SEC-031
WordPress config backup or debug log is public
HighDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
wp-config.php backups (.bak, ~, .save, .old) and /wp-content/debug.log.
Why it matters
A wp-config backup is served as plain text with the database password and auth salts; debug.log reveals paths, plugin errors and sometimes user data.
Recommended fix
Delete the backups and the debug log, set WP_DEBUG_LOG to false, and rotate the database password.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-031: WordPress config backup or debug log is public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Delete the wp-config backup files and wp-content/debug.log listed in the evidence, set WP_DEBUG and WP_DEBUG_LOG to false in production, block these paths in the server config, and rotate the database password and salts if a config backup was exposed.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.