PluginScore

missing_direct_file_access_protection

Missing direct file access protection

A PHP file in the plugin can be loaded directly instead of through WordPress.

medium weight

Why It Shows Up

Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.

Why It Matters

Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.

How to Fix

  • Add a guard near the top of PHP files that are not intended to be requested directly.
  • Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
  • Keep template partials and bootstrap files protected too, not only the main plugin file.

Notes

  • Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.

References

WordPress Coding Standards

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#6051Widget Instance94711500Non-prefixed global variable
#6052MyParcel942848k+Non-prefixed global variable
#6053Novalnet Payment Gateway for WooCommerce944581k+Non-prefixed class
#6054WP Plugin Manager – Deactivate plugins per page9418113k+Missing direct file access protection
#6055WP Typograph Lite94841k+trademarked term
#6056WP Sync for Notion – Notion to WordPress9414471k+Non-prefixed hook name
#6057XO Security945330k+wp function not compatible with requires wp
#6058Zotabox – 20+ Promotional Sales tools to boost your subscribers and sales94128500wp function not compatible with requires wp
#6059Sign In Scheduling Online Appointment Booking System9582800No Explicit Version
#6060Accessibility by AudioEye9517162k+Non-prefixed global variable
#6061Pulsating Chat Button952933k+wp function not compatible with requires wp
#6062Art WooCommerce Order One Click9514404k+Non-prefixed global variable
#6063Astrology957221600Non-prefixed global variable
#6064AWSM Team – Team Showcase Plugin957343k+Non-prefixed global variable
#6065Azigen951201k+Missing Arg Domain
#6066BBSpoiler95574k+Missing Version
#6067Better Block Editor (BBE)954535k+Non-prefixed global variable
#6068Booster Pack for Divi951792500Text Domain Mismatch
#6069Bulk Media Register958358k+Non-prefixed hook name
#6070Clicky by Yoast951074k+Missing direct file access protection
#6071Custom Login Page Customizer9535550k+Non-prefixed global variable
#6072Comment Validation9585700Missing Version
#6073Complianz – Terms and Conditions951326300k+Non-prefixed global variable
#6074Gravity Forms ConvertKit Add-On956511700Text Domain Mismatch
#6075Customify95110110k+Non-prefixed global variable
#6076Date counter951221k+Missing direct file access protection
#6077Custom Post Carousels with Owl953272k+Non-prefixed hook name
#6078de_DE951611k+wp function not compatible with requires wp
#6079Disable User Gravatar951423k+wp function not compatible with requires wp
#6080Dokan Menu Hider9582500Text Domain Mismatch
#6081Email Log9555380k+Non-prefixed hook name
#6082Fluid Player9572400Missing direct file access protection
#6083Functionality95621k+date date
#6084Ghost Kit – Page Builder Blocks, Motion Effects & Extensions9517607k+Non-prefixed hook name
#6085Hash Link Scroll Offset95841k+Text Domain Mismatch
#6086Htaccess File Editor – Easily Edit, Backup, Restore .htaccess file9511159k+Non-prefixed global variable
#6087Image Rotation Repair95457k+Deprecated function: _rotate_image_resource
#6088Increase Maximum Upload File Size9563500Missing direct file access protection
#6089jQuery Image Lazy Load WP9574800Not Allowed
#6090Kattene95731k+date date
#6091Language Switcher for Transposh9522681k+Non-prefixed global variable
#6092Lemmony Companion951352k+block api version too low
#6093Liveblog9522341k+Non-prefixed global variable
#6094Live Chat Plugin for WooCommerce – LiveChat9562101k+Text Domain Mismatch
#6095Meta Box951216500k+Non-prefixed hook name
#6096MilesWeb Tools9544910k+Non-prefixed global variable
#6097MotoPress Hotel Booking for Divi9522111k+Missing direct file access protection
#6098Next Page, Not Next Post951201k+wp function not compatible with requires wp
#6099No category parents95546k+Missing direct file access protection
#6100StatCounter – Free Real Time Visitor Stats95411070k+wp function not compatible with requires wp