missing_direct_file_access_protection
Missing direct file access protection
A PHP file in the plugin can be loaded directly instead of through WordPress.
Why It Shows Up
Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.
Why It Matters
Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.
How to Fix
- Add a guard near the top of PHP files that are not intended to be requested directly.
- Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
- Keep template partials and bootstrap files protected too, not only the main plugin file.
Notes
- Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #6501 | Contact Form Clean and Simple | 98 | 2 | 3 | 7k+ | Non-prefixed class | ||
| #6502 | Clean My Archives | 98 | 4 | 0 | 800 | Missing direct file access protection | ||
| #6503 | Clear Floats Button | 98 | 3 | 1 | 2k+ | Missing direct file access protection | ||
| #6504 | Clone Posts | 98 | 5 | 5 | 10k+ | Missing Arg Domain | ||
| #6505 | MomentoPress for Momento360 | 98 | 2 | 3 | 1k+ | Missing Version | ||
| #6506 | Collapsible Categories in the Dashboard | 98 | 3 | 0 | 600 | Missing direct file access protection | ||
| #6507 | Comment Email Reply | 98 | 6 | 2 | 600 | Text Domain Mismatch | ||
| #6508 | Comments Shortcode | 98 | 3 | 1 | 900 | Missing direct file access protection | ||
| #6509 | CookieFirst | GDPR Cookie Consent Banner | 98 | 5 | 0 | 400 | Missing direct file access protection | ||
| #6510 | Counter Block | 98 | 4 | 2 | 1k+ | Missing direct file access protection | ||
| #6511 | Counter-Hits | 98 | 4 | 2 | 1k+ | Missing direct file access protection | ||
| #6512 | Custom Post Type Editor | 98 | 4 | 2 | 2k+ | Missing direct file access protection | ||
| #6513 | Create And Assign Categories For Pages | 98 | 3 | 1 | 10k+ | Missing direct file access protection | ||
| #6514 | Custom Color Palette for Gutenberg | 98 | 2 | 4 | 1k+ | Discouraged text-domain loading | ||
| #6515 | Datawrapper oEmbed | 98 | 3 | 0 | 800 | Missing direct file access protection | ||
| #6516 | Date Published Shortcode | 98 | 3 | 1 | 500 | Missing direct file access protection | ||
| #6517 | ElasticPress Debugging Add-On | 98 | 2 | 10 | 800 | Non-prefixed hook name | ||
| #6518 | Default Media Uploader View | 98 | 3 | 1 | 600 | Missing direct file access protection | ||
| #6519 | Disable Autosave | 98 | 3 | 0 | 400 | Missing direct file access protection | ||
| #6520 | Disable "BIG Image" Threshold | 98 | 3 | 1 | 10k+ | Missing direct file access protection | ||
| #6521 | Disable Block Editor | 98 | 3 | 1 | 800 | Missing direct file access protection | ||
| #6522 | Disable WordPress Core Update Email | 98 | 2 | 3 | 2k+ | trademarked term | ||
| #6523 | Disable Generate Thumbnails | 98 | 1 | 14 | 6k+ | Non-prefixed global variable | ||
| #6524 | Disable Login Language Selector | 98 | 4 | 0 | 1k+ | Missing direct file access protection | ||
| #6525 | Disable Plugin Autoupdate Emails | 98 | 3 | 3 | 6k+ | trademarked term | ||
| #6526 | Disable Real MIME Check | 98 | 3 | 0 | 10k+ | Missing direct file access protection | ||
| #6527 | Disable Updates for WordPress Core, Plugins and Themes | 98 | 2 | 3 | 10k+ | Missing direct file access protection | ||
| #6528 | Disable Welcome Messages and Tips | 98 | 3 | 0 | 800 | Missing direct file access protection | ||
| #6529 | Disable Widget Block Editor | 98 | 3 | 1 | 400 | Missing direct file access protection | ||
| #6530 | Disable All WordPress Updates | 98 | 4 | 6 | 10k+ | trademarked term | ||
| #6531 | Disable XML-RPC Pingback | 98 | 2 | 1 | 60k+ | Missing direct file access protection | ||
| #6532 | DocumentCloud | 98 | 3 | 3 | 1k+ | Missing direct file access protection | ||
| #6533 | Drop Cap Shortcode | 98 | 2 | 2 | 500 | Missing Version | ||
| #6534 | Duplicate Widgets | 98 | 6 | 1 | 3k+ | Text Domain Mismatch | ||
| #6535 | Easy Access Reusable Blocks | 98 | 3 | 3 | 500 | Non-prefixed constant | ||
| #6536 | Easy Add Thumbnail | 98 | 3 | 0 | 7k+ | Missing direct file access protection | ||
| #6537 | Easy Hide Login | 98 | 3 | 12 | 20k+ | Non-prefixed global variable | ||
| #6538 | Map Block | 98 | 2 | 5 | 6k+ | Missing direct file access protection | ||
| #6539 | Easy remove item menu | 98 | 3 | 3 | 6k+ | Discouraged text-domain loading | ||
| #6540 | Easy YouTube Gallery | 98 | 4 | 0 | 500 | Missing direct file access protection | ||
| #6541 | Eazy Enable Blogroll | 98 | 4 | 2 | 2k+ | Missing Arg Domain | ||
| #6542 | Edit Image Thumbnails Separately | 98 | 2 | 1 | 400 | Missing direct file access protection | ||
| #6543 | Eleblog – Elementor Blog And Magazine Addons | 98 | 13 | 1 | 1k+ | Missing direct file access protection | ||
| #6544 | Embed Block for GitHub | 98 | 5 | 2 | 400 | Missing Translators Comment | ||
| #6545 | Enable CORS | 98 | 10 | 2 | 6k+ | Missing direct file access protection | ||
| #6546 | ESTO payment methods | 98 | 15 | 4 | 400 | wp function not compatible with requires wp | ||
| #6547 | Event Block | 98 | 5 | 1 | 1k+ | Missing direct file access protection | ||
| #6548 | FAQ Block For Gutenberg | 98 | 3 | 5 | 4k+ | trademarked term | ||
| #6549 | Featured Image in Content | 98 | 3 | 1 | 700 | Missing direct file access protection | ||
| #6550 | Feeds for TikTok (TikTok feed, video, and gallery plugin) | 98 | 5 | 3 | 70k+ | Missing direct file access protection |
