missing_direct_file_access_protection
Missing direct file access protection
A PHP file in the plugin can be loaded directly instead of through WordPress.
Why It Shows Up
Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.
Why It Matters
Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.
How to Fix
- Add a guard near the top of PHP files that are not intended to be requested directly.
- Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
- Keep template partials and bootstrap files protected too, not only the main plugin file.
Notes
- Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #6551 | ESTO payment methods | 98 | 15 | 4 | 400 | wp function not compatible with requires wp | ||
| #6552 | Event Block | 98 | 5 | 1 | 1k+ | Missing direct file access protection | ||
| #6553 | FAQ Block For Gutenberg | 98 | 3 | 5 | 4k+ | trademarked term | ||
| #6554 | Featured Image in Content | 98 | 3 | 1 | 700 | Missing direct file access protection | ||
| #6555 | Feeds for TikTok (TikTok feed, video, and gallery plugin) | 98 | 5 | 3 | 70k+ | Missing direct file access protection | ||
| #6556 | File Upload Types by WPForms | 98 | 2 | 9 | 40k+ | Non-prefixed function | ||
| #6557 | Filenames to latin | 98 | 2 | 1 | 9k+ | Missing direct file access protection | ||
| #6558 | Filter for Elementor | 98 | 3 | 0 | 700 | Missing direct file access protection | ||
| #6559 | Find My Blocks – Locate blocks on your site | 98 | 2 | 7 | 4k+ | Non-prefixed function | ||
| #6560 | Flexible Table Block | 98 | 4 | 7 | 40k+ | Non-prefixed constant | ||
| #6561 | Footer Credits | 98 | 3 | 2 | 1k+ | Missing direct file access protection | ||
| #6562 | Formsite | Embed online forms to collect orders, registrations, leads, and surveys | 98 | 3 | 2 | 900 | Missing direct file access protection | ||
| #6563 | Fusion Page Builder : Extension – Image | 98 | 4 | 2 | 500 | Missing direct file access protection | ||
| #6564 | Lightbox for Gallery & Image Block | 98 | 3 | 0 | 20k+ | Missing direct file access protection | ||
| #6565 | Genesis Simple Menus | 98 | 3 | 15 | 2k+ | Non-prefixed global variable | ||
| #6566 | Genesis Simple Share | 98 | 3 | 0 | 10k+ | Missing direct file access protection | ||
| #6567 | Google Tag Manager | 98 | 7 | 4 | 10k+ | wp function not compatible with requires wp | ||
| #6568 | Gravity Forms Personality Quiz Add-On | 98 | 7 | 3 | 500 | Text Domain Mismatch | ||
| #6569 | GravityWP – Count | 98 | 2 | 3 | 2k+ | trademarked term | ||
| #6570 | GravityWP – CSS Selector | 98 | 2 | 4 | 4k+ | trademarked term | ||
| #6571 | Grid Columns | 98 | 3 | 0 | 1k+ | Missing direct file access protection | ||
| #6572 | Guest Author | 98 | 6 | 1 | 5k+ | Missing direct file access protection | ||
| #6573 | GUI for List Category Posts | 98 | 6 | 1 | 600 | Missing direct file access protection | ||
| #6574 | Gutenbye | 98 | 4 | 0 | 700 | Missing direct file access protection | ||
| #6575 | Hide Admin Bar from Non-Admins | 98 | 3 | 1 | 10k+ | Missing direct file access protection | ||
| #6576 | Hide Admin Toolbar | 98 | 3 | 1 | 9k+ | Missing direct file access protection | ||
| #6577 | Jetpack Without Promotions | 98 | 2 | 2 | 1k+ | trademarked term | ||
| #6578 | Hide Prices for WooCommerce | 98 | 4 | 3 | 800 | Missing direct file access protection | ||
| #6579 | Hide Text Shortcode | 98 | 4 | 0 | 400 | Missing direct file access protection | ||
| #6580 | Hide This | 98 | 3 | 1 | 2k+ | Missing direct file access protection | ||
| #6581 | Hide Comment Author Link | 98 | 4 | 1 | 1k+ | Missing direct file access protection | ||
| #6582 | Highlight Search Terms | 98 | 4 | 0 | 7k+ | Missing direct file access protection | ||
| #6583 | HyperPay Payments | 98 | 4 | 0 | 600 | Missing direct file access protection | ||
| #6584 | iFrame Block | 98 | 4 | 0 | 800 | Missing direct file access protection | ||
| #6585 | Image Comparison Block | 98 | 3 | 2 | 1k+ | Missing direct file access protection | ||
| #6586 | Image Rotation Fixer | 98 | 3 | 1 | 1k+ | Missing direct file access protection | ||
| #6587 | WP Image Size Selection | 98 | 3 | 2 | 1k+ | Missing direct file access protection | ||
| #6588 | Inline Image Upload for BBPress | 98 | 3 | 1 | 3k+ | Missing direct file access protection | ||
| #6589 | Insert Giphy Block | 98 | 3 | 1 | 700 | Missing direct file access protection | ||
| #6590 | International Telephone Input With Flags And Dial Codes | 98 | 7 | 7 | 1k+ | badly named files | ||
| #6591 | Sharing buttons shortcode for Jetpack | 98 | 3 | 2 | 800 | Missing direct file access protection | ||
| #6592 | Keep Emoticons as Text | 98 | 3 | 1 | 700 | Missing direct file access protection | ||
| #6593 | ZZAZZ | 98 | 8 | 2 | 500 | Missing direct file access protection | ||
| #6594 | ToneDen Shortcode | 98 | 3 | 0 | 2k+ | Missing direct file access protection | ||
| #6595 | Last Viewed Posts by WPBeginner | 98 | 3 | 4 | 500 | Missing direct file access protection | ||
| #6596 | Layout Grid Block | 98 | 5 | 1 | 200k+ | Missing direct file access protection | ||
| #6597 | Lazy Load | 98 | 4 | 0 | 10k+ | Missing direct file access protection | ||
| #6598 | Lili Business Banking | 98 | 18 | 0 | 1k+ | Text Domain Mismatch | ||
| #6599 | Link Manager | 98 | 4 | 0 | 20k+ | Missing direct file access protection | ||
| #6600 | List Sub Pages | 98 | 4 | 0 | 400 | Missing direct file access protection |
