<p>As <a href="https://craftcms.stackexchange.com/questions/33782/avoid-saving-post-in-craft-logs-for-certain-urls#comment41078_33782">Oli</a> commented, those will only be logged if <code>devMode</code> is enabled, which should never be the case in production.</p>

<p>Outside of that, Craft does have a <code>sensitiveKeywords</code> propery in the Security class: <a href="https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29" rel="nofollow noreferrer">https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29</a> that defaults to these keywords: <a href="https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29" rel="nofollow noreferrer">https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29</a> and will redact those from places like log files.</p>

<p>If you need to modify that list, you can do so from by extending the <a href="https://docs.craftcms.com/v3/config/app.html#app" rel="nofollow noreferrer">application config</a> like so:</p>

<pre><code>&lt;?php
return [
    'components' =&gt; [
        'security' =&gt; [
            'class' =&gt; craft\services\Security::class,
            'sensitiveKeywords' =&gt; [
                'key1',
                'key2',
            ],
        ],
    ],
];
</code></pre>

CC BY-SA 4.0
2020-02-28T05:12:08.413Z
Thanks for clarifying, Oli and Brad, and that's a very useful tip regarding the sensitiveKeywords.
Wei
CC BY-SA 4.0
2020-02-27T23:49:04.720Z
2020-02-27T23:49:04.720Z
Brad Bell
<p>We know that Craft logs the $_POST variable in web.log. I wonder if we have some sensitive data going through the server side (collected from a front end form), even if we don't save it in the database, it can still potentially end up in Craft's logs, isn't it? E.g. when there's an error during the form submission.</p>

<p>Is there any ways which we could avoid saving the $_POST variable in the log, just for certain URLs?</p>

CC BY-SA 4.0
2020-02-27T09:17:04.807Z
You will only see those if you have `'devMode' => true,` in your `config/general.php`
Oli
<craft3><form><logs><logging>
Avoid saving $_POST in Craft logs for certain URLs
# Avoid saving $_POST in Craft logs for certain URLs

(Asked by: username_0 on 2020-02-27)

We know that Craft logs the $\_POST variable in web.log. I wonder if we have some sensitive data going through the server side (collected from a front end form), even if we don't save it in the database, it can still potentially end up in Craft's logs, isn't it? E.g. when there's an error during the form submission.

Is there any ways which we could avoid saving the $\_POST variable in the log, just for certain URLs?

**Tags:** craft3, form, logs, logging

> **Comments:**
> **username_1**: You will only see those if you have `'devMode' => true,` in your `config/general.php`  

---

## 1 answers

### Answer by username_2 on 2020-02-27. Score: 1 | Accepted answer

As username_1 commented, those will only be logged if devMode is enabled, which should never be the case in production.
Outside of that, Craft does have a sensitiveKeywords propery in the Security class: https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29 that defaults to these keywords: https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29 and will redact those from places like log files.
If you need to modify that list, you can do so from by extending the application config like so:
 [
        'security' => [
            'class' => craft\services\Security::class,
            'sensitiveKeywords' => [
                'key1',
                'key2',
            ],
        ],
    ],
];

> **Comments:**
> **username_0**: Thanks for clarifying, username_1 and Brad, and that's a very useful tip regarding the sensitiveKeywords.  

---

