DockRay

DockRay requires an account and a project at https://dockray.io (a free plan
and paid service plans are available). The plugin itself is free.

DockRay sends PHP errors and uncaught exceptions from your WordPress site to a
DockRay project, together with the stack trace, the environment and — when you
allow it — the logged-in user. It can also measure how long requests take.

Features:

• Automatic reporting of PHP errors and uncaught exceptions
• Optional request timing, including admin-ajax actions and WP-CLI commands
• Optional user context
• Error filtering by PHP error type
• Optional vulnerability checks: the versions of WordPress, PHP, plugins and
  themes are matched against DockRay’s vulnerability database, with the
  findings shown on the settings screen and next to affected plugins
• A settings screen at Settings → DockRay, with a live connection
  status and a one-click test event — no wp-config.php editing required
• Configuration can also come from wp-config.php constants, per field or
  entirely, for teams that prefer to keep the private key out of the database
• Translation-ready through translate.wordpress.org

Fill in the token and the private key on Settings → DockRay and you are
done. If you would rather keep the private key out of the database — a
database dump travels between environments more often than a config file
does — define it as a wp-config.php constant instead; the settings screen
shows exactly which fields are currently coming from a constant, and a
Configuration source switch lets you pin the plugin to constants only,
to the database only, or let a defined constant win per field (the default,
and how the plugin behaved before this screen existed).

Configuration

Every setting below has a field on Settings → DockRay. Each one can also
be set as a wp-config.php constant — go there above the /* That's all */
line — and the Configuration source switch on the screen decides whether
a constant is allowed to win, is required, or is ignored in favour of the
database.

Error types — which PHP errors become events. Defaults to everything except
deprecations and notices. This one is constant-only; there is no equivalent
field on the settings screen, since it is a bitmask rather than a value worth
typing into a text box.

define( 'DOCK_RAY_ERROR_TYPES', E_ALL & ~E_DEPRECATED & ~E_NOTICE );

Personal data — attaches the user id, e-mail, IP address and user agent.
Off by default.

define( 'DOCK_RAY_SEND_DEFAULT_PII', true );

Release — the version of the site. Without it the active theme version is
used.

define( 'DOCK_RAY_VERSION', 'v1.4.0' );

Environment — defaults to WP_ENVIRONMENT_TYPE.

define( 'DOCK_RAY_ENV', 'production' );

Request timing — the share of requests that are measured, from 0 to 1.
Zero, the default, disables it.

define( 'DOCK_RAY_TRACES_SAMPLE_RATE', 0.2 );

Vulnerability checks — periodically sends the versions of WordPress, PHP
and the installed plugins and themes, so DockRay can flag known
vulnerabilities. Off by default.

define( 'DOCK_RAY_INVENTORY', true );<h3>Filters</h3>
dock_ray_token, `dock_ray_private_key` — override the

credentials, for instance to read them from a secrets manager.

dock_ray_user_context — change the user data attached to events.

add_filter( 'dock_ray_user_context', fn( array $user ) => array_merge( $user, [ 'plan' => 'pro' ] ) );

dock_ray_scope — set tags and extra context before events are sent.

add_filter( 'dock_ray_scope', function ( $scope ) { $scope->setTag( 'tier', 'gold' ); return $scope; } );

dock_ray_options — adjust SDK options after the client is built.

dock_ray_client_builder — an action that receives the client builder before

the client is created.

Reporting your own exceptions

if ( function_exists( 'dock_ray_safe' ) ) {
    dock_ray_safe( fn( $hub ) => $hub->captureException( $exception ) );
}

The callback runs only when the plugin is configured, so the calling code does
not have to check.

External services

This plugin sends data to DockRay (https://dockray.io), the monitoring service
it is a client for. Nothing is sent until you enter a project token and a
private key on Settings → DockRay or configure those credentials through
wp-config.php constants or plugin filters: without credentials the plugin loads
and stays silent.

What is sent, and when:

• PHP errors and uncaught exceptions, as they happen — the message, the
  error type, the stack trace with the surrounding source lines, the file and
  line, the site URL, the environment and release, the WordPress version and
  the site language.
• Request timings, when the transaction sample rate is above zero — the
  request path, the HTTP method and the response status. WP-Cron runs
  (including wp cron and Action Scheduler queue runners) are not timed: they
  are the site’s own background work rather than visitor traffic, so their
  duration says nothing about how fast the site is. Errors raised
  inside a scheduled task are still reported. Off by default.
• JavaScript errors, when that switch is on — the message, the script URL
  and the stack trace, forwarded by this site rather than sent from the
  browser. Off by default.
• The logged-in user and the visitor IP address, only when Send user identity, IP
  address and user agent is on. Off by default.
• A test event, when you click Send a test event on the settings screen.
• Software versions, only when Send software versions for vulnerability
  checks is on — the WordPress and PHP versions, the slug, name, version,
  active state and available update of every installed plugin (must-use
  plugins included) and theme, the site address and the plugin version.
  Sent about twice a day (DockRay may ask for a different interval, between
  one hour and seven days) and about a minute after plugins, themes or
  WordPress itself are installed, updated, activated, deactivated or removed,
  always from WP-Cron in the background, and when you click Send now. No
  file paths, users, e-mail addresses or configuration values are included.
  Off by default.

Everything is sent to DockRay at https://dockray.io.

Request bodies, cookies, request headers, URL query strings and fragments,
and stack frame argument values are removed before delivery. Error messages,
source code context, file paths and custom context may still contain personal
or sensitive information supplied by your application. Review what your
application logs and inform your visitors before enabling monitoring.
Browser reports also include the page and referrer URLs without query strings
or fragments. Normal reports are queued until shutdown; the manual test waits
for an acknowledgement. The service receives the IP of the sending server.

Service terms: https://dockray.io/pl/regulamin
Privacy policy: https://dockray.io/privacy-policy