Is your WordPress debug.log public? How to check and fix it

A guide for site owners. Updated October 13, 2026.

When something goes wrong on a WordPress site, a common fix-it step is to switch on debugging in wp-config.php. With WP_DEBUG_LOG set to true, WordPress writes every error and warning to /wp-content/debug.log. That folder is public, so unless your server blocks it, anyone can read the file. It's often left on long after the problem was fixed.

Why it matters

• It shows your server's folder layout and every plugin and theme that logged an error, which tells an attacker exactly which known bugs to try.
• Errors can include whatever the code was handling at the time: database queries, email addresses, order details, sometimes keys from a plugin's settings.
• It can grow to gigabytes, and bots that find it download it again and again.

Is yours public? Check in 10 seconds

Open https://yoursite.com/wp-content/debug.log in a private browser window. If you see lines starting with a date in square brackets, like [13-Oct-2026 09:14:02 UTC] PHP Warning: …, it's public. A "not found" or "forbidden" page means it isn't. The free store check looks for it too, along with public usernames, XML-RPC and more.

Three ways to fix it

1. Turn the log off, then delete the file

If you're not debugging anything, set these in wp-config.php (above the line that says "That's all, stop editing!"):

define( 'WP_DEBUG', false );
define( 'WP_DEBUG_LOG', false );
define( 'WP_DEBUG_DISPLAY', false );

Then delete wp-content/debug.log with your host's file manager or FTP.

2. Keep logging, but outside the website

Since WordPress 5.1, WP_DEBUG_LOG can be a file path instead of true. Point it at a folder above your site's public folder, so no web address reaches it:

define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', '/home/youraccount/logs/wp-errors.log' );
define( 'WP_DEBUG_DISPLAY', false );

Your host can tell you the right path. Then delete the old wp-content/debug.log.

3. Block it at the server

As a safety net, whatever happens to wp-config.php later. On Apache (in the .htaccess file in your site's main folder):

<Files "debug.log">
  Require all denied
</Files>

On nginx:

location ~* /debug\.log$ { deny all; }

Many hosts and firewalls can add the same rule for you.