內容簡介
DockRay 是一款免費的 WordPress 外掛，能自動將 PHP 錯誤和未捕獲的例外傳送至 DockRay 專案，並提供請求時間測量及安全性檢查，幫助開發者快速定位問題。
【主要功能】
• 自動報告 PHP 錯誤和未捕獲的例外
• 可選的請求時間測量
• 錯誤類型過濾功能
• 可選的使用者上下文
• 漏洞檢查功能
• 簡易設定介面
外掛標籤
開發者團隊
原文外掛簡介
DockRay requires an account and a project at https://dockray.io (a free plan
and paid service plans are available). The plugin itself is free.
DockRay sends PHP errors and uncaught exceptions from your WordPress site to a
DockRay project, together with the stack trace, the environment and — when you
allow it — the logged-in user. It can also measure how long requests take.
Features:
Automatic reporting of PHP errors and uncaught exceptions
Optional request timing, including admin-ajax actions and WP-CLI commands
Optional user context
Error filtering by PHP error type
Optional vulnerability checks: the versions of WordPress, PHP, plugins and
themes are matched against DockRay’s vulnerability database, with the
findings shown on the settings screen and next to affected plugins
Optional security report: WordPress core files are compared with the
official WordPress.org checksums, plugins and themes are watched for files
that change without an update, and PHP hidden in the uploads directory,
new must-use plugins and risky settings are flagged
Optional early error reporting: a small drop-in reports fatal errors that
happen before the plugin loads
A settings screen at Settings → DockRay, with a live connection
status and a one-click test event — no wp-config.php editing required
Configuration can also come from wp-config.php constants, per field or
entirely, for teams that prefer to keep the private key out of the database
Translation-ready through translate.wordpress.org
Fill in the token and the private key on Settings → DockRay and you are
done. If you would rather keep the private key out of the database — a
database dump travels between environments more often than a config file
does — define it as a wp-config.php constant instead; the settings screen
shows exactly which fields are currently coming from a constant, and a
Configuration source switch lets you pin the plugin to constants only,
to the database only, or let a defined constant win per field (the default,
and how the plugin behaved before this screen existed).
Configuration
Every setting below has a field on Settings → DockRay. Each one can also
be set as a wp-config.php constant — go there above the /* That's all */
line — and the Configuration source switch on the screen decides whether
a constant is allowed to win, is required, or is ignored in favour of the
database.
Error types — which PHP errors become events. Defaults to everything except
deprecations and notices. This one is constant-only; there is no equivalent
field on the settings screen, since it is a bitmask rather than a value worth
typing into a text box.
define( 'DOCK_RAY_ERROR_TYPES', E_ALL & ~E_DEPRECATED & ~E_NOTICE );
Personal data — attaches the user id, e-mail, IP address and user agent.
Off by default.
define( 'DOCK_RAY_SEND_DEFAULT_PII', true );
Release — the version of the site. Without it the active theme version is
used.
define( 'DOCK_RAY_VERSION', 'v1.4.0' );
Environment — defaults to WP_ENVIRONMENT_TYPE.
define( 'DOCK_RAY_ENV', 'production' );
Request timing — the share of requests that are measured, from 0 to 1.
Zero, the default, disables it.
define( 'DOCK_RAY_TRACES_SAMPLE_RATE', 0.2 );
Vulnerability checks — periodically sends the versions of WordPress, PHP
and the installed plugins and themes, so DockRay can flag known
vulnerabilities. Off by default.
define( 'DOCK_RAY_INVENTORY', true );
Security report — periodically sends checksums of the site files and a
few security settings, so DockRay can flag modified core files, plugins
changed without an update and PHP files in the uploads directory. Off by
default.
define( 'DOCK_RAY_SECURITY', true );
Early error reporting — the Install the drop-in button on the settings
screen copies dropins/fatal-error-handler.php from the plugin to
wp-content/fatal-error-handler.php. Where WordPress may not write files
(DISALLOW_FILE_MODS, a read-only container), copy it there in your
deployment instead. It reads the same token and private key, from the
constants above, the RAY_TOKEN and RAY_PRIVATE_KEY environment variables
or the saved settings.
Filters
dock_ray_token, `dock_ray_private_key` — override the
credentials, for instance to read them from a secrets manager.
dock_ray_user_context — change the user data attached to events.
add_filter( 'dock_ray_user_context', fn( array $user ) => array_merge( $user, [ 'plan' => 'pro' ] ) );
dock_ray_scope — set tags and extra context before events are sent.
add_filter( 'dock_ray_scope', function ( $scope ) { $scope->setTag( 'tier', 'gold' ); return $scope; } );
dock_ray_options — adjust SDK options after the client is built.
dock_ray_client_builder — an action that receives the client builder before
the client is created.
Reporting your own exceptions
if ( function_exists( 'dock_ray_safe' ) ) {
dock_ray_safe( fn( $hub ) => $hub->captureException( $exception ) );
}
The callback runs only when the plugin is configured, so the calling code does
not have to check.
External services
This plugin sends data to DockRay (https://dockray.io), the monitoring service
it is a client for. Nothing is sent until you enter a project token and a
private key on Settings → DockRay or configure those credentials through
wp-config.php constants or plugin filters: without credentials the plugin loads
and stays silent.
What is sent, and when:
PHP errors and uncaught exceptions, as they happen — the message, the
error type, the stack trace with the surrounding source lines, the file and
line, the site URL, the environment and release, the WordPress version and
the site language.
Request timings, when the transaction sample rate is above zero — the
request path, the HTTP method and the response status. WP-Cron runs
(including wp cron and Action Scheduler queue runners) are not timed: they
are the site’s own background work rather than visitor traffic, so their
duration says nothing about how fast the site is. Errors raised
inside a scheduled task are still reported. Off by default.
JavaScript errors, when that switch is on — the message, the script URL
and the stack trace, forwarded by this site rather than sent from the
browser. Off by default.
The logged-in user and the visitor IP address, only when Send user identity, IP
address and user agent is on. Off by default.
A test event, when you click Send a test event on the settings screen.
Software versions, only when Send software versions for vulnerability
checks is on — the WordPress and PHP versions, the slug, name, version,
active state and available update of every installed plugin (must-use
plugins included) and theme, the site address and the plugin version.
Sent about twice a day (DockRay may ask for a different interval, between
one hour and seven days) and about a minute after plugins, themes or
WordPress itself are installed, updated, activated, deactivated or removed,
always from WP-Cron in the background, and when you click Send now. No
file paths, users, e-mail addresses or configuration values are included.
Off by default.
The security report, only when Send a file integrity and security
report is on — checksums (MD5 for WordPress core files, SHA-256 for
everything else) of the WordPress core files, of every plugin and theme as
one digest each, of wp-config.php, .htaccess, must-use plugins and
drop-ins; the paths relative to the WordPress directory, sizes and
modification times of PHP files found in the uploads directory, of hidden
directories there and of files with code typical of backdoors, with the
names of the patterns found; whether core files are writable by PHP,
DISALLOW_FILE_MODS, DISALLOW_FILE_EDIT, display_errors, WP_DEBUG
display and command-execution functions are on; the WordPress, PHP and
plugin versions and the site address. Sent every six hours (DockRay may ask
for a different interval, between one hour and one day), shortly after
software changes and when you click Send now. File contents, absolute
paths, users and configuration values are never included. Off by default.
Fatal errors caught by the early error drop-in, only when you install
it — the error message, file, line, request URL without the query string
and the environment, the same as other PHP errors.
Everything is sent to DockRay at https://dockray.io.
Request bodies, cookies, request headers, URL query strings and fragments,
and stack frame argument values are removed before delivery. Error messages,
source code context, file paths and custom context may still contain personal
or sensitive information supplied by your application. Review what your
application logs and inform your visitors before enabling monitoring.
Browser reports also include the page and referrer URLs without query strings
or fragments. Normal reports are queued until shutdown; the manual test waits
for an acknowledgement. The service receives the IP of the sending server.
Service terms: https://dockray.io/pl/regulamin
Privacy policy: https://dockray.io/privacy-policy
