DockRay

io (a free plan

and paid service plans are available). The plugin itself is free.

DockRay sends PHP errors and uncaught exceptions from your WordPress site to a

DockRay project, together with the stack trace, the environment and — when you

allow it — the logged-in user. It can also measure how long requests take.

Features:

• Automatic reporting of PHP errors and uncaught exceptions

• Optional request timing, including admin-ajax actions and WP-CLI commands

• Optional user context

• Error filtering by PHP error type

• Optional vulnerability checks: the versions of WordPress, PHP, plugins and

themes are matched against DockRay’s vulnerability database, with the

findings shown on the settings screen and next to affected plugins

• Optional security report: WordPress core files are compared with the

org checksums, plugins and themes are watched for files

that change without an update, and PHP hidden in the uploads directory,

new must-use plugins and risky settings are flagged

• Optional early error reporting: a small drop-in reports fatal errors that

happen before the plugin loads

• A settings screen at Settings → DockRay, with a live connection

php editing required

• Configuration can also come from wp-config.php constants, per field or

entirely, for teams that prefer to keep the private key out of the database

• Translation-ready through translate.wordpress.org

Fill in the token and the private key on Settings → DockRay and you are

done. If you would rather keep the private key out of the database — a

database dump travels between environments more often than a config file

php constant instead; the settings screen

shows exactly which fields are currently coming from a constant, and a

Configuration source switch lets you pin the plugin to constants only,

to the database only, or let a defined constant win per field (the default,

and how the plugin behaved before this screen existed).

Configuration

Every setting below has a field on Settings → DockRay. Each one can also

php constant — go there above the /* That's all */

line — and the Configuration source switch on the screen decides whether

a constant is allowed to win, is required, or is ignored in favour of the

database.

Error types — which PHP errors become events. Defaults to everything except

deprecations and notices. This one is constant-only; there is no equivalent

field on the settings screen, since it is a bitmask rather than a value worth

typing into a text box.

define( 'DOCK_RAY_ERROR_TYPES', E_ALL & ~E_DEPRECATED & ~E_NOTICE );

Personal data — attaches the user id, e-mail, IP address and user agent.

Off by default.

define( 'DOCK_RAY_SEND_DEFAULT_PII', true );

Release — the version of the site. Without it the active theme version is

used.

0' );

Environment — defaults to WP_ENVIRONMENT_TYPE.

define( 'DOCK_RAY_ENV', 'production' );

Request timing — the share of requests that are measured, from 0 to 1.

Zero, the default, disables it.

2 );

Vulnerability checks — periodically sends the versions of WordPress, PHP

and the installed plugins and themes, so DockRay can flag known

vulnerabilities. Off by default.

define( 'DOCK_RAY_INVENTORY', true );

Security report — periodically sends checksums of the site files and a

few security settings, so DockRay can flag modified core files, plugins

changed without an update and PHP files in the uploads directory. Off by

default.

define( 'DOCK_RAY_SECURITY', true );

Early error reporting — the Install the drop-in button on the settings

php from the plugin to

php. Where WordPress may not write files

( DISALLOW_FILE_MODS, a read-only container), copy it there in your

deployment instead. It reads the same token and private key, from the

constants above, the RAY_TOKEN and RAY_PRIVATE_KEY environment variables

or the saved settings.

Filters

dock_ray_token, `dock_ray_private_key` — override the

credentials, for instance to read them from a secrets manager.

dock_ray_user_context — change the user data attached to events.

add_filter( 'dock_ray_user_context', fn( array $user ) => array_merge( $user, [ 'plan' => 'pro' ] ) );

dock_ray_scope — set tags and extra context before events are sent.

add_filter( 'dock_ray_scope', function ( $scope ) { $scope->setTag( 'tier', 'gold' ); return $scope; } );

dock_ray_options — adjust SDK options after the client is built.

dock_ray_client_builder — an action that receives the client builder before

the client is created.

Reporting your own exceptions

if ( function_exists( 'dock_ray_safe' ) ) { dock_ray_safe( fn( $hub ) => $hub->captureException( $exception ) ); }

The callback runs only when the plugin is configured, so the calling code does

not have to check.

External services

io), the monitoring service

it is a client for. Nothing is sent until you enter a project token and a

private key on Settings → DockRay or configure those credentials through

php constants or plugin filters: without credentials the plugin loads

and stays silent.

What is sent, and when:

• PHP errors and uncaught exceptions, as they happen — the message, the

error type, the stack trace with the surrounding source lines, the file and

line, the site URL, the environment and release, the WordPress version and

the site language.

• Request timings, when the transaction sample rate is above zero — the

request path, the HTTP method and the response status. WP-Cron runs

(including wp cron and Action Scheduler queue runners) are not timed: they

are the site’s own background work rather than visitor traffic, so their

duration says nothing about how fast the site is. Errors raised

inside a scheduled task are still reported. Off by default.

• JavaScript errors, when that switch is on — the message, the script URL

and the stack trace, forwarded by this site rather than sent from the

browser. Off by default.

• The logged-in user and the visitor IP address, only when Send user identity, IP

address and user agent is on. Off by default.

• A test event, when you click Send a test event on the settings screen.

• Software versions, only when Send software versions for vulnerability

checks is on — the WordPress and PHP versions, the slug, name, version,

active state and available update of every installed plugin (must-use

plugins included) and theme, the site address and the plugin version.

Sent about twice a day (DockRay may ask for a different interval, between

one hour and seven days) and about a minute after plugins, themes or

WordPress itself are installed, updated, activated, deactivated or removed,

always from WP-Cron in the background, and when you click Send now. No

file paths, users, e-mail addresses or configuration values are included.

Off by default.

• The security report, only when Send a file integrity and security

report is on — checksums (MD5 for WordPress core files, SHA-256 for

everything else) of the WordPress core files, of every plugin and theme as

htaccess, must-use plugins and

drop-ins; the paths relative to the WordPress directory, sizes and

modification times of PHP files found in the uploads directory, of hidden

directories there and of files with code typical of backdoors, with the

names of the patterns found; whether core files are writable by PHP,

DISALLOW_FILE_MODS, DISALLOW_FILE_EDIT, display_errors, WP_DEBUG

display and command-execution functions are on; the WordPress, PHP and

plugin versions and the site address. Sent every six hours (DockRay may ask

for a different interval, between one hour and one day), shortly after

software changes and when you click Send now. File contents, absolute

paths, users and configuration values are never included. Off by default.

• Fatal errors caught by the early error drop-in, only when you install

it — the error message, file, line, request URL without the query string

and the environment, the same as other PHP errors.

io.

Request bodies, cookies, request headers, URL query strings and fragments,

and stack frame argument values are removed before delivery. Error messages,

source code context, file paths and custom context may still contain personal

or sensitive information supplied by your application. Review what your

application logs and inform your visitors before enabling monitoring.

Browser reports also include the page and referrer URLs without query strings

or fragments. Normal reports are queued until shutdown; the manual test waits

for an acknowledgement. The service receives the IP of the sending server.

io/pl/regulamin

io/privacy-policy