Why displaying PHP and WordPress notices to visitors can expose paths, queries and implementation details.
Why this check matters
A notice that helps a developer can confuse a visitor and disclose information useful to an attacker. Logging and display are separate controls and should be treated separately.
How to review it
- Check whether WP_DEBUG_DISPLAY is enabled.
- Keep errors in a protected log when troubleshooting is required.
- Test a public page while logged out after changing the setting.
- Review the log and remove sensitive diagnostic data.
Keep the change safe
Do not suppress every error blindly. Fix the underlying warning, keep display off, and use a controlled log for diagnosis.
How WPVitals uses this signal
WPVitals checks this setting locally and reports the result in the WordPress dashboard. The check is a maintenance signal, so review the site context before changing a setting and test the visitor experience afterwards.