Security, logs are public

[User]

Hi,
even when not connected as Admin, the logs files are visible for all. exemple. urlSite/wp-content/logs/newsletter/antispam-2026-09-33d924e6.txt OR upgrade-2026-9.txt (with some admin informations in files)
Off course i can mitigate this y adding Apache or Nginx restriction, but after that logs are not available via admin panel (403 error, this is logical)

has someone get this problem too ?
Thanks
Franck

[Michael]

Hello Franck,

usually the logs generated by Newsletter have an hash at the end of their filenames to make them non predictable, but I understand this may not be enough for everyone, from a security standpoint. I’ll talk to our devs about this, thanks for your feedback!

Michael

[Stefano]

Hi, I suggest leaving the logging level at “none” on Newsletter/Settings, meanwhile, we’re correcting the code to avoid that fatal error levels and the upgrading process ignore the logging level.
Thank you for reporting!

[Author]

Posts