missing_direct_file_access_protection
Missing direct file access protection
A PHP file in the plugin can be loaded directly instead of through WordPress.
Why It Shows Up
Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.
Why It Matters
Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.
How to Fix
- Add a guard near the top of PHP files that are not intended to be requested directly.
- Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
- Keep template partials and bootstrap files protected too, not only the main plugin file.
Notes
- Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #6201 | List Pages Shortcode | 96 | 5 | 9 | 5k+ | Non-prefixed hook name | ||
| #6202 | Magazine Columns | 96 | 6 | 3 | 600 | wp function not compatible with requires wp | ||
| #6203 | Cool Integration for LearnPress & WooCommerce | 96 | 4 | 4 | 1k+ | trademarked term | ||
| #6204 | MathJax-LaTeX | 96 | 15 | 0 | 10k+ | wp function not compatible with requires wp | ||
| #6205 | Menu Cart Divi | 96 | 26 | 9 | 1k+ | Text Domain Mismatch | ||
| #6206 | Metric Converter | 96 | 4 | 3 | 800 | Missing Version | ||
| #6207 | Modernizr for WordPress | 96 | 5 | 4 | 800 | Deprecated parameter: load_plugin_textdomain parameter 2 | ||
| #6208 | Multicons | 96 | 38 | 0 | 2k+ | wp function not compatible with requires wp | ||
| #6209 | NextGenThemes jsDelivr CDN | 96 | 27 | 0 | 400 | wp function not compatible with requires wp | ||
| #6210 | NoFollow Link | 96 | 5 | 1 | 500 | Missing direct file access protection | ||
| #6211 | Ocultar "Añadir al Carrito" | 96 | 4 | 2 | 600 | Missing direct file access protection | ||
| #6212 | WP Options Importer | 96 | 56 | 4 | 6k+ | Text Domain Mismatch | ||
| #6213 | Divi Masonry Gallery – Pro Gallery | 96 | 54 | 16 | 2k+ | Text Domain Mismatch | ||
| #6214 | Permalink Trailing Slash Fixer | 96 | 4 | 2 | 700 | Missing direct file access protection | ||
| #6215 | Plugins Condition | 96 | 3 | 30 | 1k+ | Non-prefixed global variable | ||
| #6216 | Porn Videos Embed | 96 | 17 | 2 | 2k+ | Missing direct file access protection | ||
| #6217 | Preloader Awesome – Page Loading Animation with Spinner & Gif | 96 | 32 | 7 | 1k+ | Missing direct file access protection | ||
| #6218 | Pretty Google Calendar | 96 | 12 | 4 | 5k+ | wp function not compatible with requires wp | ||
| #6219 | Prevent Direct Access – Protect WordPress Files | 96 | 4 | 26 | 10k+ | Non-prefixed constant | ||
| #6220 | Progress Bar | 96 | 52 | 1 | 1k+ | Text Domain Mismatch | ||
| #6221 | PWA | 96 | 34 | 3 | 20k+ | Missing direct file access protection | ||
| #6222 | Remove Unrestricted Uploads | 96 | 5 | 3 | 1k+ | Missing direct file access protection | ||
| #6223 | Require Post Category | 96 | 6 | 4 | 1k+ | Discouraged text-domain loading | ||
| #6224 | REST API Meta Support | 96 | 9 | 1 | 7k+ | wp function not compatible with requires wp | ||
| #6225 | RSWPTHEMES ONE CLICK DEMO CONTENT | 96 | 68 | 5 | 1k+ | Missing Arg Domain | ||
| #6226 | RSS Featured Image | 96 | 4 | 2 | 2k+ | Missing direct file access protection | ||
| #6227 | Russian Date by Axelnsk | 96 | 5 | 1 | 500 | Missing direct file access protection | ||
| #6228 | Selection Sharer by Hans van Gent | 96 | 6 | 4 | 2k+ | wp function not compatible with requires wp | ||
| #6229 | Share on Mastodon | 96 | 24 | 3 | 1k+ | wp function not compatible with requires wp | ||
| #6230 | Show User Registration Date | 96 | 4 | 4 | 1k+ | Non-prefixed function | ||
| #6231 | Smartsupp – live chat, AI shopping assistant and chatbots | 96 | 16 | 4 | 20k+ | wp function not compatible with requires wp | ||
| #6232 | Tag Cloud Shortcode | 96 | 5 | 1 | 500 | Missing direct file access protection | ||
| #6233 | Taxonomy List Widget | 96 | 6 | 3 | 1k+ | wp function not compatible with requires wp | ||
| #6234 | Team Members | 96 | 15 | 16 | 20k+ | Missing direct file access protection | ||
| #6235 | Text Spinner | 96 | 6 | 1 | 1k+ | wp function not compatible with requires wp | ||
| #6236 | Timeline Express – Single Column Add-On | 96 | 5 | 4 | 500 | Text Domain Mismatch | ||
| #6237 | Title and Nofollow For Links (Classic Editor) | 96 | 17 | 2 | 30k+ | Missing Arg Domain | ||
| #6238 | Tooltip for Gravity Forms | 96 | 23 | 10 | 900 | Text Domain Mismatch | ||
| #6239 | Top Level Categories | 96 | 5 | 1 | 2k+ | Missing direct file access protection | ||
| #6240 | Unfiltered MU | 96 | 5 | 2 | 3k+ | Discouraged WordPress constant usage: MUPLUGINDIR | ||
| #6241 | Video User Manuals | 96 | 15 | 3 | 10k+ | Missing Arg Domain | ||
| #6242 | VK Dynamic If Block | 96 | 8 | 6 | 3k+ | date date | ||
| #6243 | VLibras | 96 | 6 | 2 | 5k+ | Missing direct file access protection | ||
| #6244 | Custom Product tabs for WooCommerce | 96 | 25 | 6 | 10k+ | wp function not compatible with requires wp | ||
| #6245 | Product Category Showcase for WooCommerce | 96 | 8 | 45 | 1k+ | Non-prefixed global variable | ||
| #6246 | What Template File Am I Viewing? | 96 | 7 | 0 | 1k+ | wp function not compatible with requires wp | ||
| #6247 | Wikipedia Preview | 96 | 8 | 15 | 1k+ | Non-prefixed function | ||
| #6248 | Cart Weight for WooCommerce | 96 | 5 | 12 | 1k+ | Non-prefixed global variable | ||
| #6249 | Dynamic Pricing & Discounts Lite | 96 | 35 | 1 | 400 | Missing direct file access protection | ||
| #6250 | WooCommerce Product Details Customiser | 96 | 5 | 6 | 2k+ | trademarked term |
