Errorgap

外掛說明

errorgap captures WordPress runtime failures and sends them to an errorgap project using the native errorgap notice endpoint.

The plugin is intentionally dependency-free and uses WordPress core APIs for settings, sanitization, and HTTP delivery.

Reporting is disabled by default. A site administrator must configure an Errorgap endpoint and enable reporting before the plugin sends data.

Configuration

Endpoint:
The base URL for your errorgap instance, for example https://errorgap.example.com.

Project slug:
The errorgap project slug. Notices are sent to /api/projects/{project_slug}/notices.

Project key:
The errorgap Project API key. It is sent as X-Errorgap-Project-Key.

Environment:
Defaults to wp_get_environment_type(), then production.

Sample rate:
Use 1.0 to report every captured error. Lower values sample captured notices before sending.

APM:
Optionally record request timings and send APM transactions. Database query spans can also be included; SQL string and numeric literals are replaced with placeholders before transmission. APM can also be enabled from wp-config.php with define('ERRORGAP_APM_ENABLED', true); and define('ERRORGAP_APM_DB_QUERIES', true);.

Reported severities:
The plugin reports its own set of PHP error severities (errors and warnings) independently of the site’s global error-reporting level, so activating it never changes how the rest of your site reports or displays PHP errors. Notices, deprecations, and strict notices are not reported by default, and neither are errors the code silenced with @, such as core’s expected write-test failures. Adjust the set with the errorgap_reported_severities filter:

add_filter('errorgap_reported_severities', fn() => E_ALL & ~E_DEPRECATED);

Sign-ins:
Optionally report sign-ins to Errorgap’s Security › Logins: each successful sign-in (wp_login), each failed attempt on wp-login.php, XML-RPC or REST authentication (wp_login_failed), and each password reset (after_password_reset). Errorgap flags a new IP address, country or hour for a user and can alert on a sign-in after many failures. Off by default; turn it on with the Sign-ins setting or define('ERRORGAP_AUTH_EVENTS', true);. The app is named after the site’s host (filter errorgap_sign_in_app); behind a proxy, supply the client address with the errorgap_sign_in_ip filter.

Browser errors and session replay:
Optionally load the Errorgap browser SDK (@errorgap/browser, bundled in the plugin at assets/errorgap-browser.js; no remote script) on the public site. It reports JavaScript errors from visitors’ browsers, and records session replay when replay is switched on in the project’s Errorgap settings. Not loaded in wp-admin or on the login page, and only when a project key is set. Off by default; turn it on with the “Browser errors & session replay” setting or define('ERRORGAP_BROWSER_SDK', true);. Adjust the browser configuration with the errorgap_browser_config filter. Mark content that must never be captured in a snapshot with data-errorgap-block (removed) or data-errorgap-mask (text replaced).

Constants:
Every connection setting can also be defined in wp-config.php, above the /* That's all, stop editing! */ line. Constants take precedence over values saved on the settings screen, and keep the project key out of the database:

define('ERRORGAP_ENDPOINT', 'https://errorgap.example.com');
define('ERRORGAP_PROJECT_SLUG', 'my-project');
define('ERRORGAP_API_KEY', getenv('ERRORGAP_API_KEY'));
define('ERRORGAP_ENVIRONMENT', 'production'); // optional
define('ERRORGAP_ENABLED', true); // optional; implied when endpoint and slug are defined
define('ERRORGAP_AUTH_EVENTS', true); // optional; report sign-ins
define('ERRORGAP_BROWSER_SDK', true); // optional; browser errors and session replay

Empty values and getenv() misses are ignored, so the defines are safe in environments where the variables are not set.

External Service and Data Disclosure

This plugin connects to the Errorgap endpoint configured by the site administrator. The service receives and stores error reports and, when APM is enabled, performance transactions so administrators can diagnose application failures and performance problems. The plugin does not send data until reporting has been explicitly enabled or enabled through the documented wp-config.php constants.

Error reports may include error types and messages, request URLs, HTTP methods and hostnames, backtrace file paths and function names, source-code excerpts surrounding failing lines, WordPress and PHP versions, environment and site URLs, sanitized GET and POST parameters, and the ID, login, email address, and roles of a logged-in WordPress user. Fields whose names indicate passwords, authorization values, tokens, secrets, keys, nonces, or cookies are replaced with [FILTERED]; other request values may still contain personal or sensitive information.

When APM is enabled, transactions may include a random per-request identifier (also attached to errors from that request), request paths, response status codes, durations, environment names, and timestamps. If database query spans are also enabled, normalized SQL statements and their durations are sent. String and numeric SQL literals are replaced with placeholders before transmission.

When sign-in reporting is enabled, each sign-in, failed sign-in attempt and password reset sends the user name entered or signed in with, the IP address, the browser user agent, the request method and path (without the query string), the outcome and a timestamp. Passwords are never sent. Errorgap can be set to store user names as a salted hash.

When browser errors and session replay are enabled, visitors’ browsers send JavaScript error reports (error type and message, stack frames, page URL, browser user agent, language and screen size) directly to the Errorgap endpoint, and read the project’s replay settings from it. While session replay is switched on for the project, a sampled share of visits also sends a session timeline: a random session id, browser, operating system and device class, page paths, failed request methods and paths (without query strings), error messages, and descriptions of rage or dead clicks (the clicked element’s text). When the project captures page snapshots, a static copy of the page is sent on the chosen trigger with every form field value removed, scripts removed, and anything marked data-errorgap-block or data-errorgap-mask removed or masked. Keystrokes are never recorded. The project key is embedded in the page, as it is an ingest-only key. Errorgap derives the visitor’s country from the request IP address.

The destination and data-handling terms depend on the endpoint selected by the administrator. For the hosted Errorgap service, see the Errorgap Privacy Policy and Errorgap Terms of Service. Administrators using a self-hosted or third-party endpoint are responsible for that endpoint’s data handling and disclosures.