What it is

WP_DEBUG is turned on in production. While it's on, WordPress can print full file paths and detailed error messages directly to visitors — information that helps an attacker map out the site and plan an attack.

How to fix it

Open wp-config.php and set WP_DEBUG to false (or remove the line) on the live site. Keep it enabled only on a staging or test copy.

In depth

WP_DEBUG is a setting that makes WordPress show detailed error messages and technical information directly on your website when something goes wrong. When this is turned on in your live site, visitors can see file locations and system details that hackers use to find weaknesses and plan attacks against you. Think of it like leaving your house blueprints taped to your front door where anyone walking by can read them. To fix this, you need to edit a file called wp-config.php on your server and change the line that says WP_DEBUG to false, or simply delete that line entirely. You can ask your hosting provider to help you access and edit this file if you're not comfortable doing it yourself. Once it's turned off on your live site, error messages will stop displaying publicly, but you can still create a testing copy of your site where you leave WP_DEBUG on to catch problems during development.