---
title: "Duo Two-Factor WordPress Plugin Filling the PHP Log With \"Duo debug\" Lines"
canonical: "https://techwiki.co.uk/cms/duo-wordpress-plugin-debug-log-lines"
author: "Adam Birds"
article_type: "documentation"
published: "2026-10-31T15:35:44.235Z"
updated: "2026-10-31T15:35:44.236Z"
categories: ["Cms"]
tags: ["duo","wordpress"]
---**The PHP error log gets `Duo debug` lines for logged-in users on most requests, including the username and URL of each request.**

```text
Duo debug: Verifying second factor for user: <username> URL: /wp-admin/admin-ajax.php path: / network path: /cookie domain:  is SSL: 1
Duo debug: User <username> allowed
```

These lines are not errors. `User <username> allowed` is a successful check.

## Cause

Debug logging is switched on in the Duo plugin's own file. There is no setting for it in wp-admin, and it is not stored in the database. The official release ships with it set to `false`, so a value of `true` means the file has been edited on that site.

## Fix

Check the current value, then set it to `false`. Run these from the WordPress root:

```bash
grep -n 'DuoDebug = ' wp-content/plugins/duo-wordpress/duo_wordpress.php
sed -i 's/\$DuoDebug = true;/$DuoDebug = false;/' wp-content/plugins/duo-wordpress/duo_wordpress.php
```

Run the commands as the site's user, so the file's ownership does not change. No PHP restart should be needed if OPcache timestamp validation is on, which is the default.

## Verify

Confirm that the file now matches the official release:

```bash
wp plugin verify-checksums duo-wordpress
```

Then browse wp-admin while logged in and check that no new `Duo debug` lines appear in the log.

## Notes

- Debug output includes usernames and URLs, so leave it off on production sites.
- Because the official release ships with `false`, a plugin update will not turn logging back on.
- Tested with Duo Two-Factor Authentication for WordPress 2.5.7 on PHP 8.5.