Exercise 2: Why a Live Site with WP_DEBUG Still True Is a Real Problem — Possible Solution ==================================================================== WHAT WP_DEBUG ACTUALLY CONTROLS ------------------------------ Per this chapter, WP_DEBUG "toggles PHP error/warning output" - when enabled, PHP errors, warnings, and notices that occur while the page is being generated get printed directly onto the page itself, rather than being hidden from the visitor. WHY THIS MATTERS FOR A LIVE, PUBLIC SITE ------------------------------ Per this chapter, leaving WP_DEBUG "true" accidentally on a live site "can leak technical details to visitors" - specifically, PHP error messages routinely reveal internal information a site owner would never want exposed publicly: full server file paths, the names and structure of PHP functions being called, database-related error text, and sometimes fragments of the underlying code itself. This isn't merely untidy - it's real information disclosure, handing a potential attacker a head start on understanding the site's internal structure. WHY THIS IS A GENUINE SECURITY ISSUE, NOT JUST A STYLE PROBLEM ------------------------------ A visitor (or an attacker deliberately probing for errors) seeing raw PHP warnings learns real facts about the server's internal layout and configuration that should never be visible outside the development process. This is the kind of information that narrows down what vulnerabilities might be worth trying next - not a cosmetic issue like an ugly typo, but a genuine crack in the site's own information security. WHY THIS CHAPTER FRAMES IT AS "SHOULD ALWAYS BE FALSE ONCE LIVE" ------------------------------ Per this chapter, WP_DEBUG being true has real, legitimate value during active development, where seeing those same errors immediately helps a developer catch and fix bugs. The problem specifically described here is leaving it on unintentionally after the site has gone live to real visitors - the setting itself isn't wrong to use, only wrong to forget to turn back off. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains precisely what WP_DEBUG does technically, connects that directly to the specific kind of information it leaks, explains why that leaked information constitutes a genuine security risk rather than a cosmetic issue, and distinguishes the setting's legitimate development-time use from the specific live-site oversight this chapter is actually warning against.