONTENT_DIR . '/debug.log';
if ( ! file_exists( $file ) ) {
return;
}
printf(
'<div class="notice notice-warning"><p><strong>Public debug log found</strong> (%1$s). Visitors may be able to read it at /wp-content/debug.log. Delete it and set WP_DEBUG_LOG to a path outside the web root in wp-config.php.</p></div>',
esc_html( size_format( (int) filesize( $file ) ) )
);
} );Notes
Some hosts block access to .log files; the notice cannot tell, so check the URL yourself.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.