Security Notes
Security considerations for wpzylos-logger.
Sensitive Data
Never Log Credentials
// Bad: NEVER log passwords or keys
$logger->info('Login attempt', [
'user' => $username,
'password' => $password, // NEVER
]);
// Good: Log safe data only
$logger->info('Login attempt', [
'user' => $username,
'ip' => $_SERVER['REMOTE_ADDR'],
]);
Sanitize PII
// Mask email
$logger->info('User registered', [
'email' => substr($email, 0, 3) . '***@***',
]);
File Security
Protect Log Files
# .htaccess in logs/
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
Store Outside Web Root
// Prefer wp-content outside public
$handler = new FileHandler(WP_CONTENT_DIR . '/../logs/app.log');