[ad_1]
I thought the best way to debug a WordPress site was to enable logging to debug.log, but through Wordfence I found out that de debug.log file is publicly accessible for anyone. This seems like a big security risk.
Is debug.log always publicly available by default? What is the safest way to debug a WordPress website?
[ad_2]
Yes, it’s a regular file that anyone can access.
Once you’ve finished debugging, disable debugging and delete the file. Generally it’s not to big of a deal if someone sees it, there isn’t *usually* anything in it that poses a risk to your site.
Some servers absolutely block it. I wouldn’t be shocked if some just blocked all .log access, because why make that public?
It’s generally done with .htaccess or Nginx rules.
If you can access it publicly on your server, it’s public.