missing_direct_file_access_protection
Missing direct file access protection
A PHP file in the plugin can be loaded directly instead of through WordPress.
Why It Shows Up
Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.
Why It Matters
Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.
How to Fix
- Add a guard near the top of PHP files that are not intended to be requested directly.
- Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
- Keep template partials and bootstrap files protected too, not only the main plugin file.
Notes
- Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #6451 | WP Maximum Execution Time Exceeded | 97 | 4 | 3 | 20k+ | trademarked term | ||
| #6452 | WP-NoIndex | 97 | 4 | 2 | 400 | trademarked term | ||
| #6453 | WP-Post-Meta-Revisions | 97 | 5 | 3 | 400 | Missing direct file access protection | ||
| #6454 | WP Print Friendly | 97 | 5 | 3 | 500 | trademarked term | ||
| #6455 | WP Responsive Auto Fit Text | 97 | 11 | 6 | 600 | wp function not compatible with requires wp | ||
| #6456 | WP-RTL | 97 | 4 | 5 | 2k+ | trademarked term | ||
| #6457 | WP Sanitize File Name Plus | 97 | 3 | 5 | 1k+ | trademarked term | ||
| #6458 | WP-Stateless – Gravity Forms Addon | 97 | 2 | 9 | 400 | Non-prefixed hook name | ||
| #6459 | Smart Coupons For WooCommerce Coupons | 97 | 3 | 58 | 30k+ | Non-prefixed class | ||
| #6460 | Wufoo Shortcode | 97 | 3 | 3 | 10k+ | Missing direct file access protection | ||
| #6461 | Yoycol Integration for WooCommerce | 97 | 4 | 4 | 400 | Missing Version | ||
| #6462 | ZIP from Media | 97 | 4 | 16 | 400 | Non-prefixed global variable | ||
| #6463 | Zone Manager (Zoninator) | 97 | 5 | 2 | 2k+ | Missing direct file access protection | ||
| #6464 | Accessibility Widget by OneTap – Easy One-Click Accessibility Toolbar | 98 | 4 | 18 | 50k+ | Non-prefixed global variable | ||
| #6465 | Advanced Custom Fields: Unique ID Field | 98 | 4 | 2 | 3k+ | Missing direct file access protection | ||
| #6466 | ActBlue Contributions | 98 | 2 | 3 | 400 | Missing direct file access protection | ||
| #6467 | Add Custom Header Images | 98 | 2 | 4 | 400 | Missing direct file access protection | ||
| #6468 | Admin Sticky Sidebar | 98 | 2 | 3 | 800 | Missing direct file access protection | ||
| #6469 | Admin Toolbar Menus | 98 | 2 | 1 | 1k+ | Missing direct file access protection | ||
| #6470 | Advanced Disable Parent Menu Link | 98 | 3 | 0 | 600 | Missing direct file access protection | ||
| #6471 | Advanced Image Styles | 98 | 3 | 1 | 9k+ | Missing direct file access protection | ||
| #6472 | Advanced Post Excerpt | 98 | 2 | 2 | 2k+ | Non-prefixed hook name | ||
| #6473 | Ajax Load More for Advanced Custom Fields | 98 | 3 | 1 | 2k+ | Missing direct file access protection | ||
| #6474 | Allow Cyrillic Usernames | 98 | 3 | 0 | 600 | Missing direct file access protection | ||
| #6475 | Allow ePUB and MOBI formats upload | 98 | 2 | 2 | 2k+ | Missing direct file access protection | ||
| #6476 | Always Use Open Graph with Jetpack | 98 | 2 | 1 | 500 | Missing direct file access protection | ||
| #6477 | Style Kits for Elementor | 98 | 2 | 15 | 10k+ | Non-prefixed constant | ||
| #6478 | App for Cloudflare® | 98 | 10 | 1 | 1k+ | wp function not compatible with requires wp | ||
| #6479 | Augmented Reality Viewer – 3D Model Viewer | 98 | 5 | 2 | 500 | wp function not compatible with requires wp | ||
| #6480 | Auto Copyright Year Updater | 98 | 3 | 0 | 3k+ | Missing direct file access protection | ||
| #6481 | Disable Gutenberg | 98 | 2 | 2 | 600 | trademarked term | ||
| #6482 | Auto SEO | 98 | 3 | 12 | 500 | Non-prefixed global variable | ||
| #6483 | Auto Submenu | 98 | 2 | 2 | 2k+ | Missing direct file access protection | ||
| #6484 | Auto Updates | 98 | 2 | 2 | 1k+ | Missing direct file access protection | ||
| #6485 | Automatic image ALT attributes | 98 | 4 | 0 | 1k+ | Missing direct file access protection | ||
| #6486 | Autover | 98 | 4 | 0 | 800 | Missing direct file access protection | ||
| #6487 | Better REST API Featured Images | 98 | 4 | 1 | 2k+ | Deprecated parameter: load_plugin_textdomain parameter 2 | ||
| #6488 | Bit Social – Social Media Auto Poster and Scheduler | 98 | 10 | 1 | 6k+ | wp function not compatible with requires wp | ||
| #6489 | Blocks Export Import – Backup & Move Gutenberg Blocks as JSON | 98 | 2 | 11 | 1k+ | Non-prefixed global variable | ||
| #6490 | Broken Link Checker by AIOSEO – Find & Fix Broken Internal, External & Video Links | 98 | 1 | 15 | 300k+ | Non-prefixed global variable | ||
| #6491 | Bulglish Permalinks | 98 | 3 | 1 | 3k+ | Missing direct file access protection | ||
| #6492 | Cachebuster | 98 | 3 | 1 | 1k+ | Missing direct file access protection | ||
| #6493 | Callout | 98 | 3 | 1 | 400 | Missing direct file access protection | ||
| #6494 | Category Archives Block | 98 | 14 | 5 | 900 | Missing Arg Domain | ||
| #6495 | Category Checklist Tree | 98 | 3 | 0 | 5k+ | Missing direct file access protection | ||
| #6496 | Category and Subcategory List Widget | 98 | 2 | 3 | 700 | Not In Footer | ||
| #6497 | cbnet Ping Optimizer | 98 | 3 | 0 | 1k+ | Missing direct file access protection | ||
| #6498 | City Dropdown For Woocommerce | 98 | 6 | 3 | 400 | Text Domain Mismatch | ||
| #6499 | Clariti | 98 | 3 | 1 | 1k+ | Missing direct file access protection | ||
| #6500 | Contact Form Clean and Simple | 98 | 2 | 3 | 7k+ | Non-prefixed class |
