src/Handler/DefaultHandlerFactory.php
private function maybe_create_htaccess( $folder ) {

		if (
			! $folder
			|| ! is_dir( $folder )
			|| ! is_writable( $folder )
			|| file_exists( "{$folder}/.htaccess" )
			|| ! defined( 'WP_CONTENT_DIR' )
		) {
			return $folder;
		}

		$target_dir  = realpath( $folder );
		$content_dir = realpath( WP_CONTENT_DIR );

		// Sorry, we can't allow logs to be put straight in content folder. That's too dangerous.
		if ( $target_dir === $content_dir ) {
			$target_dir .= DIRECTORY_SEPARATOR . 'wonolog';
		}

		// If target dir is outside content dir, its security is up to user.
		if ( strpos( $target_dir, $content_dir ) !== 0 ) {
			return $target_dir;
		}

		// Let's disable error reporting: too much file operations which might fail, nothing can log them, and package
		// is fully functional even if failing happens. Silence looks like best option here.
		set_error_handler( '__return_true' );

		$handle = fopen( "{$folder}/.htaccess", 'w' );

		if ( $handle && flock( $handle, LOCK_EX ) ) {
			$htaccess = <<<'HTACCESS'
<IfModule mod_authz_core.c>
	Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
	Deny from all
</IfModule>
HTACCESS;

			if ( fwrite( $handle, $htaccess ) ) {
				flock( $handle, LOCK_UN );
				chmod( "{$folder}/.htaccess", 0444 );
			}
		}

		fclose( $handle );

		restore_error_handler();

		return $target_dir;
	}
private function maybe_create_htaccess( $folder ) {

		if (
			! $folder
			|| ! is_dir( $folder )
			|| ! is_writable( $folder )
			|| file_exists( "{$folder}/.htaccess" )
			|| ! defined( 'WP_CONTENT_DIR' )
		) {
			return $folder;
		}

		$target_dir  = realpath( $folder );
		$content_dir = realpath( WP_CONTENT_DIR );

		// Sorry, we can't allow logs to be put straight in content folder. That's too dangerous.
		if ( $target_dir === $content_dir ) {
			$target_dir .= DIRECTORY_SEPARATOR . 'wonolog';
		}

		// If target dir is outside content dir, its security is up to user.
		if ( strpos( $target_dir, $content_dir ) !== 0 ) {
			return $target_dir;
		}

		// Let's disable error reporting: too much file operations which might fail, nothing can log them, and package
		// is fully functional even if failing happens. Silence looks like best option here.
		set_error_handler( '__return_true' );

		$handle = fopen( "{$folder}/.htaccess", 'w' );

		if ( $handle && flock( $handle, LOCK_EX ) ) {
			$htaccess = <<<'HTACCESS'
<IfModule mod_authz_core.c>
	Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
	Deny from all
</IfModule>
HTACCESS;

			if ( fwrite( $handle, $htaccess ) ) {
				flock( $handle, LOCK_UN );
				chmod( "{$folder}/.htaccess", 0444 );
			}
		}

		fclose( $handle );

		restore_error_handler();

		return $target_dir;
	}
private function maybe_create_htaccess ( $ folder ) { if ( ! $ folder || ! is_dir ( $ folder ) || ! is_writable ( $ folder ) || file_exists ( "{$folder}/.htaccess" ) || ! defined ( 'WP_CONTENT_DIR' ) ) { return $ folder ; } $ target_dir = realpath ( $ folder ) ; $ content_dir = realpath ( WP_CONTENT_DIR ) ; // Sorry, we can't allow logs to be put straight in content folder. That's too dangerous. if ( $ target_dir === $ content_dir ) { $ target_dir .= DIRECTORY_SEPARATOR . 'wonolog' ; } // If target dir is outside content dir, its security is up to user. if ( strpos ( $ target_dir , $ content_dir ) !== 0 ) { return $ target_dir ; } // Let's disable error reporting: too much file operations which might fail, nothing can log them, and package // is fully functional even if failing happens. Silence looks like best option here. set_error_handler ( '__return_true' ) ; $ handle = fopen ( "{$folder}/.htaccess" , 'w' ) ; if ( $ handle && flock ( $ handle , LOCK_EX ) ) { $ htaccess =  <<<'HTACCESS'
<IfModule mod_authz_core.c>
	Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
	Deny from all
</IfModule>
HTACCESS ; if ( fwrite ( $ handle , $ htaccess ) ) { flock ( $ handle , LOCK_UN ) ; chmod ( "{$folder}/.htaccess" , 0444 ) ; } } fclose ( $ handle ) ; restore_error_handler ( ) ; return $ target_dir ; }
When the log root folder is inside WordPress content folder, the logs are going to be publicly accessible, and
that is in best case a privacy leakage issue, in worst case a security threat.
We try to write an .htaccess file to prevent access to them.
This guarantees nothing, because .htaccess can be ignored depending web server in use and its configuration,
but at least we tried.
To configure a custom log folder outside content folder is also highly recommended in documentation.

@param string $folder

@return string
When the log root folder is inside WordPress content folder the logs are going to be publicly accessible and that is in best case a privacy leakage issue in worst case a security threat . We try to write an . htaccess file to prevent access to them . This guarantees nothing because . htaccess can be ignored depending web server in use and its configuration but at least we tried . To configure a custom log folder outside content folder is also highly recommended in documentation .