missing_direct_file_access_protection
Missing direct file access protection
A PHP file in the plugin can be loaded directly instead of through WordPress.
Why It Shows Up
Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.
Why It Matters
Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.
How to Fix
- Add a guard near the top of PHP files that are not intended to be requested directly.
- Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
- Keep template partials and bootstrap files protected too, not only the main plugin file.
Notes
- Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #5751 | Coupon & Discount Code Reveal Button | 89 | 37 | 10 | 1k+ | wp function not compatible with requires wp | ||
| #5752 | CSS | 89 | 10 | 1 | 500 | Missing Arg Domain | ||
| #5753 | Custom Layouts – Post + Product grids made easy | 89 | 23 | 22 | 4k+ | Missing Translators Comment | ||
| #5754 | Disable WP Registration Page | 89 | 4 | 9 | 2k+ | trademarked term | ||
| #5755 | Cool Flipbox – Shortcode & Gutenberg Block | 89 | 29 | 10 | 5k+ | wp function not compatible with requires wp | ||
| #5756 | Font Awesome | 89 | 21 | 3 | 400k+ | Missing direct file access protection | ||
| #5757 | FV Clone Screen Options | 89 | 16 | 3 | 1k+ | wp function not compatible with requires wp | ||
| #5758 | Location Add-on For Gravity Forms | 89 | 18 | 16 | 400 | Text Domain Mismatch | ||
| #5759 | LH Copy Media File | 89 | 21 | 5 | 800 | wp function not compatible with requires wp | ||
| #5760 | Link View | 89 | 99 | 5 | 700 | Missing Translators Comment | ||
| #5761 | Loading Page with Loading Screen | 89 | 49 | 18 | 10k+ | wp function not compatible with requires wp | ||
| #5762 | MAS Elementor | 89 | 19 | 216 | 1k+ | Non-prefixed hook name | ||
| #5763 | Open Links In New Tab | 89 | 5 | 3 | 900 | Missing direct file access protection | ||
| #5764 | Page Sidebar for Twenty Seventeen | 89 | 110 | 14 | 1k+ | Text Domain Mismatch | ||
| #5765 | Popups for Divi | 89 | 99 | 57 | 100k+ | Text Domain Mismatch | ||
| #5766 | RT Slider | 89 | 9 | 2 | 800 | Missing direct file access protection | ||
| #5767 | Server IP & Memory Usage Display | 89 | 3 | 5 | 30k+ | Input is not sanitized | ||
| #5768 | Shipping by City for Woocommerce | 89 | 13 | 2 | 400 | Text Domain Mismatch | ||
| #5769 | Wbcom Designs – Shortcodes & Elementor Widgets For BuddyPress | 89 | 26 | 184 | 600 | Non-prefixed hook name | ||
| #5770 | Show modified Date in admin lists | 89 | 4 | 3 | 6k+ | Output is not escaped | ||
| #5771 | SiteLock Security – WP Hardening, Login Security & Malware Scans | 89 | 44 | 9 | 1k+ | Text Domain Mismatch | ||
| #5772 | Slimbox Plugin | 89 | 9 | 2 | 500 | Non Enqueued Script | ||
| #5773 | Statify | 89 | 5 | 33 | 100k+ | Direct Query | ||
| #5774 | Superb Table (SEO Optimized Tables With Schema) | 89 | 44 | 12 | 2k+ | wp function not compatible with requires wp | ||
| #5775 | Széchenyi 2020 Logo | 89 | 140 | 9 | 1k+ | Text Domain Mismatch | ||
| #5776 | Tawk.To Live Chat | 89 | 102 | 27 | 100k+ | wp function not compatible with requires wp | ||
| #5777 | Taxonomy Metadata | 89 | 4 | 9 | 4k+ | Direct Query | ||
| #5778 | Turn Off Comments — Hide Comment Box and Stop Spam | 89 | 3 | 4 | 1k+ | Non-prefixed function | ||
| #5779 | User Admin Simplifier | 89 | 106 | 32 | 10k+ | Text Domain Mismatch | ||
| #5780 | Password Strength Settings for WooCommerce | 89 | 17 | 6 | 10k+ | Missing Arg Domain | ||
| #5781 | WP Anywhere Widgets | 89 | 16 | 14 | 700 | wp function not compatible with requires wp | ||
| #5782 | WP AutoTags | 89 | 4 | 5 | 1k+ | trademarked term | ||
| #5783 | WP Database Backup – Unlimited Database & Files Backup by Backup for WP | 89 | 855 | 11 | 30k+ | Text Domain Mismatch | ||
| #5784 | WP Featherlight Disabled | 89 | 5 | 11 | 2k+ | trademarked term | ||
| #5785 | WordPress Widgets Shortcode | 89 | 5 | 4 | 500 | trademarked term | ||
| #5786 | Codevyne SEO Meta Keywords | 89 | 3 | 7 | 4k+ | Non-prefixed function | ||
| #5787 | WPGet API – Connect to any external REST API | 89 | 15 | 19 | 10k+ | Missing direct file access protection | ||
| #5788 | Advanced Custom Fields: Restrict Color Picker Options | 90 | 4 | 3 | 1k+ | Output is not escaped | ||
| #5789 | Animated Headline | 90 | 5 | 16 | 2k+ | Non-prefixed constant | ||
| #5790 | aThemes Addons for Elementor | 90 | 13 | 96 | 8k+ | Non-prefixed global variable | ||
| #5791 | Automatically Paginate Posts | 90 | 12 | 2 | 2k+ | wp function not compatible with requires wp | ||
| #5792 | Avantex Companion | 90 | 35 | 100 | 1k+ | Non-prefixed global variable | ||
| #5793 | Toolbox for Beaver Builder | 90 | 8 | 7 | 600 | Missing Version | ||
| #5794 | Beehive Analytics – Google Analytics Dashboard | 90 | 611 | 22 | 20k+ | Text Domain Mismatch | ||
| #5795 | Billbee – Auftragsabwicklung, Warenwirtschaft, Automatisierung | 90 | 8 | 7 | 500 | Non-prefixed function | ||
| #5796 | Canvas | 90 | 2 | 115 | 10k+ | Non-prefixed global variable | ||
| #5797 | Contact Form 7 Google Analytics | 90 | 6 | 5 | 7k+ | trademarked term | ||
| #5798 | Child Themify | 90 | 10 | 4 | 7k+ | Missing direct file access protection | ||
| #5799 | Compact Archives | 90 | 8 | 14 | 2k+ | Non-prefixed function | ||
| #5800 | Conditional Blocks – Advanced Content Visibility Control for WordPress | 90 | 10 | 22 | 2k+ | Missing direct file access protection |
