What it is

WordPress's debug.log file is publicly downloadable. It can contain file paths, plugin/theme errors and, occasionally, sensitive data from failed operations — all useful reconnaissance for an attacker.

How to fix it

Delete this file, and disable public access to debug.log — the WordPress Plugin's Security tab can block access to files like this automatically.

In depth

Your WordPress site is leaving a detailed log file publicly visible on the internet that hackers can read. This file contains error messages from your site's operations, including the exact folder structure of your website and details about which plugins or themes you're using. Sometimes this log file also records sensitive information like database errors or partial passwords from failed transactions, which gives attackers valuable clues about how to break into your site. Think of it like leaving your building's security blueprints and maintenance notes in the front lobby. To fix this, you need to delete the existing debug.log file from your server, which you can do through your hosting control panel by finding the file in your WordPress folder and removing it. Then you should either have your hosting provider block public access to any log files automatically, or install a security plugin that prevents people from downloading these files by simply visiting their web address. After that, your site will stop creating this publicly accessible log file and attackers won't be able to spy on your website's inner workings.