WP_DEBUG left enabled in production

What it is

WP_DEBUG is turned on in production. While it's on, WordPress can print full file paths and detailed error messages directly to visitors — information that helps an attacker map out the site and plan an attack.

How to fix it

Open wp-config.php and set WP_DEBUG to false (or remove the line) on the live site. Keep it enabled only on a staging or test copy.