---
title: Is BugTrace safe on a live site?
description: Yes, if you follow a few simple rules. Learn what to turn off and what not to share.
url: "https://docs.prefixwp.com/docs/bugtrace/bugtrace-getting-started/is-bugtrace-safe-on-a-live-site/"
updated: "2026-11-10"
category: Getting started
---

# Is BugTrace safe on a live site?

Yes, you can use BugTrace on a live site. But debug logs can hold private details. Follow the rules on this page to keep your site safe.

## What BugTrace does to protect you

- Only **administrators** can open BugTrace pages and use its buttons.
- BugTrace does not send your log or your site data to any other server.
- The **Help** links (Google, ChatGPT) open only when you click them. Your browser opens them, not BugTrace.
- When you activate BugTrace, it keeps `WP_DEBUG_DISPLAY` off. So visitors do not see errors on your pages.
- On the WP Config tab, passwords, keys and salts are hidden until you turn on **Show sensitive values**.

## What you need to watch

### Your debug log can be public

Errors are saved in `wp-content/debug.log`. On many servers, anyone can open this file in a browser. BugTrace does not block it.

On a live site, turn off `WP_DEBUG_LOG` when you finish. Then clear the log. Go to `BugTrace → Settings` to turn it off, and `BugTrace → Logs` to clear it.

### Server Info shows private details

The Server Info page shows your `wp-config.php` file, your database name and host, and your own browser cookies. This is useful for you, but not for other people.

### BugTrace keeps a copy of wp-config.php

Each time BugTrace changes your settings, it saves a copy of `wp-config.php`. The copy is called `wp-config-backup.php`. It is in the same folder. If you do not need it, you can delete it with your host's file manager.

## Do and don't

- Do turn on `WP_DEBUG_LOG` only while you look for a problem.
- Do clear the log when you finish.
- Do check a screenshot before you send it to someone.
- Don't turn on `WP_DEBUG_DISPLAY` on a live site. Visitors would see your errors.
- Don't share screenshots of the **WP Config** or **Cookies** tabs. They can show passwords or login data.
- Don't give administrator access to people you do not trust. Administrators can see everything in BugTrace.