DockRay

Description

DockRay requires an account and a project at https://dockray.io (a free plan
and paid service plans are available). The plugin itself is free.

DockRay sends PHP errors and uncaught exceptions from your WordPress site to a
DockRay project, together with the stack trace, the environment and — when you
allow it — the logged-in user. It can also measure how long requests take.

Features:

• Automatic reporting of PHP errors and uncaught exceptions
• Optional request timing, including admin-ajax actions and WP-CLI commands
• Optional user context
• Error filtering by PHP error type
• Optional vulnerability checks: the versions of WordPress, PHP, plugins and
  themes are matched against DockRay’s vulnerability database, with the
  findings shown on the settings screen and next to affected plugins
• Optional security report: WordPress core files are compared with the
  official WordPress.org checksums, plugins and themes are watched for files
  that change without an update, and PHP hidden in the uploads directory,
  new must-use plugins and risky settings are flagged
• Optional early error reporting: a small drop-in reports fatal errors that
  happen before the plugin loads
• A settings screen at Settings → DockRay, with a live connection
  status and a one-click test event — no wp-config.php editing required
• Configuration can also come from wp-config.php constants, per field or
  entirely, for teams that prefer to keep the private key out of the database
• Translation-ready through translate.wordpress.org

Fill in the token and the private key on Settings → DockRay and you are
done. If you would rather keep the private key out of the database — a
database dump travels between environments more often than a config file
does — define it as a wp-config.php constant instead; the settings screen
shows exactly which fields are currently coming from a constant, and a
Configuration source switch lets you pin the plugin to constants only,
to the database only, or let a defined constant win per field (the default,
and how the plugin behaved before this screen existed).

Configuration

Every setting below has a field on Settings → DockRay. Each one can also
be set as a wp-config.php constant — go there above the /* That's all */
line — and the Configuration source switch on the screen decides whether
a constant is allowed to win, is required, or is ignored in favour of the
database.

Error types — which PHP errors become events. Defaults to everything except
deprecations and notices. This one is constant-only; there is no equivalent
field on the settings screen, since it is a bitmask rather than a value worth
typing into a text box.

define( 'DOCK_RAY_ERROR_TYPES', E_ALL & ~E_DEPRECATED & ~E_NOTICE );

Personal data — attaches the user id, e-mail, IP address and user agent.
Off by default.

define( 'DOCK_RAY_SEND_DEFAULT_PII', true );

Release — the version of the site. Without it the active theme version is
used.

define( 'DOCK_RAY_VERSION', 'v1.4.0' );

Environment — defaults to WP_ENVIRONMENT_TYPE.

define( 'DOCK_RAY_ENV', 'production' );

Request timing — the share of requests that are measured, from 0 to 1.
Zero, the default, disables it.

define( 'DOCK_RAY_TRACES_SAMPLE_RATE', 0.2 );

Vulnerability checks — periodically sends the versions of WordPress, PHP
and the installed plugins and themes, so DockRay can flag known
vulnerabilities. Off by default.

define( 'DOCK_RAY_INVENTORY', true );

Security report — periodically sends checksums of the site files and a
few security settings, so DockRay can flag modified core files, plugins
changed without an update and PHP files in the uploads directory. Off by
default.

define( 'DOCK_RAY_SECURITY', true );

Early error reporting — the Install the drop-in button on the settings
screen copies dropins/fatal-error-handler.php from the plugin to
wp-content/fatal-error-handler.php. Where WordPress may not write files
(DISALLOW_FILE_MODS, a read-only container), copy it there in your
deployment instead. It reads the same token and private key, from the
constants above, the RAY_TOKEN and RAY_PRIVATE_KEY environment variables
or the saved settings.

Filters

dock_ray_token, `dock_ray_private_key` — override the

credentials, for instance to read them from a secrets manager.

dock_ray_user_context — change the user data attached to events.

add_filter( 'dock_ray_user_context', fn( array $user ) => array_merge( $user, [ 'plan' => 'pro' ] ) );

dock_ray_scope — set tags and extra context before events are sent.

add_filter( 'dock_ray_scope', function ( $scope ) { $scope->setTag( 'tier', 'gold' ); return $scope; } );

dock_ray_options — adjust SDK options after the client is built.

dock_ray_client_builder — an action that receives the client builder before

the client is created.

Reporting your own exceptions

if ( function_exists( 'dock_ray_safe' ) ) {
    dock_ray_safe( fn( $hub ) => $hub->captureException( $exception ) );
}

The callback runs only when the plugin is configured, so the calling code does
not have to check.

External services

This plugin sends data to DockRay (https://dockray.io), the monitoring service
it is a client for. Nothing is sent until you enter a project token and a
private key on Settings → DockRay or configure those credentials through
wp-config.php constants or plugin filters: without credentials the plugin loads
and stays silent.

What is sent, and when:

• PHP errors and uncaught exceptions, as they happen — the message, the
  error type, the stack trace with the surrounding source lines, the file and
  line, the site URL, the environment and release, the WordPress version and
  the site language.
• Request timings, when the transaction sample rate is above zero — the
  request path, the HTTP method and the response status. WP-Cron runs
  (including wp cron and Action Scheduler queue runners) are not timed: they
  are the site’s own background work rather than visitor traffic, so their
  duration says nothing about how fast the site is. Errors raised
  inside a scheduled task are still reported. Off by default.
• JavaScript errors, when that switch is on — the message, the script URL
  and the stack trace, forwarded by this site rather than sent from the
  browser. Off by default.
• The logged-in user and the visitor IP address, only when Send user identity, IP
  address and user agent is on. Off by default.
• A test event, when you click Send a test event on the settings screen.
• Software versions, only when Send software versions for vulnerability
  checks is on — the WordPress and PHP versions, the slug, name, version,
  active state and available update of every installed plugin (must-use
  plugins included) and theme, the site address and the plugin version.
  Sent about twice a day (DockRay may ask for a different interval, between
  one hour and seven days) and about a minute after plugins, themes or
  WordPress itself are installed, updated, activated, deactivated or removed,
  always from WP-Cron in the background, and when you click Send now. No
  file paths, users, e-mail addresses or configuration values are included.
  Off by default.
• The security report, only when Send a file integrity and security
  report is on — checksums (MD5 for WordPress core files, SHA-256 for
  everything else) of the WordPress core files, of every plugin and theme as
  one digest each, of wp-config.php, .htaccess, must-use plugins and
  drop-ins; the paths relative to the WordPress directory, sizes and
  modification times of PHP files found in the uploads directory, of hidden
  directories there and of files with code typical of backdoors, with the
  names of the patterns found; whether core files are writable by PHP,
  DISALLOW_FILE_MODS, DISALLOW_FILE_EDIT, display_errors, WP_DEBUG
  display and command-execution functions are on; the WordPress, PHP and
  plugin versions and the site address. Sent every six hours (DockRay may ask
  for a different interval, between one hour and one day), shortly after
  software changes and when you click Send now. File contents, absolute
  paths, users and configuration values are never included. Off by default.
• Fatal errors caught by the early error drop-in, only when you install
  it — the error message, file, line, request URL without the query string
  and the environment, the same as other PHP errors.

Everything is sent to DockRay at https://dockray.io.

Request bodies, cookies, request headers, URL query strings and fragments,
and stack frame argument values are removed before delivery. Error messages,
source code context, file paths and custom context may still contain personal
or sensitive information supplied by your application. Review what your
application logs and inform your visitors before enabling monitoring.
Browser reports also include the page and referrer URLs without query strings
or fragments. Normal reports are queued until shutdown; the manual test waits
for an acknowledgement. The service receives the IP of the sending server.

Service terms: https://dockray.io/pl/regulamin
Privacy policy: https://dockray.io/privacy-policy

define( 'DOCK_RAY_TOKEN', 'YOUR_PROJECT_TOKEN' );
define( 'DOCK_RAY_PRIVATE_KEY', 'YOUR_PRIVATE_KEY' );