Remove a public WordPress debug log

tech-wp-debug-log

debug.log is readable under wp-content and holds file paths, queries and sometimes credentials. Delete it and stop writing logs into the web root.

Why this matters

Your WordPress debug log is publicly readable. It may contain file paths, queries, and internal details — information disclosure that aids attackers but is not directly exploitable.

Your stack

Web servers

Nginx

Frameworks

WordPress

Nginx

1 Block access to debug.log at the web server level as a defense-in-depth measure

nginx

location = /wp-content/debug.log {
    deny all;
    return 404;
}

WordPress

1 Delete the wp-content/debug.log file from your server
2 In wp-config.php, set WP_DEBUG to false or log to a non-web-accessible path

php

// In wp-config.php: disable debug logging in production
define('WP_DEBUG', false);
define('WP_DEBUG_LOG', false);

// Or log to a path outside the web root:
// define('WP_DEBUG_LOG', '/var/log/wordpress/debug.log');

Does your app still have this?

Scan your domain