PluginScore

missing_direct_file_access_protection

Missing direct file access protection

A PHP file in the plugin can be loaded directly instead of through WordPress.

medium weight

Why It Shows Up

Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.

Why It Matters

Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.

How to Fix

  • Add a guard near the top of PHP files that are not intended to be requested directly.
  • Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
  • Keep template partials and bootstrap files protected too, not only the main plugin file.

Notes

  • Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.

References

WordPress Coding Standards

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#701PayPal Brasil para WooCommerce245543291k+Unsafe printing function
#702PDF for Gravity Forms + Drag And Drop Template Builder241,457260400wp function not compatible with requires wp
#703PDF Generator for WordPress Elementor245132711k+Exception output is not escaped
#704PeproDev Ultimate Invoice243792344k+Output is not escaped
#705Database Manager – WP Adminer241,0052,75220k+Non-prefixed global variable
#706PixelYourSite – Your smart PIXEL (TAG) & API Manager241,1762,416500k+Non-prefixed namespace
#707Post Status Notifier Lite24984451700Missing direct file access protection
#708Product Catalog Simple241,5551,9821k+Output is not escaped
#709Post Affiliate Pro24293335500Nonce verification recommended
#710Premium Blocks – Gutenberg Blocks, Patterns & Templates241403082k+Non-prefixed function
#711Premmerce Brands for WooCommerce247001,3442k+Non-prefixed global variable
#712Premmerce Product Filter for WooCommerce248171,4862k+Non-prefixed global variable
#713Product Editor Pro – WooCommerce Bulk Edit: Prices, Stock, Images, Titles, CSV Import & More242,1544,8331k+Non-prefixed global variable
#714Product Tabs Manager for WooCommerce246344822k+Text Domain Mismatch
#715Product Watermark for WooCommerce246854592k+Text Domain Mismatch
#716Products Compare for WooCommerce241,0226951k+Output is not escaped
#717ProfileGrid – User Profiles, Groups and Communities244842,4615k+Non-prefixed global variable
#718Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors2436982020k+Nonce verification recommended
#719Quick Event Manager241523881k+Non-prefixed function
#720Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker244052,60640k+Non-prefixed hook name
#721reGenerate Thumbnails Advanced2422012270k+Unsafe printing function
#722Registrations for the Events Calendar – Event Registration Plugin244049447k+Non-prefixed global variable
#723Related Posts Thumbnails Plugin for WordPress2431441320k+Non-prefixed function
#724Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More24146759100k+Non-prefixed global variable
#725PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes2442158310k+Missing Translators Comment
#726RS WP Book Showcase – A Complete Book Catalogue & Library System249103431k+Text Domain Mismatch
#727RSFirewall!245635214k+Output is not escaped
#728RSVP and Event Management243456243k+Direct Query
#729Sailthru for WordPress242392662k+Non-prefixed global variable
#730Sales Report for WooCommerce246594511k+Output is not escaped
#731Screen Reader Accessibility – WCAG, Text-to-Speech & AI Accessibility Fixes24235330600Non-prefixed global variable
#732Security Plugin, Firewall & Malware Scanner with Auto Removal241,18877030k+Output is not escaped
#733SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress242393041k+Direct Query
#734SEOKEY – Powerful SEO plugin with Expert Insights and SEO Audit246059281k+Non-prefixed global variable
#735SEO Ultimate2443726910k+Output is not escaped
#736Sequential Order Numbers for WooCommerce246984721k+Text Domain Mismatch
#737Servebolt Optimizer241,9586811k+Text Domain Mismatch
#738Service Box Slider246181,410500Non-prefixed global variable
#739Share This Image247441,5821k+Non-prefixed global variable
#740Shortcodes Ultimate – Content Elements246561,552400k+Non-prefixed global variable
#741ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization2492632210k+Output is not escaped
#742Simple Membership242,2971,73440k+Unsafe printing function
#743Simple Social Media Share Buttons – Social Sharing for Everyone2446810120k+Output is not escaped
#744SiteGuard WP Plugin24359350500k+Output is not escaped
#745Sitepact's Contact Form 7 Extension For Klaviyo245411,412500Non-prefixed global variable
#746SKT Templates – 100% Free Templates for Elementor & Gutenberg245531,35320k+Non-prefixed global variable
#747Slider Hero with Video Background, Animation24469043k+Non-prefixed hook name
#748Video Slider – Slider Carousel242082,2033k+Request data is not unslashed
#749Slideshow Gallery LITE248964145k+Output is not escaped
#750Smart Variations Images & Swatches for WooCommerce249901,4861k+Non-prefixed global variable