Duo Two-Factor WordPress Plugin Filling the PHP Log With "Duo debug" Lines
Stop the Duo two-factor plugin writing debug lines to the PHP log by setting $DuoDebug to false in duo_wordpress.php.
The PHP error log gets Duo debug lines for logged-in users on most requests, including the username and URL of each request.
Duo debug: Verifying second factor for user: <username> URL: /wp-admin/admin-ajax.php path: / network path: /cookie domain: is SSL: 1
Duo debug: User <username> allowed
These lines are not errors. User <username> allowed is a successful check.
Cause
Debug logging is switched on in the Duo plugin’s own file. There is no setting for it in wp-admin, and it is not stored in the database. The official release ships with it set to false, so a value of true means the file has been edited on that site.
Fix
Check the current value, then set it to false. Run these from the WordPress root:
grep -n 'DuoDebug = ' wp-content/plugins/duo-wordpress/duo_wordpress.php
sed -i 's/\$DuoDebug = true;/$DuoDebug = false;/' wp-content/plugins/duo-wordpress/duo_wordpress.php
Run the commands as the site’s user, so the file’s ownership does not change. No PHP restart should be needed if OPcache timestamp validation is on, which is the default.
Verify
Confirm that the file now matches the official release:
wp plugin verify-checksums duo-wordpress
Then browse wp-admin while logged in and check that no new Duo debug lines appear in the log.
Notes
- Debug output includes usernames and URLs, so leave it off on production sites.
- Because the official release ships with
false, a plugin update will not turn logging back on. - Tested with Duo Two-Factor Authentication for WordPress 2.5.7 on PHP 8.5.