PluginScore

missing_direct_file_access_protection

Missing direct file access protection

A PHP file in the plugin can be loaded directly instead of through WordPress.

medium weight

Why It Shows Up

Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.

Why It Matters

Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.

How to Fix

  • Add a guard near the top of PHP files that are not intended to be requested directly.
  • Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
  • Keep template partials and bootstrap files protected too, not only the main plugin file.

Notes

  • Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.

References

WordPress Coding Standards

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#6001Skyword Publishing API934915400wp function not compatible with requires wp
#6002Teachable931975500Non-prefixed global variable
#6003The Simplest Favicon9330700Missing direct file access protection
#6004Themx Maximum Upload File Size | Increase Maximum Upload File Size9317141k+Text Domain Mismatch
#6005Use Administrator Password9324900Non-prefixed hook name
#6006Product Author for WooCommerce9336500Missing direct file access protection
#6007SharkDropship & Affiliate for AliExpress, eBay, Amazon, Etsy and Temu9310523500Text Domain Mismatch
#6008Payment Gateway bKash for WC939671k+Text Domain Mismatch
#6009External Links – nofollow, noopener & new window93246790k+Non-prefixed global variable
#6010WP Menu Cart9311157k+Non-prefixed hook name
#6011404 Redirection94427k+Missing direct file access protection
#6012404 to Home94611k+wp function not compatible with requires wp
#6013ACF Options For Polylang9492310k+Non-prefixed constant
#6014Addonify Floating Cart For WooCommerce94181211k+Non-prefixed global variable
#6015Advanced Sidebar Menu94511710k+Non-prefixed hook name
#6016Automatically Update Permalinks94222k+Missing nonce verification
#6017Better 404 Redirect To Homepage9433600Missing direct file access protection
#6018Blogger To WordPress941543k+Missing direct file access protection
#6019Certify – Certificate Management & Verification9422500Database parameter is not escaped
#6020Coinbase Commerce Payment Gateway for WooCommerce942154k+Missing Arg Domain
#6021Custom Image Sizes by 99 Robots943526600Text Domain Mismatch
#6022Disable woocommerce logout confirmation9433700trademarked term
#6023Disk Usage Insights943201k+Non-prefixed global variable
#6024Easy Theme and Plugin Upgrades94292070k+Discouraged PHP function
#6025Flawless Themes Demo Importer9439111k+Text Domain Mismatch
#6026فرم ساز فرم افزار9489500Non Enqueued Script
#6027GHL Contact Form 7 Bridge – Send Contact Form 7 leads to GHL CRM94617400Non-prefixed global variable
#6028Gravity Forms IBAN94721500Non-prefixed function
#6029Gravity Forms Zero Spam9449100k+trademarked term
#6030Hello Plus94153880k+Post Not In exclude
#6031LLMs.txt and LLMs-Full.txt Generator941494k+Non-prefixed global variable
#6032Login Lockdown & Protection94515100k+Non-prefixed global variable
#6033Magyar Video Embed94591k+Non-prefixed function
#6034Marquee Addons for Elementor – Essential Motion Widgets & Templates9422420k+Post Not In exclude
#6035MobileMonkey X-Ray Installer9443400Missing direct file access protection
#6036Moving Media Library943272k+Direct Query
#6037No-Indexer9456500Non-prefixed function
#6038Podbean Shortcode94222900wp function not compatible with requires wp
#6039Post Category Prev-Next Link Fix94341k+Missing direct file access protection
#6040Regiones de Chile para WooCommerce9474400trademarked term
#6041Clean Filenames94243k+Missing nonce verification
#6042Sch.gr Commons94651k+Discouraged text-domain loading
#6043Seamless Sticky Custom Post Types94851k+Missing Arg Domain
#6044Shortcode94645500Direct Query
#6045Simple Author Box94126190k+Non-prefixed global variable
#6046Simple Lightbox for WordPress94117400Non Enqueued Script
#6047SKT Blocks – Gutenberg based Page Builder9414251k+Non-prefixed function
#6048Tada: Instant Webpage Loading, Fast Website Browsing9481500Missing direct file access protection
#6049Visual Composer Templates Library942511600Missing direct file access protection
#6050WC City Select94406163k+Missing Arg Domain